cgsecurity.org

I have an old laptop that runs Ubuntu. Its partition was full so I tried to extend it.
In a moment of idiocy, I deleted the primary partition. I thought all my files were backed up, so I just re-installed Ubuntu using the whole disk (the rest of it had Windows at one point I think).
Well, turns out that my Keepass password file was not synched up. I pulled the disk out of the laptop and connected it via USB to my deskop and ran PhotoRec on it.
I attempted recovery on the whole disk, using default options, and only selecting the 2 Keepass file extensions (kdb, and kdbx)

I have 17 recovered files, varying in size from a bit over 100 KB to about 37GB. The original file is around 10KB.
I have a couple of other password DBs that are ~ 100KB each.

The versions of the password DB file I need vary in size between ~ 100KB to about 300MB
I'm trying to figure out why the file sizes vary so much, when they are almost identical?

Some of the very large files that were recovered (10s of GB) are unreadable.
Is there anything I can do beyond the basics that can help in this situation? I have the outdated version of the password file if that matters.

I'm running in expert mode (no paranoid, not keeping corrupt files) and it asked me if it should attempt to unformat FAT. I assume this is because the file system is mounted?
I read in the step by step guide that I should select the smallest block size possible, so I selected 512.
Now I see a bunch of i_node directories, and a number of different files in them, not only .kdbx ones, even though that's the only file extension selected in the file options?

Finally, is "brute force" only for JPEGs?

Please rerun PhotoRec with all other file types selected to see if the file size of your password databases shrinks.

Re-running now with Paranoid (brute force enabled), Expert Mode: No, Keep Corrupted Files: Yes and All file types enabled.
I'm seeing a bunch of recup_dir.<num> being created with a bunch of different files in them. Will report if the files shrink. Do you suspect a bug?

Also, when in expert mode, it seems that the file options are being dis-regarded?

When I run with all file types enabled, the size of the recovered files is much more reasonable.
It still appears slightly over the expected size but it's much closer in size.
However, I still notice slight file size growth.
In my case, I have a file that periodically changes slightly. Photorec recovers, say, 8 version of that file.
Version 1 is just about the expected size. Version 2 is slightly bigger. Version 3 is slighly bigger, and so forth.

In my case the expected file size is 7.8KB
Recovered file sizes are : 12.3 KB, 49.2 KB, 53.2 KB, 57.3 KB, 81.9 KB, 159.7 KB, 335.9 KB, 555.7 KB

The files are still valid and I can open them.

Enabling the other families tends to shorten the file because PhotoRec stops when it hits another file signature which will close the current file in recovery.

Isn't that a bug?
I would expect photorec to do that regardless. The only difference should be that files with extensions that are not selected are not saved.

If PhotoRec worked like you proposed, any known file signature that in reality is not a file signature but represents pure data within another file with a different type would have the current file being finalized.

Doing it your way there would be no way to prevent this behaviour.