PhotoRec: Specific Files/Sectors?

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
HomelyPoet
Posts: 8
Joined: 17 Mar 2012, 15:56

PhotoRec: Specific Files/Sectors?

#1 Post by HomelyPoet »

Is there a way to point PhotoRec at a specific file, or sector?
Previous attempts to recover .mp4, .flv, .mov, et cetera, video files resulted in files, though correct in size and file-type, refused to play through either QuickTime 7.7 (1680.25)[Pro], VLC 2.0.0 nor VLC 2.0.1.
Or, Wouldst this be a case for either dd, dd_rescue or ddrescue?
User avatar
cgrenier
Site Admin
Posts: 5437
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: PhotoRec: Specific Files/Sectors?

#2 Post by cgrenier »

HomelyPoet wrote:Is there a way to point PhotoRec at a specific file, or sector?
To recover a specific file, try TestDisk, Advanced, Undelete.
To ignore data before a certain sector, start a recovery using PhotoRec 6.14-WIP or later, stop it, edit the photorec.ses with a text editor like wordpad or notepad++, modify the sector near the end of the second line (a very long line) just before ",inter".
HomelyPoet wrote: Previous attempts to recover .mp4, .flv, .mov, et cetera, video files resulted in files, though correct in size and file-type, refused to play through either QuickTime 7.7 (1680.25)[Pro], VLC 2.0.0 nor VLC 2.0.1.
Fragmented files won't play correctly but otherwise there should be no problem. Which filesystem are you recover your data from ?
HomelyPoet wrote: Or, Wouldst this be a case for either dd, dd_rescue or ddrescue?
They will have no effect.
HomelyPoet
Posts: 8
Joined: 17 Mar 2012, 15:56

Re: PhotoRec: Specific Files/Sectors?

#3 Post by HomelyPoet »

HFS+:
Drive: ST2000DL 003-9VT166 Media
Partition Map Scheme : Apple Partition Map
Total Capacity : 1.8 TB (2,000,398,934,016 Bytes)
Volume: Capacity : 1.8 TB (2,000,264,675,328 Bytes)
File System : Mac OS Extended (Journaled)[HFS+]
Written Area: 3906766944 Sectors
Sector Size: 512 bytes

From TestDIsk:
Disk /dev/disk2 - 2000 GB / 1863 GiB - CHS 3907029168 1 1 (RO)
1 P Mac HFS 262208 3907029151 3906766944
Disk /dev/rdisk2 - 2000 GB / 1863 GiB - CHS 3907029168 1 1 (RO)
>P Mac HFS 262208 3907029151 3906766944

Further information from TestDisk I Posted at: Board index/TestDisk & PhotoRec forum in English/File undelete/File Recovery Mac OSX 10.5

It seems there might be a connection betwixt the assigned file designation from PhotoRec and sector number, is that so?
HomelyPoet
Posts: 8
Joined: 17 Mar 2012, 15:56

Re: PhotoRec: Specific Files/Sectors?

#4 Post by HomelyPoet »

Thought I might post the most recent session log.

