cgsecurity.org

Hi,

PhotoRec is a great tool to recover files when a file signature is known. I have a Macrium Reflect backup image file I'm trying to recover from a Synology NAS that uses the ext4 file system. I've been able to plug the hard drive into my PC and use PhotoRec with it but it can't find the .mrimg file. It was able to recover GIF and JPEG files just fine. My guess is there's no way to figure out a file signature for .mrimg files.

Internet searches turned up someone who was able to find an .mrimg file using scrounge-ntfs, but I would need a version of scrounge for ext4.

Could PhotoRec be used in a way to skip signature checking and simply look for huge files, say over 100GB?

Thanks!

Interstate90 wrote: 27 Jun 2023, 20:16 Could PhotoRec be used in a way to skip signature checking and simply look for huge files, say over 100GB?

No. When skipping signatures Photorec can't determine the start or location of a file. Therefore it can't find one.
You have to build your common signature, the how is explained in the manual.

You just have to find out what all Macrium reflect backup files have in common.
If you look at them with a hex editor like HxD and compare them pair-wise at the beginning you should find some bytes that are equal over all your Macrium backup files. These are the bytes you should put into the signature.

Be aware that, as backup files are typically large, Photorec will only succeed if the file data has been stored in consecutive order.