Categories Windows 7, Windows Vista

PhotoRec, or how to recover lost files


Who hasn't at least once deleted a file permanently by mistake and then pester against this wrong manipulation? Who didn't have at least once a USB stick or camera memory card on which all the files had “disappeared”?

Presentation

I have recently experienced a “crash” fatal disk for my system since boot areas have been altered to the point that a OS restoration could not unfold completely without crashing.
Fortunately, I had my USB external hard drive with Ubuntu 9.04 installed (my Portable PC is “USB bootable”) and I discovered the “PhotoRec” tool with which I was able to recover some files that I had left on my desktop (by lazy because they are usually still on another disk).

I will introduce, in the following paragraphs, a simple use of PhotoRec Windows version. The operation remains the same with the Ubuntu version (Linux 2.4.x or 2.6.x).

N.B. : the associated TestDisk tool will not be presented here although it was very useful to make my disc again “visible” by Ubuntu before using PhotoRec.

Installation

PhotoRec can be downloaded via the link below. Opt for the Windows version. Its installation is simple: simply unzip the ZIP file in the directory of your choice. The PhotoRec application can be accessed in the directory ..\TestDisk-6.11.3\win\photorec_win.exe.

PhotoRec (1.4) MiB, 3,778 downloads)

The PhotoRec app works in console mode.

Capture décran - PhotoRec, présentation de la console
Screenshot — PhotoRec, console presentation

It is entirely in English; I did not try to find out if there was a translation into French.

It is difficult to present the application further without having an example of use, which is why I suggest that you go into the heart of the subject with a specific case.

Concrete use: restoring an XLS file

I will use a USB stick on which I have the following files:

Capture décran - Explorateur Windows, liste de fichiers de tests
Screenshot — Windows Explorer, Test File List

Let’s permanently delete the file Loads-JPD.xls either by removing it and draining the recycle bin or by the combination of keys SHIFT+DELETE.

Capture décran - Explorateur Windows, suppression du fichier Excel
Screenshot of screen — Windows Explorer, delete Excel file

Let’s go back to the PhotoRec console and try to get this file back. Select the right media (CBM Flash Disk) and click with [Proceed]

Capture décran - PhotoRec, sélection du média
Screenshot — PhotoRec, Media Selection

The following screen offers us to choose the type of partition of the media. We select [Intel].

N.B. : as you can see, the XBox partition is also available...

Capture décran - PhotoRec, sélection du type de partition
Screenshot of screen — PhotoRec, selection of partition type

Then select the correct score; as far as we are concerned Fat16 > 32M.

Capture décran - PhotoRec, choix de la partition adéquate
Screenshot of screen — PhotoRec, choice of appropriate partition

Before validating the search with [Search] we will set the file type sought by PhotoRec by choosing [File Opt].

Capture décran - PhotoRec, choix du type de fichiers à restaurer
Screenshot of screen — PhotoRec, choice of file type to restore

We turn off the default selection with the key s.

Capture décran - PhotoRec, désactivation de la sélection par défaut
Screenshot of screen — PhotoRec, disabling the default selection

We scroll the list with the arrows Top and Low keypad to select doc Microsoft Office Document with the key Space. Save this choice with the key B and to end with the touch Entry to return to the partition selection screen.

Capture décran - PhotoRec, recherche des fichiers Microsoft Office
Screenshot of screen — PhotoRec, search for Microsoft Office files

Let’s validate the search with [Search]. The next step will offer us to choose the type of filesystem of the media; let’s choose [Other].

Capture d'écran - PhotoRec, choix du type de partition
Screenshot — PhotoRec, choice of partition type

Let’s now select the type of space to analyse:

Capture décran - PhotoRec, sélection du type despace pour lanalyse
Screenshot — PhotoRec, selection of space type for analysis
  • [Free] to analyse only the unallocated space. This option only recovers deleted files;
  • [Whole] to analyse the entire media. This option is useful in case of faulty or corrupt filesystem;

For our case, we select [Free].

Before definitively analysing the media and recovering the file(s), PhotoRec proposes to select the storage location of recovered file(s).

You will notice that I use the singular and plural for the file(s) to be recovered. PhotoRec is capable of recovering temporary files, which is why it will recover more than one file.

Capture décran - PhotoRec, choix de l'espace à analyser
Screenshot — PhotoRec, choice of space to analyse

We choose the storage folder using the arrows Top and Low the keyboard as well as the line ending with .. to go up one level in the directories. Once the choice is made, we validate it with the key Y.