#1332103823
/dev/disk1 partition_mac,3,blocksize,4096,
fileopt,custom,disable,1cd,disable,7z,disable,
DB,disable,a,disable,abcdp,disable,accdb,disable,
ace,disable,ab,disable,ahn,disable,aif,disable,
all,disable,als,disable,amd,disable,amr,disable,
apa,disable,ape,disable,apple,disable,arj,disable,
asf,disable,asm,disable,atd,disable,au,disable,
bac,disable,bim,disable,bkf,disable,blend,disable,
bmp,disable,bz2,disable,cab,disable,caf,disable,
cam,disable,catdrawing,disable,cdt,disable,
chm,disable,class,disable,comicdoc,disable,
cp_,disable,cow,disable,crw,disable,ctg,disable,
cwk,disable,d2s,disable,dar,disable,dat,disable,
dbf,disable,dbn,disable,ddf,disable,dex,disable,
diskimage,disable,djv,disable,dmp,disable,drw,
disable,doc,disable,dpx,disable,ds2,disable,dsc,
disable,dss,disable,dta,disable,dump,disable,dv,
disable,dwg,disable,dxf,disable,e01,disable,
eCryptfs,disable,edb,disable,elf,disable,emf,disable,
evt,disable,exe,disable,exs,disable,ext,disable,
fat,disable,fbk,disable,fcp,disable,fcs,disable,
fdb,disable,fh10,disable,fh5,disable,sparseimage,disable,
fits,disable,flac,disable,flp,disable,flv,enable,fob,disable,
fp5,disable,fp7,disable,freeway,disable,frm,disable,
fs,disable,gam,disable,gct,disable,gho,disable,gif,disable,
gm6,disable,gp5,disable,gpg,disable,gz,disable,hdf,disable,
hds,disable,hr9,disable,icc,disable,ico,disable,ifo,disable,
imb,disable,indd,disable,iso,disable,it,disable,itu,disable,
jpg,disable,kdb,disable,ldf,disable,logic,disable,lnk,disable,
lso,disable,lxo,disable,lzo,disable,m2ts,disable,mat,disable,
max,disable,mb,disable,mcd,disable,mdb,disable,mdf,disable,
mfa,disable,mfg,disable,mid,disable,mk5,disable,mkv,disable,
mov,enable,mp3,disable,mpg,disable,mrw,disable,
mus,disable,myo,disable,MYI,disable,mxf,disable,nds,disable,
njx,disable,nk2,disable,nsf,disable,oci,disable,ogg,disable,
one,disable,orf,disable,paf,disable,pap,disable,par2,disable,
pcap,disable,pct,disable,pcx,disable,pdf,disable,pds,disable,
pfx,disable,png,disable,pnm,disable,prc,disable,prt,disable,
ps,disable,psd,disable,psf,disable,psp,disable,pst,disable,
ptb,disable,ptf,disable,pyc,disable,pzf,disable,pzh,disable,
qbb,disable,qdf,disable,qkt,disable,qxd,disable,r3d,disable,
ra,disable,raf,disable,rar,disable,raw,disable,rdc,disable,
reg,disable,res,disable,rfp,disable,riff,disable,rm,disable,
rns,disable,rpm,disable,rw2,disable,save,disable,ses,disable,
sib,disable,SIT,disable,skd,disable,skp,disable,sp3,disable,
spe,disable,spf,disable,sav,disable,sqlite,disable,sqm,disable,
stl,disable,sit,disable,swf,enable,tar,disable,tax,disable,
tib,disable,tif,disable,TiVo,disable,torrent,disable,tph,
disable,ts,disable,ttf,disable,tx,disable,txt,disable,tz,disable,
vault,disable,vfb,disable,vdi,disable,veg,disable,vmdk,disable,
vmg,disable,wdp,disable,win,disable,wks,disable,wmf,disable,
wnk,disable,wpb,disable,wpd,disable,wtv,disable,wv,disable,
x3f,disable,xcf,disable,xfi,disable,xm,disable,xsv,disable,
xpt,disable,xv,disable,zip,disable,
options,paranoid,keep_corrupted_file_no,wholespace,search,status=ext2_off,155595712,inter
262208-4359519
9864208-9865015
11898584-11898671
13190288-13190375
14471072-14471159
15767888-15767975
17082520-17082607
18365096-18365183
19668032-19668119
20961872-20961959
22240984-22241071
23536160-23536247
26085608-26085695
27402112-27402199
29034024-29034111
30628240-30630423
32253328-32262863
33582976-33585375
35214112-35214199
36835952-36836039
38461864-38461951
40119448-40119535
41427528-41427615
42743880-42743967
44361896-44361975
45972880-45975071
47568184-47568271
49227488-49227575
50880432-50880519
52506184-52506271
54162752-54162839
55761104-55761191
57412144-57412231
59032000-59032087
60617904-60617991
62270960-62271047
63858736-63858823
65169784-65169871
66475248-66475335
67756824-67756911
69049576-69049663
69060568-69060655
69076288-69076375
69470984-69471071
69564992-69565079
69596480-69596567
69678144-69678231
69722480-69722567
69736088-69736175
69743584-69743671
69848664-69848751
69868520-69868607
69923112-69923199
69956232-69956319
70489008-70489095
70571728-70571815
71296576-71296663
71689888-71689967
71974808-71974895
72186208-72186647
72490184-72490271
72698120-72698207
72803688-72803775
73031392-73031479
73217520-73217607
73577352-73577439
74127288-74127375
74197624-74197711
74499352-74499439
74828032-74828279
78607544-81143551
84225840-84226087
87496664-87496911
90292352-90292599
93237416-93237663
95932368-95932615
106911976-106912695
106984736-106984983
107620976-107621223
108250856-108251103
108303048-108303999
108337776-108364335
109729768-110025487
110044304-110068999
110088640-110117431
110117432-110192215
110213528-110233175
110266912-110352735
110375360-110404151
110423048-110447655
111396560-112248999
112249000-112311887
112579864-112858831
113130808-113413879
113438944-113475943
113494672-113519359
113573760-113635359
113697704-113829887
113856440-113889247
113999912-114084047
114096008-114108319
114158952-114216383
114267224-114396551
114412592-114433095
114528128-114589983
114762128-114942647
114942648-115007959
115007960-115138599
115181008-115230231
115289272-115354911
115400808-115454127
115499168-115548399
115651816-115762575
115789760-115822575
115945296-116072479
116162592-116256951
116352440-116455007
116478888-116507599
116574176-116648015
116728056-116814199
116855992-116905207
116963712-117029343
117099712-117177655
117365040-117557863
117604392-117657719
117657720-117689335
117689336-117877847
117891384-117907791
118008360-118115023
118157216-118276503
118375248-118444991
118507528-118577263
118844040-119118911
119128736-119141031
119211040-119288991
119369448-119455599
119504864-119558191
119628272-119778919
119801264-119825879
119914800-119970327
120038712-120112559
120171176-120232735
120279832-120329071
120329072-120338631
120338632-120451375
120540624-120634983
120738496-120930255
121051776-121137927
121213168-121374255
121435360-121447983
121486064-121539079
121617528-121771831
121869016-121971575
122056488-122110783
122162040-122215367
122307464-122405927
122484352-122566399
122615632-122669007
122676104-122754871
122860912-122871951
125942416-125967327
128407960-128597655
136452016-136456671
139233744-139236375
142423952-142478279
143813280-143813367
145716440-145719023
147379880-147379967
149040800-149040887
150718720-150718807
152295600-152295687
153952776-153952863
155595624-155595711
155595712-3907029151
User avatar
cgrenier
Site Admin
Posts: 5437
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: PhotoRec: Specific Files/Sectors?

