cgsecurity.org

Hello

I am trying rescue all data from 500 GB hard disk. Incidentally I pressed Ctrl+C on terminal and stopped process during ~20%. I wanted resume it (just by reproduce steps) but there were not any steps similar to these ones (I have PhotoRec 6.13)

I started second probe and in this case, I made program search only doc and pdf files. Surprising fact is that the first probe will last about 30 hours, but second probe show about 31 hours. So could anyone explain me this situation? Is Optimal way scan whole disk and recovery all data than particular files?

And last question, I hope. Can I merge Office files from second scan with rest files (first scan; photos, movies, zips etc) and start recovery again from 20% point + all office files?

Since version 6.14, PhotoRec save the progression every 5 minutes. With previous versions, it only do it when the user choose Stop (not Ctrl-C).

The estimated time isn't always accurate (it's why it's updated every few seconds)
- it's faster to access data stored at the beginning of disk than at the end
- it can take minutes to parse an area where there are bad sectors
- PhotoRec checks by default the recovered data, it's slower to check a .jpg than a .doc

It's better to recover data
- partition by partition than using whole disk.
- all files/several extensions at the time than extension one by one