Recovering files from beyond the grave using PhotoRec

At the end of the article I was hoping he'd show a couple of images he managed to recover, just to end it on a fun and satisfying note. I liked the article otherwise though.

PhotoRec has saved me many times. But I have noticed that the results aren’t nearly as good for Mac file formats or video, especially professional video formats. A lot of videos I’ve tried to recover have failed. I wish that there was an app like this for those formats, but I understand that may be more of a niche market for them.

Anybody got tips for making custom signatures work? I'm trying to rescue Unreal Engine game save files off an EXT4 drive where the containing directory was deleted. I put the `sav 0 "GVAS"` (GVAS is the UE save magic value) in my `.photorec.sig`. `fidentify` correctly works on reference UE saves I have. Grepping the raw partition device finds many hits for GVAS, but photorec runs and doesn't recover any files...

[1] https://www.cgsecurity.org/testdisk_doc/photorec_custom_sign...

I love photorec and dd rescue. I have recovered many many disks and memory cards with it.

I even recovered a card that had been off to professional recovery and deemed unrecoverable. I think half the memory chips in the card were fried so I used DD rescue to recover what data I could and then photorec to sift the wreckage. The owner was delighted to receive some of the photos.

If you ever have to do this, use DD rescue to image the source media as a first step. Sometimes you don't get a second read!

PhotoRec saved my ass just earlier this week, after an accidental wipe of a CompactFlash card with client photos on it.

As another commenter noted, create an exact dupe/image of the volume as the very first thing you do.

Also: if it doesn't successfully retrieve files on the first go, try another configuration. I think it took me 3 attempts to get it right.

A fun perk, also noted in the article: you may get back some surprises along with the files you expect - older files revealed in the sediment!

My folks gave me a big box of hard drives from various family computers over the years. Learning to use ddrescue and photorec to get data off of them was a ton of fun. Really cool tools, and not wildly unfriendly to someone who’d never used them before. I even managed to recover the drive that crashed a few days before the start of my junior year of high school, leaving me to re-write all of my summer homework in a panic. A little late on that one.

I hit every thrift store storage device with photorec. I also use it on storage devices I'm getting rid of, just to be sure.

Photorec is great and has improved over the years; it did way better in 2010s than it had done in the early 2000s. (I have a dd image of a corrupt disk of baby photos.)

This reminds me to try it again.