Who hasn't at least once deleted a file permanently by mistake and then pester against this wrong manipulation? Who didn't have at least once a USB stick or camera memory card on which all the files had “disappeared”?
I have recently experienced a “crash” fatal disk for my system since boot areas have been altered to the point that a OS restoration could not unfold completely without crashing.
Fortunately, I had my USB external hard drive with Ubuntu 9.04 installed (my Portable PC is “USB bootable”) and I discovered the “PhotoRec” tool with which I was able to recover some files that I had left on my desktop (by lazy because they are usually still on another disk).
I will introduce, in the following paragraphs, a simple use of PhotoRec Windows version. The operation remains the same with the Ubuntu version (Linux 2.4.x or 2.6.x).
N.B. : the associated TestDisk tool will not be presented here although it was very useful to make my disc again “visible” by Ubuntu before using PhotoRec.
PhotoRec can be downloaded via the link below. Opt for the Windows version. Its installation is simple: simply unzip the ZIP file in the directory of your choice. The PhotoRec application can be accessed in the directory ..\TestDisk-6.11.3\win\photorec_win.exe.
The PhotoRec app works in console mode.
It is entirely in English; I did not try to find out if there was a translation into French.
It is difficult to present the application further without having an example of use, which is why I suggest that you go into the heart of the subject with a specific case.
Concrete use: restoring an XLS file
I will use a USB stick on which I have the following files:
Let’s permanently delete the file Loads-JPD.xls either by removing it and draining the recycle bin or by the combination of keys SHIFT+DELETE.
Let’s go back to the PhotoRec console and try to get this file back. Select the right media (CBM Flash Disk) and click with [Proceed]
The following screen offers us to choose the type of partition of the media. We select [Intel].
N.B. : as you can see, the XBox partition is also available...
Then select the correct score; as far as we are concerned Fat16 > 32M.
Before validating the search with [Search] we will set the file type sought by PhotoRec by choosing [File Opt].
We turn off the default selection with the key s.
We scroll the list with the arrows Top and Low keypad to select doc Microsoft Office Document with the key Space. Save this choice with the key B and to end with the touch Entry to return to the partition selection screen.
Let’s validate the search with [Search]. The next step will offer us to choose the type of filesystem of the media; let’s choose [Other].
Let’s now select the type of space to analyse:
- [Free] to analyse only the unallocated space. This option only recovers deleted files;
- [Whole] to analyse the entire media. This option is useful in case of faulty or corrupt filesystem;
For our case, we select [Free].
Before definitively analysing the media and recovering the file(s), PhotoRec proposes to select the storage location of recovered file(s).
You will notice that I use the singular and plural for the file(s) to be recovered. PhotoRec is capable of recovering temporary files, which is why it will recover more than one file.
We choose the storage folder using the arrows Top and Low the keyboard as well as the line ending with .. to go up one level in the directories. Once the choice is made, we validate it with the key Y.
Once the key is Y pressed the following screen appears:
The final screen after the analysis is as follows:
We find that PhotoRec recovered 2 files. Let’s see in the recovery directory:
Files are not named as they were before deletion; nevertheless, we can access it.
After checking, the first file is a temporary file (39 KB) and the second (53 KB) the file actually deleted at the beginning of this presentation.
Use after quick formatting
Fast formatting simply emptys the file allocation table (the media index) without actually destroying the files.
After this quick formatting we repeat all the steps above to recover the same file and we get the same result.
PhotoRec is a quick and efficient utility to recover lost files. However, it can quickly become complex to use (including checking recovered files) in case of many files to process. In this case, I advise you to avoid selecting multiple file types and proceeding with iterations.