Page 1 of 1
Scan repeatedly restarts from lower point
Posted: 09 Mar 2017, 22:31
by nickd
Howdy! I'm running PhotoRec on a drive, curious why it's restarting. It appears to have recovered a lot files, but now it starts from an earlier point over and over every couple of days.
So it'll go from e.g.:
Pass 1 - Reading sector 316755605/976745984, 51485 files found
Elapsed time 101h23m43s - Estimated time to completion 211h16m00
to
Pass 1 - Reading sector 97068011/976745984, 51487 files found
Elapsed time 334h44m47s - Estimated time to completion 3033h38m10
to
Pass 1 - Reading sector 131172202/976745984, 51488 files found
Elapsed time 389h26m13s - Estimated time to completion 2510h25m21
It's reading a lower number of sectors, even though it's found lots of files. It might recover 1 or 2 more before it restarts.
Thoughts on why this may be? Should we just end the scan?
Re: Scan repeatedly restarts from lower point
Posted: 10 Mar 2017, 06:51
by cgrenier
Please try using latest 7.1-WIP version.
To avoid to restart from the beginning, you can copy the photorec.ses file from the old version of photorec to the directory where the latest version is.
If needed,
https://www.cgsecurity.org/testdisk.pdf explains how to install the latest version.
Re: Scan repeatedly restarts from lower point
Posted: 16 Mar 2017, 17:26
by nickd
Thanks! I just ran 7.1-WIP and it completed the scan successfully. Appreciate the help.
One more thing, though: instead of generating a bunch of directories with files in them as before, photorec appears to have generated two files:
f905091823.diskimage, which is 293.5GB
report.xml, which is 2kb (and is pasted).
What's the best way to unzip the diskimage file and access its contents? Disk Utility and hdiutil appear to not work. Thanks!
Code: Select all
<?xml version='1.0' encoding='UTF-8'?>
<dfxml xmloutputversion='1.0'>
<metadata
xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
xmlns:dc='http://purl.org/dc/elements/1.1/'>
<dc:type>Carve Report</dc:type>
</metadata>
<creator>
<package>PhotoRec</package>
<version>7.1-WIP</version>
<build_environment>
<compiler>GCC 4.0</compiler>
<compilation_date>2017-03-03T06:48:04</compilation_date>
<library name='libext2fs' version='1.42.8'/>
<library name='libewf' version='20120504'/>
<library name='libjpeg' version='62'/>
<library name='libntfs' version='libntfs-3g'/>
<library name='zlib' version='1.2.3'/>
</build_environment>
<execution_environment>
<os_sysname>Darwin</os_sysname>
<os_release>16.4.0</os_release>
<os_version>Darwin Kernel Version 16.4.0: Thu Dec 22 22:53:21 PST 2016; root:xnu-3789.41.3~3/RELEASE_X86_64</os_version>
<host>squeller</host>
<arch>x86_64</arch>
<uid>0</uid>
<start_time>2017-03-10T08:51:33-0600</start_time>
</execution_environment>
</creator>
<source>
<image_filename>/dev/disk7</image_filename>
<sectorsize>4096</sectorsize>
<image_size>4000752599040</image_size>
<volume>
<byte_runs>
<byte_run offset='0' img_offset='4096' len='4000751550464'/>
</byte_runs>
<block_size>4096</block_size>
</volume>
</source>
<configuration>
</configuration>
<fileobject>
<filename>f905091823.diskimage</filename>
<filesize>293495443456</filesize>
<byte_runs>
<byte_run offset='0' img_offset='3707256111104' len='293495443456'/>
</byte_runs>
</fileobject>
</dfxml>
Re: Scan repeatedly restarts from lower point
Posted: 31 Mar 2017, 14:55
by nickd
Hello! Just following up on this – how does one read .diskimage files?