Photorec stops during scripted mode.

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
72616e646f6d
Posts: 2
Joined: 10 Nov 2014, 16:02

Photorec stops during scripted mode.

#1 Post by 72616e646f6d »

Hi,

We've encountered a problem while running photorec during processing in scripted mode.

It seems that photorec is waiting for some input from the user because we can send a 'y' symbol to the process and it will continue after. This is the last part of the photorec log file:
Analyse
1 P HPFS - NTFS 0 0 2 128 193 1 2068479 [charliework]
NTFS, 1059 MB / 1009 MiB
Pass 0 (blocksize=4096) STATUS_FIND_OFFSET
Elapsed time 0h00m00s
Pass 1 (blocksize=4096) STATUS_EXT2_OFF
* 41321-44904: (null)
48489-660480: (null)
689257-689408: (null)
690001-2068479: (null)
1994207 sectors contains unknown data, 0 invalid files found and rejected.
PhotoRec has been stopped
Elapsed time 0h11m35s
Pass 1 +0 file
Total: 0 file found

41321-44904: (null)
48489-660480: (null)
689257-689408: (null)
690001-2068479: (null)
1994207 sectors contains unknown data, 0 invalid files found and rejected.
PhotoRec exited normally.
This is the result when we sent the 'y' command to the process. It stopped after the first pass (Pass 0 (blocksize=4096) STATUS_FIND_OFFSET).

Is there any way to circumvent/mitigate this problem?
Top
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:
Contact cgrenier

Re: Photorec stops during scripted mode.

#2 Post by cgrenier »

Can you post the log file content when using latest Photoec 7.0-WIP ? Do not send 'y', maybe the reason will be visible in the log file.
BTW do you restore the files to a FAT32 filesystem ?
Top
72616e646f6d
Posts: 2
Joined: 10 Nov 2014, 16:02

Re: Photorec stops during scripted mode.

#3 Post by 72616e646f6d »

We are restoring the files to a ext4 file system.

Log without the 'y':
Fri Nov 14 10:15:12 2014
Command line: PhotoRec /debug /log /logname /var/log/photorec /d /opt/data/tmp_carving/Charlie-usb-work_carved/carved_data /cmd /tmp/mount_dir.PVvcUS/ewf1 options,keep_corrupted_file_no,fileopt,everything,enable,freespace,search

PhotoRec 7.0-WIP, Data Recovery Utility, October 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.2.0-70-generic (#105-Ubuntu SMP Wed Sep 24 19:49:16 UTC 2014) x86_64
Compiler: GCC 4.4
Compilation date: 2014-11-13T19:10:45
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, ewf lib: 20120504, libjpeg: libjpeg-turbo-1.3.1
Hard disk list
Disk /tmp/mount_dir.PVvcUS/ewf1 - 1048 MB / 1000 MiB - CHS 128 255 63 (RO), sector size=512

Partition table type (auto): Intel
Geometry from i386 MBR: head=255 sector=63
Disk /tmp/mount_dir.PVvcUS/ewf1 - 1048 MB / 1000 MiB (RO)
Partition table type: Intel
Geometry from i386 MBR: head=255 sector=63
FAT32 at 0/1/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
Info: size boot_sector 2047878, partition 2047878
FAT1 : 32-2027
FAT2 : 2028-4023
start_rootdir : 4024 root cluster : 2
Data : 4024-2047871
sectors : 2047878
cluster_size : 8
no_of_cluster : 255481 (2 - 255482)
fat_length 1996 calculated 1996
heads/cylinder 128 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
No partition 0 0 1 127 122 59 2048000 [Whole disk]
1 P FAT32 0 1 1 127 121 63 2047878 [JO FAVORITE]
FAT32, blocksize=4096, 1048 MB / 999 MiB
New options :
Paranoid : Yes
Brute force : No
Keep corrupted files : No
ext2/ext3 mode : No
Expert mode : No
Low memory : No

