Scan repeatedly restarts from lower point

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
nickd
Posts: 3
Joined: 09 Mar 2017, 22:27

Scan repeatedly restarts from lower point

#1 Post by nickd »

Howdy! I'm running PhotoRec on a drive, curious why it's restarting. It appears to have recovered a lot files, but now it starts from an earlier point over and over every couple of days.

So it'll go from e.g.:

Pass 1 - Reading sector 316755605/976745984, 51485 files found
Elapsed time 101h23m43s - Estimated time to completion 211h16m00

to

Pass 1 - Reading sector 97068011/976745984, 51487 files found
Elapsed time 334h44m47s - Estimated time to completion 3033h38m10

to

Pass 1 - Reading sector 131172202/976745984, 51488 files found
Elapsed time 389h26m13s - Estimated time to completion 2510h25m21


It's reading a lower number of sectors, even though it's found lots of files. It might recover 1 or 2 more before it restarts.

Thoughts on why this may be? Should we just end the scan?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Scan repeatedly restarts from lower point

#2 Post by cgrenier »

Please try using latest 7.1-WIP version.
To avoid to restart from the beginning, you can copy the photorec.ses file from the old version of photorec to the directory where the latest version is.
If needed, https://www.cgsecurity.org/testdisk.pdf explains how to install the latest version.

nickd
Posts: 3
Joined: 09 Mar 2017, 22:27

Re: Scan repeatedly restarts from lower point

#3 Post by nickd »

Thanks! I just ran 7.1-WIP and it completed the scan successfully. Appreciate the help.

One more thing, though: instead of generating a bunch of directories with files in them as before, photorec appears to have generated two files:

f905091823.diskimage, which is 293.5GB
report.xml, which is 2kb (and is pasted).

What's the best way to unzip the diskimage file and access its contents? Disk Utility and hdiutil appear to not work. Thanks!

Code: Select all

<?xml version='1.0' encoding='UTF-8'?>
<dfxml xmloutputversion='1.0'>
  <metadata 
  xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML' 
  xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' 
  xmlns:dc='http://purl.org/dc/elements/1.1/'>
    <dc:type>Carve Report</dc:type>
  </metadata>
  <creator>
    <package>PhotoRec</package>
    <version>7.1-WIP</version>
    <build_environment>
      <compiler>GCC 4.0</compiler>
      <compilation_date>2017-03-03T06:48:04</compilation_date>
      <library name='libext2fs' version='1.42.8'/>
      <library name='libewf' version='20120504'/>
      <library name='libjpeg' version='62'/>
      <library name='libntfs' version='libntfs-3g'/>
      <library name='zlib' version='1.2.3'/>
    </build_environment>
    <execution_environment>
      <os_sysname>Darwin</os_sysname>
      <os_release>16.4.0</os_release>
      <os_version>Darwin Kernel Version 16.4.0: Thu Dec 22 22:53:21 PST 2016; root:xnu-3789.41.3~3/RELEASE_X86_64</os_version>
      <host>squeller</host>
      <arch>x86_64</arch>
      <uid>0</uid>
      <start_time>2017-03-10T08:51:33-0600</start_time>
    </execution_environment>
  </creator>
  <source>
    <image_filename>/dev/disk7</image_filename>
    <sectorsize>4096</sectorsize>
    <image_size>4000752599040</image_size>
    <volume>
      <byte_runs>
        <byte_run offset='0' img_offset='4096' len='4000751550464'/>
      </byte_runs>
      <block_size>4096</block_size>
    </volume>
  </source>
  <configuration>
  </configuration>
  <fileobject>
    <filename>f905091823.diskimage</filename>
    <filesize>293495443456</filesize>
    <byte_runs>
      <byte_run offset='0' img_offset='3707256111104' len='293495443456'/>
    </byte_runs>
  </fileobject>
</dfxml>

nickd
Posts: 3
Joined: 09 Mar 2017, 22:27

Re: Scan repeatedly restarts from lower point

#4 Post by nickd »

Hello! Just following up on this – how does one read .diskimage files?

Locked