Hi Everyone,
I have been trying to recover files using photorec, but so far I have not been too successful. The drive is read-only so hopefully I will not continue to overwrite deleted data.
I am desperate to get this data or at least as much as I can recovered because it was 6 months worth of scientific work. This happen as long as one year ago, but the computer has been used minimally since then.
The deleted files are a stream of images taken from a CCD camera. They have no footer, but all have the following header in the first line: ISOIdwR'COIMSOFT thefilename
Each deleted file is of one of two sizes: 659715948 bytes or 520089082 bytes.
The larger byte sized file and smaller byte size file go together and the names are used to read them together (e.g., t_19a.0100 (large) and t_19a.0101 (smaller)).
I made a custom signature file in photorec using: raw 0 "ISOIdwR"
fidentify could recognize existing undeleted files, labeling them as "raw."
When running photorec I picked /dev/sda, 6 Linux, ext3, and under file opts I selected only the custom signature file.
Many files were recovered all having the correct header. However, many files were much greater than the 659715948 bytes. Some were also smaller. I tried running the command to analyze this file, but it failed and recognizes that the file size is much too large.
1. What can I do to carve out the data better? Is there a way to set a byte size limit since there is no good footer?
2. Should I be using testdisk instead of photorec?
3. Is there a difference between photorec 6.13 and 6.14 in how well they recover? I am using photorec 6.13.
Thank you!
Deleted large custom files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
- cgrenier
- Site Admin
- Posts: 5438
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: Deleted large custom files
When using latest PhotoRec 6.14-WIP, you can also enable "ext ext2/ext3/ext4 Superblock".
Actually, to be able to specify a filesize limit, you have to be able to program in C
But you can truncate the recovered files using "dd if=old.raw of=new.raw count=1 bs=520089082".
Can you check if some of the recovered files (after truncation) are valid ?
Actually, to be able to specify a filesize limit, you have to be able to program in C
But you can truncate the recovered files using "dd if=old.raw of=new.raw count=1 bs=520089082".
Can you check if some of the recovered files (after truncation) are valid ?