Why might photorec do this?

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
lostbit
Posts: 4
Joined: 30 Nov 2025, 01:03

Why might photorec do this?

#1 Post by lostbit »

I used a scripted run of photorec to recover everything on a usb stick. It recovered lots of files including pdf and gnucash.

I then did a test and searched only for pdf and it returned just pdf. I then did the same for gnucash and it recovered nothing.

I wonder why that might happen? It's certainly capable of finding gnucash files but leaves me a bit worried files will get left behind if I search for a specific file type.

Thank you for any insight.
recuperation
Posts: 3108
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Why might photorec do this?

#2 Post by recuperation »

Which version are you using?
lostbit
Posts: 4
Joined: 30 Nov 2025, 01:03

Re: Why might photorec do this?

#3 Post by lostbit »

PhotoRec 7.2, on openSUSE
recuperation
Posts: 3108
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Why might photorec do this?

#4 Post by recuperation »

Please download the 7.3 BETA and try to reproduce the error.
The linux version contains the static version of PhotoRec - no installation is necessary.
lostbit
Posts: 4
Joined: 30 Nov 2025, 01:03

Re: Why might photorec do this?

#5 Post by lostbit »

Thank you for replying.

Same with 7.3 beta... it doesn't work.

PhotoRec syntax error: gnucash,enable,search

If I run the same command but replace gnucash with txt it recovers all the txt (and py, html etc) files.

I don't know how many filetypes it might do it for but I can't get it to work for any custom signatures I create either. If I use fileopt,everything,enable then the gnucash files, and custom signatures are found.
recuperation
Posts: 3108
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Why might photorec do this?

#6 Post by recuperation »

lostbit wrote: 12 Dec 2025, 23:18 Thank you for replying.

Same with 7.3 beta... it doesn't work.

PhotoRec syntax error: gnucash,enable,search
Please explain these words.


If I run the same command but replace gnucash with txt it recovers all the txt (and py, html etc) files.

I don't know how many filetypes it might do it for but I can't get it to work for any custom signatures I create either. If I use fileopt,everything,enable then the gnucash files, and custom signatures are found.
Custom signatures do work but I can't help you without a proper bug documentation. Your error description is vague and lacking details.

There is at least one thread where I went through creating a custom signature in all details, based on the failures the user experienced.

You should always check your custom signature by putting some files and a file with a type that you want to find. Put them on a USB pen drive p.e. If that test file is not found, your signature is wrong.
lostbit
Posts: 4
Joined: 30 Nov 2025, 01:03

Re: Why might photorec do this?

#7 Post by lostbit »

I've learned that PhotoRec doesn't handle individual file types, onlly families of file types. So, gnucash is found using gz.

gz
gnucash, kmy, RData, schematic, sla, tgz, als, prproj

zip
docx, xlsx, pptx, odt, ods, odp, epub, jar, apk, kmz, vsdx, kra, xd, indd, xpi, sketch

txt
py, php, html, asp, bat, c, h, java, js, json, sh, xml

tiff
pef, nef, dcr, sr2, arw, cr2, dng, wdp

mov
mp4, m4a, m4v, 3gp, 3g2, heic, jp2, cr3

doc
xls, ppt, vsd, pub, mdb, msg, max, sldprt, fla, wps, qbb

riff
wav, avi, cdr, cda, ani, cpr, aep

mkv
webm, ebml

asf
wma, wmv

exe
dll
recuperation
Posts: 3108
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Why might photorec do this?

#8 Post by recuperation »

lostbit wrote: 12 Dec 2025, 23:18 Thank you for replying.

Same with 7.3 beta... it doesn't work.

PhotoRec syntax error: gnucash,enable,search


I give up. I can't help you. Yes, I know what families are.

Again:
These two lines are not a bug report!

A bug report contains all the necessary information to reproduce a bug.
Typically it contains sentences. A sentence contains at least a subject and a verb.
PhotoRec syntax error:
This - is not a sentence!
I don't know what these words above are supposed to mean.
maxencevidal26
Posts: 1
Joined: 16 Dec 2025, 09:07

Re: Why might photorec do this?

#9 Post by maxencevidal26 »

PhotoRec detects files by file signatures. PDFs have a strong, well-defined signature, so they’re easy to find. GnuCash files often don’t have a unique signature (or are embedded in SQLite/XML), so PhotoRec may only recover them during a broad scan and miss them when filtering by type.

So yes, when you restrict file types, some files can be missed. A full scan is safer for uncommon formats.
recuperation
Posts: 3108
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Why might photorec do this?

#10 Post by recuperation »

What you say contradicts what Christophe Grenier programmed as far as I can read C.
Furthermore the scan undertaken by PhotoRec is always complete. Deselecting families does not reduce scan time.
Post Reply