I have been trying to recover files using photorec, but so far I have not been too successful. The drive is read-only so hopefully I will not continue to overwrite deleted data.
I am desperate to get this data or at least as much as I can recovered because it was 6 months worth of scientific work. This happen as long as one year ago, but the computer has been used minimally since then.
The deleted files are a stream of images taken from a CCD camera. They have no footer, but all have the following header in the first line: ISOIdwR'COIMSOFT thefilename
Each deleted file is of one of two sizes: 659715948 bytes or 520089082 bytes.
The larger byte sized file and smaller byte size file go together and the names are used to read them together (e.g., t_19a.0100 (large) and t_19a.0101 (smaller)).
I made a custom signature file in photorec using: raw 0 "ISOIdwR"
fidentify could recognize existing undeleted files, labeling them as "raw."
When running photorec I picked /dev/sda, 6 Linux, ext3, and under file opts I selected only the custom signature file.
Many files were recovered all having the correct header. However, many files were much greater than the 659715948 bytes. Some were also smaller. I tried running the command to analyze this file, but it failed and recognizes that the file size is much too large.
1. What can I do to carve out the data better? Is there a way to set a byte size limit since there is no good footer?
2. Should I be using testdisk instead of photorec?
3. Is there a difference between photorec 6.13 and 6.14 in how well they recover? I am using photorec 6.13.
Thank you!
