My laptop is Win 11 and has 2 disks all NTFS.
We had used Disk Drill initially as the file is under 500 MB but Disk Drill failed to recover any of the mkv and mp4 files.
I had used TestDisk (doc 8.2 directions) but unable to see the files from yesterday (other older files deleted are available).
Q1: Is it still possible to recover files that are permanent delete with TestDisk or PhotoRec ?
I can see the files in TestDisk but after copying the files did not appear in my destination (using 'a' to select all then uppercase 'C' then 'C' again at the destination page).
A smaller file "content.phf" and it did appear in the destination.
Q2: How to verify or QA custom signature for PhotoRec on mka and mp4 files in Windows 11? (Pardon me if this a silly question)
I have read and following 12.1 Signature Syntax of manual but a bit confuse on how to do so with MS Windows 11.
Because I had use PhotoRec and it says 0 files recover despite I update the options to keep corrupted files - so would the custom Signature help solve this?
This is the report.xml
Code: Select all
<dfxml xmloutputversion="1.0">
<metadata xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/">
<dc:type>Carve Report</dc:type>
</metadata>
<creator>
<package>PhotoRec</package>
<version>7.2</version>
<build_environment>
<compiler>GCC 11.2, Cygwin 3001.4</compiler>
<library name="libext2fs" version="1.45.3"/>
<library name="libewf" version="20140608"/>
<library name="libjpeg" version="libjpeg-turbo-1.5.3"/>
<library name="libntfs" version="available"/>
<library name="zlib" version="1.2.11"/>
</build_environment>
<execution_environment>
<os_sysname>Windows</os_sysname>
<os_release>Windows 8 (9200)</os_release>
<os_version>Windows 8 (9200)</os_version>
<host>DESKTOP-Q0VKD40</host>
<arch>x86_64</arch>
<uid>197610</uid>
<start_time>2025-01-10T14:27:38+0800</start_time>
</execution_environment>
</creator>
<source>
<image_filename>\\.\PhysicalDrive0</image_filename>
<sectorsize>512</sectorsize>
<device_model>WDC WD10SPZX-00Z10T0</device_model>
<image_size>1000204886016</image_size>
<volume>
<byte_runs>
<byte_run offset="0" img_offset="137455730688" len="137438953472"/>
</byte_runs>
<block_size>4096</block_size>
</volume>
</source>
<configuration> </configuration>
</dfxml>