Interface File Select
fat32_remove_used_space
630 first-level signatures enabled

Analyse
1 P FAT32 0 1 1 127 121 63 2047878 [JO FAVORITE]
FAT32, blocksize=4096, 1048 MB / 999 MiB
Pass 0 (blocksize=4096) STATUS_FIND_OFFSET
blocksize=4096, offset=3584
Elapsed time 0h00m00s
Log with the 'y':
Fri Nov 14 10:15:12 2014
Command line: PhotoRec /debug /log /logname /var/log/photorec /d /opt/data/tmp_carving/Charlie-usb-work_carved/carved_data /cmd /tmp/mount_dir.PVvcUS/ewf1 options,keep_corrupted_file_no,fileopt,everything,enable,freespace,search

PhotoRec 7.0-WIP, Data Recovery Utility, October 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.2.0-70-generic (#105-Ubuntu SMP Wed Sep 24 19:49:16 UTC 2014) x86_64
Compiler: GCC 4.4
Compilation date: 2014-11-13T19:10:45
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, ewf lib: 20120504, libjpeg: libjpeg-turbo-1.3.1
Hard disk list
Disk /tmp/mount_dir.PVvcUS/ewf1 - 1048 MB / 1000 MiB - CHS 128 255 63 (RO), sector size=512

Partition table type (auto): Intel
Geometry from i386 MBR: head=255 sector=63
Disk /tmp/mount_dir.PVvcUS/ewf1 - 1048 MB / 1000 MiB (RO)
Partition table type: Intel
Geometry from i386 MBR: head=255 sector=63
FAT32 at 0/1/1
check_FAT: Unusual media descriptor (0xf0!=0xf8)
Info: size boot_sector 2047878, partition 2047878
FAT1 : 32-2027
FAT2 : 2028-4023
start_rootdir : 4024 root cluster : 2
Data : 4024-2047871
sectors : 2047878
cluster_size : 8
no_of_cluster : 255481 (2 - 255482)
fat_length 1996 calculated 1996
heads/cylinder 128 (FAT) != 255 (HD)
sect/track 32 (FAT) != 63 (HD)
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1
No partition 0 0 1 127 122 59 2048000 [Whole disk]
1 P FAT32 0 1 1 127 121 63 2047878 [JO FAVORITE]
FAT32, blocksize=4096, 1048 MB / 999 MiB
New options :
Paranoid : Yes
Brute force : No
Keep corrupted files : No
ext2/ext3 mode : No
Expert mode : No
Low memory : No

Interface File Select
fat32_remove_used_space
630 first-level signatures enabled

Analyse
1 P FAT32 0 1 1 127 121 63 2047878 [JO FAVORITE]
FAT32, blocksize=4096, 1048 MB / 999 MiB
Pass 0 (blocksize=4096) STATUS_FIND_OFFSET
blocksize=4096, offset=3584
Elapsed time 0h00m00s
Pass 1 (blocksize=4096) STATUS_EXT2_OFF
* 4223-4294: (null)
4503-4630: (null)
4639-4646: (null)
5031-5046: (null)
5063-5070: (null)
5079-5094: (null)
5111-5118: (null)
5143-5182: (null)
5311-5334: (null)
5343-5350: (null)
135887-135982: (null)
135991-136070: (null)
136079-136198: (null)
463687-463966: (null)
464095-470102: (null)
470119-2047942: (null)
1584736 sectors contains unknown data, 0 invalid files found and rejected.
/opt/data/tmp_carving/Charlie-usb-work_carved/carved_data.1/f0004160.gz 4223-4294 4503-4630 4639-4646 5031-5046 5063-5070 5079-5094 5111-5118 5143-5182 5311-5334 5343-5350
Sector 135887
16477 drwxr-xr-x 0 0 0 20-Nov-2009 10:25 .
3 drwxr-xr-x 0 0 0 20-Nov-2009 10:25 ..
/opt/data/tmp_carving/Charlie-usb-work_carved/carved_data.1/f0135824.fat 135887-135894
PhotoRec has been stopped
Elapsed time 0h04m28s
Pass 1 +1 file
gz: 1/1 recovered
Total: 1 file found

135895-135982: (null)
135991-136070: (null)
136079-136198: (null)
463687-463966: (null)
464095-470102: (null)
470119-2047942: (null)
1584400 sectors contains unknown data, 0 invalid files found and rejected.
PhotoRec exited normally.
Top
Locked

Return to “File recovery”