Capture décran - PhotoRec, définition du dossier cible de la sauvegarde
Screenshot of screen — PhotoRec, setting the target folder of the backup

Once the key is Y pressed the following screen appears:

Capture décran - PhotoRec, restauration en cours
Screenshot — PhotoRec, restoration in progress

The final screen after the analysis is as follows:

Capture décran - PhotoRec, récupération de fichiers terminée
Screenshot — PhotoRec, File Recovery Completed

We find that PhotoRec recovered 2 files. Let’s see in the recovery directory:

Capture décran - PhotoRec, présence des fichiers restaurés sur la clé USB
Screenshot of screen — PhotoRec, presence of restored files on USB stick

Files are not named as they were before deletion; nevertheless, we can access it.
After checking, the first file is a temporary file (39 KB) and the second (53 KB) the file actually deleted at the beginning of this presentation.

Use after quick formatting

Fast formatting simply emptys the file allocation table (the media index) without actually destroying the files.
After this quick formatting we repeat all the steps above to recover the same file and we get the same result.

PhotoRec is a quick and efficient utility to recover lost files. However, it can quickly become complex to use (including checking recovered files) in case of many files to process. In this case, I advise you to avoid selecting multiple file types and proceeding with iterations.

12 comments

Leave a Reply

  • I'm just writing a post about some data recovery software. In my case this concerns a USB stick. PhotoRec works well but it is impossible to reorganise all of its files because it is unable to find the name of the files. So for a file it goes, for 1000 better turn to other solutions

  • I use it to recover my mistakenly erased photos from my SD cards
    The point to emphasise is that you have to have the right reflex right after the unwanted erasure: limit disk accesses to be sure to be able to recover data.

  • JP Douet

    Good morning

    @mimi: it is the Windows console that opens natively in a window like any other software. The screen copies are therefore made with a “simple” ALT+IMPECR.

    CDT

  • Jeanjean

    Hello everyone,
    How do we find a file whose extansion is not included in the software list? In the case my searched extansion is a backup file “.ess”

    Thank you

  • Jeanjean

    Thank you jpdouet,

    For the link, I admit that I have already visited this page but I do not really understand it, at least this paragraph:

    How to verify if PhotoRec already detect the file format?

    There are command lines and I don't see or use them in Photorec logcieil, yet I seem to have been looking well...

    In the meantime, I became interested in the logicel VERIFY MY FILES, which is more intuitive and has enabled me to find my file thanks to the search by date very well ficelee.
    The only problem, once the file is reestablished, transfers to my good hard disk, revert to its folder and rename it, and well the file appears as CORROMPU when I use it.

    My file has an extension.ess and is a SKYRIM backup file. The error message is: the savegame can be loaded beacause it is outdated. ITS version is 0 and the current version is 8”

    So now I'm pretty stuck.

    I want everything to recover my file with Photorec which can be, will find me my file in better condition.

    If someone finds a solution to this problem, I'd pull him my hat, have to do better.

    • Raisinus

      Hi Jeanjean, I have the same problem as you with a Skyrim backup file. After full formatting and reinstalling my system (XP), I realised that I had forgotten to save a very important file, my Skyrim backup.

      So I was able to find my backups with Recuva software (which is simple and efficient, from the same editor as “Ccleaner”).

      The problem appears when trying to load files with Skyrim, or the same error message appears “the savegame can be loaded beacause it is outdated. Its version is 0 and the current version is 8”.

      I have no solution for the time being, but if you or another charitable soul find a solution –> a big thank you in advance.

  • Jeanjean

    Hi Raisinus,

    Don‘t rejoice you too fast, I don’t have the solution. I think I have every tent, I even went to Bethesda by sending them my backup file! They answered me yesterday.....to tell me that I shouldn't have renamed my backup files, something I did on duplic files while keeping the original files found (corrompu). Also they insisted on the fact that my backup file was probably “casses” so unusable and not reconstructable...

    Basically, I‘ve done a game from the beginning... I chose a little different person, forcing me not to follow the path that my first part and I have to say that I’m finally not so degoute than that of having recommance. The game is so vast, it’s little to say...

  • Momo

    Good morning,
    I'm calling on your photorec knowledge to help me. To retrieve photos from a partition (ubuntu) where I can't access, I used photorec. It recovered files with jpeg exrension, saved in “recup_dir.1”. The prob. is that I can't open this folder “no right to open or move”. So I find myself with “recovered” files without the right to access it!
    Help please!

    • Victor

      In Momo,
      in fact, the files “saved” by photorec are read only (ubuntu).... to restore the writing rights.
      in a terminal:
      CD/name of the path will go"recup_dir.1″
      Sudo chown _R username: username/Name of the pathtoallera"recup_dir.1″

      good luck.