cgsecurity.org

Background:
After receiving a file system corrupt message I ran CHKDSK which had the unexpected result of my disk reverting to a previous state (all files and foledr tree from August 2016). In order to recover my lost files 2016-2020 I ran photorec_win.exe version 7.2.0.0.

Problem:
Everything was looking good, however when viewing the recovered files I found that
recup_dir.237 through to recup_dir.715 all contain the same files. (the final directory recup_dir.716 did contain 33 different files).
All the data up to August 2016 was successfully "recovered". I feel that the VOLUME of data recovered, especially as the last 33 files recovered are from
the last set of photos I added to the drive.

Speculation/Question
Is it possible, due to insufficient RAM or other issue that PhotoRec was unable to read past a certain sector?
Is it possible to run PhotoRec beginning from a given sector instead of from the beginning?

Thank you in advance! Dan

Have you been careful to not store the recovered files on the source ?
Did you have a recent 7.2-WIP ? Versions before January 26 may get in an endless loop.

It's possible to edit the photorec.ses file to remove some sector range or edit the current sector location. When restarting PhotoRec, you should be able to resume the recovery.

@cgrenier Thanks for your reply.
1. I’ve been careful to save to separate external drive.
2. This is the 7.2.0.0 version, May build I think.
3. Great, thanks, I’ll try the .ses edit.