Hi,
PhotoRec is a great tool to recover files when a file signature is known. I have a Macrium Reflect backup image file I'm trying to recover from a Synology NAS that uses the ext4 file system. I've been able to plug the hard drive into my PC and use PhotoRec with it but it can't find the .mrimg file. It was able to recover GIF and JPEG files just fine. My guess is there's no way to figure out a file signature for .mrimg files.
Internet searches turned up someone who was able to find an .mrimg file using scrounge-ntfs, but I would need a version of scrounge for ext4.
Could PhotoRec be used in a way to skip signature checking and simply look for huge files, say over 100GB?
Thanks!
PhotoRec for recovery of very large files?
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
recuperation
- Posts: 2761
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: PhotoRec for recovery of very large files?
No. When skipping signatures Photorec can't determine the start or location of a file. Therefore it can't find one.Interstate90 wrote: ↑27 Jun 2023, 20:16 Could PhotoRec be used in a way to skip signature checking and simply look for huge files, say over 100GB?
You have to build your common signature, the how is explained in the manual.
You just have to find out what all Macrium reflect backup files have in common.
If you look at them with a hex editor like HxD and compare them pair-wise at the beginning you should find some bytes that are equal over all your Macrium backup files. These are the bytes you should put into the signature.
Be aware that, as backup files are typically large, Photorec will only succeed if the file data has been stored in consecutive order.