cgsecurity.org

Hi guys,

Fist off, thanks to everybody for all the great tips/help/content thad already exist this forum.
It helped me not to panic when photorec got stuck for hours on bad sectors and just give it some time to do its thing.

I have a thing I want to make sure if its normal behaviour or not, because I cannot really find any documentation on how the brute force mechanism works in photorec.

I used PhotoRec 7.0 WIP to scan a ntfs windows partition of around 250GB with lots of bad sectors successfully the first 2 passes.
With the following settings : jpg`s only, paranoid: yes (bruteforce enabled) , Keep corrupted files : yes , free-space.
I dont have any logs enabled sadly.

It started bruteforcing, and for some time it made progress, but now its sectors remaining counter doesnt get any less for about 70 hours. It keeps doing its test thing <test 1,2,3,4++> , but at the looks of it, when it hits <test 42> it jumps strait to <test 1> again. Im not too sure if its always 42.

I dont know if photorec is finding new file signature`s/fragment each time and it keeps on trying to recover a large jpg or somthing, but i thought it was worth asking you guys.

Any sugesstions/explenation?

Update: I think i found the reason for the behavior written above.

I am running Photorec from a usb flashdrive and it also recovers too thad flashdrive.

Last night, photorec told me thad my flashdrive was full, witch aint the case (it has used 9 of the 14GB).
When i browsed inside the disk, all folders and data had strange names and folders were not accessible.

So i think thad some nand-cels died, and the data/filesystem went corrupt.

I have put in a new flashdrive to write too, but it has to bruteforce again from the start, so i dont know if this disk will make it without dieing too.

Anyway, if there is interest in how this will develop, this topic can stay open, Otherwise i think its [solved].