Phororec freezes on brutforce

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
mkotl
Posts: 2
Joined: 30 Jul 2019, 13:55

Phororec freezes on brutforce

#1 Post by mkotl »

I try to recover files (mostly .JPG and raw photos and some video files) from the image of 2TB drive. The file system (NTFS) was corrupted - probably writing data when the HDD was disconnected. The file system was "fixed" by standard Windows tools then some directories disappeared. There file system was new (few weeks old) with >75% of free space which should increase my chances.
I recovered part of the files with Testdisk and photorec without brute force. Than I tried to use brute force scan.

Photorec freezes after half an hour consuming > 50% of one CPU thread, nothing is updated on the console or in the photorec.log. I left it for more than one weak - no changes, >50% CPU consumed. I noticed this problem in Photorec 7.0 (from Debian repository) and Photorec 7.2 (testdisk-7.2-WIP.linux26-x86_64.tar.bz2 from cgsecurity page). Stop button in Photorec do not work.

I use Photorec on Linux 4.9.0-3-amd64 (Debian Stretch).

On the screen:

Code: Select all

Disk sdc2.img - 2000 GB / 1863 GiB (RO)
     Partition                  Start        End    Size in sectors
     Unknown                  0   0  1 243199  35 36 3906994176 [Whole disk]
 
Destination /m1/mk/OdzyskJacek2T/PlikiOdzyskane4/recup_dir
 
Bruteforce  435647856 sectors remaining (test 1), 0 files found
Elapsed time 0h39m10s 
The end of photorec.log:

Code: Select all

Wed Jul 17 20:14:29 2019
Command line: PhotoRec sdc2.img /log

PhotoRec 7.2-WIP, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 4.9.0-3-amd64 (#1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26)) x86_64
Compiler: GCC 4.4
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, ewf lib: 20120504, libjpeg: libjpeg-turbo-1.3.1, curses lib: ncurses 5.7
Hard disk list
Disk sdc2.img - 2000 GB / 1863 GiB - CHS 243200 255 63 (RO), sector size=512

Load parameters from /root/.photorec.cfg
Partition table type (auto): None
Disk sdc2.img - 2000 GB / 1863 GiB (RO)
Partition table type: None
     Unknown                  0   0  1 243199  35 36 3906994176 [Whole disk]
   P NTFS                     0   0  1 243199  35 36 3906994176 [WD Red]
     NTFS, blocksize=4096, 2000 GB / 1863 GiB

Interface File Select
New options :
 Paranoid : Yes
 Brute force : Yes
 Keep corrupted files : Yes
 ext2/ext3 mode : No
 Expert mode : No
 Low memory : No
175 first-level signatures enabled

Analyse
     Unknown                  0   0  1 243199  35 36 3906994176 [Whole disk]
Pass 0 (blocksize=4096) STATUS_EXT2_OFF
Elapsed time 0h00m01s
Pass 1 (blocksize=4096) STATUS_EXT2_OFF_BF
3587227160 sectors contain unknown data, 0 invalid files found and rejected.
3587227160 sectors contain unknown data, 0 invalid files found and rejected.
File should not be bigger than 52428800, stop adding data
photorec_bf_frag /m1/mk/OdzyskJacek2T/PlikiOdzyskane4/recup_dir.31/f435721608.jpg, original_offset_ok=4489216, original_offset_error=4489216, blocs_to_skip=0
photorec_bf_frag /m1/mk/OdzyskJacek2T/PlikiOdzyskane4/recup_dir.31/f435721608.jpg, original_offset_ok=5411979, original_offset_error=4512256, blocs_to_skip=0
3587227160 sectors contain unknown data, 1 invalid files found and rejected.
photorec_bf_frag /m1/mk/OdzyskJacek2T/PlikiOdzyskane4/recup_dir.31/f435711080.jpg, original_offset_ok=131072, original_offset_error=131072, blocs_to_skip=0
photorec_bf_frag /m1/mk/OdzyskJacek2T/PlikiOdzyskane4/recup_dir.31/f435711080.jpg, original_offset_ok=5383817, original_offset_error=139264, blocs_to_skip=0
3587227160 sectors contain unknown data, 2 invalid files found and rejected.
photorec_bf_frag /m1/mk/OdzyskJacek2T/PlikiOdzyskane4/recup_dir.31/f435679472.jpg, original_offset_ok=3031040, original_offset_error=3031040, blocs_to_skip=0
photorec_bf_frag /m1/mk/OdzyskJacek2T/PlikiOdzyskane4/recup_dir.31/f435679472.jpg, original_offset_ok=6026799, original_offset_error=3040768, blocs_to_skip=0
3587227160 sectors contain unknown data, 3 invalid files found and rejected.
I also provide also photorec.ses file.
Attachments
photorec.ses.gz
Gzipped to allow attaching to the post.
(9.64 KiB) Downloaded 214 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Phororec freezes on brutforce

#2 Post by cgrenier »

If the filesystem was new, fragmentation should have been very low. As the the bruteforce mode is used to recover fragmented files, you can consider it will be practically useless and stop it (Ctrl-C).

mkotl
Posts: 2
Joined: 30 Jul 2019, 13:55

Re: Phororec freezes on brutforce

#3 Post by mkotl »

It theory yes (partition should be not fragmented), but I noticed many .jpg files which contained upper part of the picture and the rest was lost (after recovery with TestDisk, Photorec without bruteforce do not recover these files). It looks like they were fragmented. I don't know how much writing was made on this partition before.
The other think is that there is some bug in brute force search algorithm crashing Photorec.

Locked