Large Iso's

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
chand0
Posts: 2
Joined: 06 Jul 2020, 08:43

Large Iso's

#1 Post by chand0 »

So I messed up the other day and deleted the wrong folder on a USB HD resulting the in loss of several Blu Ray ISO back ups. I haven’t written anything to the disc since. I am currently running photorec only looking for ISO's and was very happy when it found the 1st dvd.iso. However it then must have found a blu ray iso as it is just continually growing and is now around 400GB!!

Looking through the options for photorec, am I right in saying the ISO part of the config will only recognise CD/DVD ISO's? I assume I need to manually add what a blu ray iso is? If so has anyone else done this? I read the how to manually add signatures but it is a little beyond me.

Any help would be greatly appreciated.

recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Large Iso's

#2 Post by recuperation »

I had to read a bit because I am not familiar with your recovery issue.
It seems that Photorec will find your blue ray ISO files provided that your ISO file contains a ISO9660 file system.
As I only have empty BD-R's and not a single commercial blue ray disc you have to test that for yourself.

Here's the recipe:

Erase a storage device large enough to hold a BD image.
You can use diskpart under Windows or dd under linux using /dev/zero as a source.
Partition it with one partition and format that device with NTFS for instance.
Copy the BD image file to the NTFS partition.
Break the device (not physically!) by zeroing out the first 512 bytes with a hex editor.

Disconnect and reconnect the device or even reboot.
Have Photorec search just ISO files on the whole drive.

Let the forum know what that gave.

chand0
Posts: 2
Joined: 06 Jul 2020, 08:43

Re: Large Iso's

#3 Post by chand0 »

recuperation wrote: 06 Jul 2020, 22:15 I had to read a bit because I am not familiar with your recovery issue.
It seems that Photorec will find your blue ray ISO files provided that your ISO file contains a ISO9660 file system.
As I only have empty BD-R's and not a single commercial blue ray disc you have to test that for yourself.
Ok i will try to explain it again better.

I accidently deleted 10 blu ray iso backups as well as 10 dvd iso backups because i was not paying attention.

So i ran photorec and set it to only look for ISO files. After around 1 hour is recovered a 4.8 GB iso (a dvd which i tested and its ok). It then started to recover another iso file. However the size of the second file kept growing and growing well past 45 GB (which i know was the size of the largest file). When I orignally posted asking for help the file was around 400 GB in size. Later on when i checked on it again the second file size had reset and was only 10GB and counting. This loop went on until the scan finished and only 1 ISO had been recovered.

I have scanned the disk with windows based software and it lists all the ISO's as 0 bytes.

My question is "does photorec recoginse a blu ray ISO as it looks like it is getting confused".

Here's the recipe:

Erase a storage device large enough to hold a BD image.
You can use diskpart under Windows or dd under linux using /dev/zero as a source.
Partition it with one partition and format that device with NTFS for instance.
Copy the BD image file to the NTFS partition.
Break the device (not physically!) by zeroing out the first 512 bytes with a hex editor.

Disconnect and reconnect the device or even reboot.
Have Photorec search just ISO files on the whole drive.

Let the forum know what that gave.
Do you have guide on how to 'break the device' as this is not something I have done before?

Thanks

recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Large Iso's

#4 Post by recuperation »

Break the device (not physically!) by zeroing out the first 512 bytes with a hex editor.
This is referring to your storage device. It means "Make it unreadable for Windows". Make an operating system access fail this way.
I won't provide instructions on how to "zeroing out the first 512 bytes with a hex editor", sorry.

The success of fingerprinting does depend on the amount of defragmentation.
That's why Photorec will easily recover everything on your camera storage device when you never delete single files so that defragmentation can never occur.

Locked