cgsecurity.org

Hi all, I’m new at this forum, I knew photorec but I’m using it in a professional way just now. First of all, I want to congratulate Christophe for his great program and thank him for support.

Now I’ll explain my situation. I was given an usb external hard disk, size 250 Gb, and it is partitioned as follows:

(E): 25 Gb – NTFS - 100% used
(F): 52 Gb – NTFS - 0% used
(G): 52 Gb – NTFS - 100% used
(H): 52 Gb – NTFS - 19% used
(I): 52 Gb – NTFS - 7% used
... (it will be an extended partition for including the logical ones..)

The (E) 25Gib partition may be damaged because Windows cannot read it without formatting. I’m using photorec for Windows with graphic user interface (qphotorec_win.exe) to recover jpg files only. I randomly selected one of the four 52Gb partitions (but I cannot know which one) and after about 12 hours the recovery was at 90% with 88 recovered images.. Now the process appears freezed if we consider that the first 87% work was faster... is that normal or is anything working bad?
So, as in the subject my main doubt is: how long does this process take on average?

My other questions are:
1. how many passes are there? (pass 0, pass 1... )
2. why the “reading sector” item is always on 0? (e.g. 0/108711855), is that right this way?
3. why for some of these partitions both items of free unallocated space and whole partition are allowed and for some other only the whole partition option is allowed?
4. since photorec does not use drive letters as Windows does, but just numbers, and because of the four partitions have all the same 52 Gb size I cannot spot the correspondence with windows drive letters. Is there a way to figure out this point?

Thanks in advance.

You can use Windows disk manager to get the drive letters affected to each partition.
If the recovery is very slow, it may be due to bad sectors. Currently this problem isn't reported by qphotorec, only by photorec.

cgrenier wrote:You can use Windows disk manager to get the drive letters affected to each partition.

Yes but because of the same size i cannot understand if e.g. partition n.4 of photorec is the same of partition "H" rather than "L" in Windows..

cgrenier wrote:If the recovery is very slow, it may be due to bad sectors. Currently this problem isn't reported by qphotorec, only by photorec.

Well I can easily use photorec (Windows prompt) instead of qphotorec... For the bad sector problem, what shall I do? Is there a way to repair them before scanning for recovery? How to do exactly?

Can you also explain me my further questions?

Nick wrote: 1. how many passes are there? (pass 0, pass 1... )
2. why the “reading sector” item is always on 0? (e.g. 0/108711855), is that right this way?
3. why for some of these partitions both items of free unallocated space and whole partition are allowed and for some other only the whole partition option is allowed?

Nick wrote: 1. how many passes are there? (pass 0, pass 1... )
2. why the “reading sector” item is always on 0? (e.g. 0/108711855), is that right this way?
3. why for some of these partitions both items of free unallocated space and whole partition are allowed and for some other only the whole partition option is allowed?

Pass 0: PhotoRec find the blocksize.
Pass 1: File recovery
Pass 2: Fragmented file recovery (if brute-force mide is enabled, disabled by default)

The reading sector say very long at 0 if there are read errors/bad sectors.

To deal with bad sectors, you should clone your disk using gnu ddrescue
http://www.cgsecurity.org/wiki/Damaged_Hard_Disk

Thanks for the reply.

The strange thing is that only one partition showed the progressive number of reading sector growing as percentage grew, for the other partitions reading sector remained at 0, but the percentage got the 100% at the end of the process, with recevered photos in one of them.

p.s. I saw photorec allows you to selectively recover many types of file... why .avi ones are not included?

avi are recovered by PhotoRec. They are part of the riff file family.