cgsecurity.org

I'm not sure if you're aware of tools such as foremost and scalpel. But they have a feature that allows the user to produce an audit file without recovering anything. Say I'm looking to recover an .iso file but before running a long scan and having nothing turn up I can produce a file that shows if the file type in question is recoverable or not. Is this possible with qphotorec and photorec. Its something similar to a log without the recovered files.

in foremost the command would be: foremost -w
in scalpel it would be: scalpel -p

Also, is there any way to have recovered files directed to a folder stating their specific file type upon recovery? Just as foremost does. For example if i recover some jpg, pdf, and png files all each file type is directed to its respective folders when recovered. Like a folder named png would just have recovered png files, and so on. Is that possible with photorec? It cuts down on sifting through all the folders if you know what file type you're interested in based on the folder they were recovered to.

To check the validity of the recovered files, PhotoRec need to write them on the disk. So it's not really possible to not write anything on the disk like "scapel -p" or "foremost -w" do. They are two possibilities:
- ignore the file check, it will produce more false positive
- delete the file once the check is done, it will still write on the disk and not produce any speedup.

You can sort the recovered files by extension in different directories using some of the scripts listed in https://www.cgsecurity.org/wiki/After_Using_PhotoRec