Rendered at 19:38:29 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
nickcw 1 days ago [-]
I love photorec and dd rescue. I have recovered many many disks and memory cards with it.
I even recovered a card that had been off to professional recovery and deemed unrecoverable. I think half the memory chips in the card were fried so I used DD rescue to recover what data I could and then photorec to sift the wreckage. The owner was delighted to receive some of the photos.
If you ever have to do this, use DD rescue to image the source media as a first step. Sometimes you don't get a second read!
xmeadow 23 hours ago [-]
You say it. A few years ago my homeserver behalved odd and i needed reboots. I took out the SSD, used dd-rescue and after that The SSD did not even show up as storage any more. Yhea. I also have backups since then. :)
gffrd 1 days ago [-]
PhotoRec saved my ass just earlier this week, after an accidental wipe of a CompactFlash card with client photos on it.
As another commenter noted, create an exact dupe/image of the volume as the very first thing you do.
Also: if it doesn't successfully retrieve files on the first go, try another configuration. I think it took me 3 attempts to get it right.
A fun perk, also noted in the article: you may get back some surprises along with the files you expect - older files revealed in the sediment!
doubled112 17 hours ago [-]
> may get back some surprises along with the files you expect - older files revealed in the sediment
One time a customer brought their computer in. She had wiped and reloaded the system through the recovery partition and didn't understand the big red text stating that all of her data would be removed.
I let her know we might be able to recover some of the data. She agreed that only the photos were important, so I let PhotoRec do its thing.
A few hours later, a panicked husband called worried his wife would find porn in the recovery. We charged him extra to clean up what was basically junk from the Internet Explorer cache. Not an extortionate amount, but extra. I think we could have asked for anything at that moment.
wazoox 6 hours ago [-]
Ah ah I was asked by my boss to repair his work laptop after windows shat itself, and the porn stash was one of the first thing to become restored among his work documents
exe34 10 hours ago [-]
Haha my friend nuked his hdd somehow and asked me to recover his pictures. I also found all his porn, which thankfully was very much vanilla.
1970-01-01 6 hours ago [-]
Still waiting for someone to tackle file-based encryption. As devices are slowly being sucked into the Android universe, the need to break it to recover files is slowly creeping up on us and we have no solution.
el_benhameen 23 hours ago [-]
My folks gave me a big box of hard drives from various family computers over the years. Learning to use ddrescue and photorec to get data off of them was a ton of fun. Really cool tools, and not wildly unfriendly to someone who’d never used them before. I even managed to recover the drive that crashed a few days before the start of my junior year of high school, leaving me to re-write all of my summer homework in a panic. A little late on that one.
dabinat 20 hours ago [-]
PhotoRec has saved me many times. But I have noticed that the results aren’t nearly as good for Mac file formats or video, especially professional video formats. A lot of videos I’ve tried to recover have failed. I wish that there was an app like this for those formats, but I understand that may be more of a niche market for them.
ce4 8 hours ago [-]
You can try "foremost", it isnt as easy to use but a bit more configurable - at least from memory (I have used it many years ago)
zeron0a 15 hours ago [-]
Deleted files becomes reclaimable space. Delayed recovery makes those files unrecoverable.
EvanAnderson 21 hours ago [-]
I hit every thrift store storage device with photorec. I also use it on storage devices I'm getting rid of, just to be sure.
dspillett 20 hours ago [-]
> storage devices I'm getting rid of
When discarding storage, I do a random pass (even if the drive has always been part of an encrypted-at-rest arrangement, if only for the sake of habit), then a zero sweep, then it gets a filesystem created and filled with many copies of a few cat photos/videos¹² to give anyone running something like photorec a treat, then the partition table is emptied.
--------
[1] With filenames to suggest a bumper collection of photo/video backups from several people's phones/cameras, with some porn accidentally mixed in.
[2] If I'm in an evil mood the “treat” filesystem is filled with shock images and Rick Astley instead.
exe34 10 hours ago [-]
I like to do a low level format. With a hammer.
code_biologist 20 hours ago [-]
Anybody got tips for making custom signatures work? I'm trying to rescue Unreal Engine game save files off an EXT4 drive where the containing directory was deleted. I put the `sav 0 "GVAS"` (GVAS is the UE save magic value) in my `.photorec.sig`. `fidentify` correctly works on reference UE saves I have. Grepping the raw partition device finds many hits for GVAS, but photorec runs and doesn't recover any files...
Honestly an AI model might be fairly okay at this?
sikozu 20 hours ago [-]
At the end of the article I was hoping he'd show a couple of images he managed to recover, just to end it on a fun and satisfying note. I liked the article otherwise though.
gblargg 14 hours ago [-]
I assumed he recovered all the memes he used in the article. /s
emmelaich 1 days ago [-]
Photorec is great and has improved over the years; it did way better in 2010s than it had done in the early 2000s. (I have a dd image of a corrupt disk of baby photos.)
I even recovered a card that had been off to professional recovery and deemed unrecoverable. I think half the memory chips in the card were fried so I used DD rescue to recover what data I could and then photorec to sift the wreckage. The owner was delighted to receive some of the photos.
If you ever have to do this, use DD rescue to image the source media as a first step. Sometimes you don't get a second read!
As another commenter noted, create an exact dupe/image of the volume as the very first thing you do.
Also: if it doesn't successfully retrieve files on the first go, try another configuration. I think it took me 3 attempts to get it right.
A fun perk, also noted in the article: you may get back some surprises along with the files you expect - older files revealed in the sediment!
One time a customer brought their computer in. She had wiped and reloaded the system through the recovery partition and didn't understand the big red text stating that all of her data would be removed.
I let her know we might be able to recover some of the data. She agreed that only the photos were important, so I let PhotoRec do its thing.
A few hours later, a panicked husband called worried his wife would find porn in the recovery. We charged him extra to clean up what was basically junk from the Internet Explorer cache. Not an extortionate amount, but extra. I think we could have asked for anything at that moment.
When discarding storage, I do a random pass (even if the drive has always been part of an encrypted-at-rest arrangement, if only for the sake of habit), then a zero sweep, then it gets a filesystem created and filled with many copies of a few cat photos/videos¹² to give anyone running something like photorec a treat, then the partition table is emptied.
--------
[1] With filenames to suggest a bumper collection of photo/video backups from several people's phones/cameras, with some porn accidentally mixed in.
[2] If I'm in an evil mood the “treat” filesystem is filled with shock images and Rick Astley instead.
[1] https://www.cgsecurity.org/testdisk_doc/photorec_custom_sign...
This reminds me to try it again.