cgsecurity.org

Hi,

Is it safe to remove already recovered files from the directory photorec is recovering to while photorec is still running? I've realised part way into a recovery that the drive I'm recovering to is not large enough for all of the recovered files and would rather not have to restart the recovery, so would prefer to move the files to a different drive without stopping photorec, but wanted to check this wouldn't confuse photorec.

Thanks

You can move the file while the recovery is in in progress except the file PhotoRec is currently writing.
You can also wait for the no enough space message from PhotoRec and continue the recovery to another disk.

Awesome, thank you.

While I've got you, is there a difference between the files who's names begin with a t and those that begin with an f?

Extract from the documentation

PhotoRec: file name and date
****************************
By default, files are saved in directories named recup_dir.1, recup_dir.2...
A new directory is created each new 500 files (The thumb files are not included in this count, nor the report.xml file).
A filename begins by a letter followed by a number (7 digits or more) and ends, if any, by a file extension.

Letter meaning:

* f=file
* b=broken
* t=jpeg embedded thumbnail

The number is calculated by using the file location minus the partition offset divided by the block size. For some filesystems like NTFS, exFAT, ext2/3/4, this number may be identical to the original cluster/block number.
Using metadata information embedded in the recovered file, the file may be renamed to include the documentation title (example, Microsoft Office doc/xls/ppt or Acrobate pdf files) like
``recup_dir.1/f0016741_Prudent_Engineering_Practice_for_Cryptographic_Protocols.pdf``.

Ah, sorry, I'm surprised I didn't find that when googling. Thank you so much.