cgsecurity.org

I'm trying to recover some Firefox data I accidentally deleted off of my hard drive using Photorec. I'm not currently using the hard drive itself, I'm running off of a live Linux OS at the moment. Besides that, I have a second empty USB thumb drive plugged in for storing what Photorec may find.

ATM I'm only looking for json files specific to Firefox, this is what I have in my photorec.sig file:
And I set Photorec to search only for those files.

When I run Photorec it finds one json file, but when it continues it states that there's not enough space. While the empty drive is small (4GB) I thought that would be enough to hold a few json files. But continuing the run shows the free space in the storage USB dropping below 100 MiB despite no new json files being added to it.

What's going on? The first json file is roughly 45MB in size, even if new json files were being added they can't possibly add up to more than one or two gigabytes, leaving plenty of space on the storage USB. dumpe2fs shows the block size for the drive I'm scanning and the USB stick are both the same (4096) and both file systems are ext4.

Are there other settings I should change, or should I just get a larger USB stick?

feckinBazBar wrote: Yesterday, 22:59 Are there other settings I should change, or should I just get a larger USB stick?

Get a larger storage device. Be careful: Garbage flash storage often ends in USB sticks.
If your recovery target device is empty and as big as your recovery source you should not have a space problem.

PhotoRec typically ends a file when it discovers any new file signature.
Your current set-up with just your individual fingerprint being active has a tendancy to create very large files due to a lack of following fingerprints.