Feature Request

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
SGB74
Posts: 7
Joined: 12 Oct 2014, 04:10

Feature Request

#1 Post by SGB74 »

I'm not sure if you're aware of tools such as foremost and scalpel. But they have a feature that allows the user to produce an audit file without recovering anything. Say I'm looking to recover an .iso file but before running a long scan and having nothing turn up I can produce a file that shows if the file type in question is recoverable or not. Is this possible with qphotorec and photorec. Its something similar to a log without the recovered files.

in foremost the command would be: foremost -w
in scalpel it would be: scalpel -p

SGB74
Posts: 7
Joined: 12 Oct 2014, 04:10

Re: Feature Request

#2 Post by SGB74 »

Also, is there any way to have recovered files directed to a folder stating their specific file type upon recovery? Just as foremost does. For example if i recover some jpg, pdf, and png files all each file type is directed to its respective folders when recovered. Like a folder named png would just have recovered png files, and so on. Is that possible with photorec? It cuts down on sifting through all the folders if you know what file type you're interested in based on the folder they were recovered to.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Feature Request

#3 Post by cgrenier »

To check the validity of the recovered files, PhotoRec need to write them on the disk. So it's not really possible to not write anything on the disk like "scapel -p" or "foremost -w" do. They are two possibilities:
- ignore the file check, it will produce more false positive
- delete the file once the check is done, it will still write on the disk and not produce any speedup.

You can sort the recovered files by extension in different directories using some of the scripts listed in https://www.cgsecurity.org/wiki/After_Using_PhotoRec

Locked