Deleted large custom files

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
scientist
Posts: 1
Joined: 27 Oct 2012, 07:06

Deleted large custom files

#1 Post by scientist »

Hi Everyone,

I have been trying to recover files using photorec, but so far I have not been too successful. The drive is read-only so hopefully I will not continue to overwrite deleted data.

I am desperate to get this data or at least as much as I can recovered because it was 6 months worth of scientific work. This happen as long as one year ago, but the computer has been used minimally since then. :o

The deleted files are a stream of images taken from a CCD camera. They have no footer, but all have the following header in the first line: ISOIdwR'COIMSOFT thefilename

Each deleted file is of one of two sizes: 659715948 bytes or 520089082 bytes.

The larger byte sized file and smaller byte size file go together and the names are used to read them together (e.g., t_19a.0100 (large) and t_19a.0101 (smaller)).

I made a custom signature file in photorec using: raw 0 "ISOIdwR"

fidentify could recognize existing undeleted files, labeling them as "raw."

When running photorec I picked /dev/sda, 6 Linux, ext3, and under file opts I selected only the custom signature file.

Many files were recovered all having the correct header. However, many files were much greater than the 659715948 bytes. Some were also smaller. I tried running the command to analyze this file, but it failed and recognizes that the file size is much too large.

1. What can I do to carve out the data better? Is there a way to set a byte size limit since there is no good footer?

2. Should I be using testdisk instead of photorec?

3. Is there a difference between photorec 6.13 and 6.14 in how well they recover? I am using photorec 6.13.

Thank you!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Deleted large custom files

#2 Post by cgrenier »

When using latest PhotoRec 6.14-WIP, you can also enable "ext ext2/ext3/ext4 Superblock".

Actually, to be able to specify a filesize limit, you have to be able to program in C
But you can truncate the recovered files using "dd if=old.raw of=new.raw count=1 bs=520089082".

Can you check if some of the recovered files (after truncation) are valid ?

Locked