PhotoRec stored data somewhere but I don't know where. Topic is solved

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
doofenshmirtz
Posts: 2
Joined: 16 Mar 2017, 12:59

PhotoRec stored data somewhere but I don't know where.

#1 Post by doofenshmirtz »

I was running a photorec recovery to a desktop folder called "recovery" then I cancelled because I realized I won't have enough space. Then deleted the "recovery" folder thinking I can start all over but just selecting a few file types rather than all. But, even though I should have ~60GB free I'm still at 12GB free like I didn't delete the folder. I also removed it from Trash but still no luck. Where is it hiding? I tried the tmp folder in root but it didn't seem it was there. I still have the photorec.ses file. Should I delete the session somehow within the program itself?

Using antergos (archlinux). Thanks

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: PhotoRec stored data somewhere but I don't know where.

#2 Post by cgrenier »

As root, search for the recup_dir.1 directory

Code: Select all

sudo find / -name recup_dir.1

doofenshmirtz
Posts: 2
Joined: 16 Mar 2017, 12:59

Re: PhotoRec stored data somewhere but I don't know where.

#3 Post by doofenshmirtz »

Tried that. Gives me three directories. One is where I'm currently recovering so that can't be it I guess, one says permission denied and one is empty even with 'show hidden files' enabled or if I try cd to the directory and do ls.

http://i.imgur.com/nfSicEL.png

Trying the /run/user/1000/gfvs in the browser says it's empty

http://i.imgur.com/lOklumN.png

This is kinda strange, I managed to find all of them using

Code: Select all

sudo find / -type d -name '*Trash*' | sudo xargs du -h | sort
like explained here http://askubuntu.com/questions/215908/h ... -directory

Then used

Code: Select all

sudo rm -fr /root/.local/share/Trash/files/recup_dir.*
to delete them one by one just to be sure (asterisk being the number of the file).

Thanks for your help. :)

Locked