#5 Post by cgrenier »

HomelyPoet wrote:It seems there might be a connection betwixt the assigned file designation from PhotoRec and sector number, is that so?
Yes, PhotoRec uses the logical sector number to create the filename.

Transparent compression may be enabled on HFS+ filesystem (Mac OS X 10.6 or later), it's why in your case PhotoRec may failed to recover your data correctly.
HomelyPoet
Posts: 8
Joined: 17 Mar 2012, 15:56

Re: PhotoRec: Specific Files/Sectors?

#6 Post by HomelyPoet »

Mac OS X 10.5.8 (9L31a)/Darwin 9.8.0

So, as an example, 262208-4359519 (from the Session log posted) wouldst be the logical sectors 262208 [Start?] through 4359519 [End?] ?

And each sector being 512 bytes, that wouldst represent approximately 1.954417347 GiB, Correct?
(((end-start)*512=[Bytes])*0.000000954=[Mega-Bytes])*0.0009765625=[Giga-Bytes]

Theoretically allowing physical mapping to the exact file, more or less?

How/Where wouldst one find out if transparent compression is/is not enabled?
Is there a command line command that wouldst/wouldstn't allow access to such information?
User avatar
cgrenier
Site Admin
Posts: 5437
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: PhotoRec: Specific Files/Sectors?

#7 Post by cgrenier »

You can use hfsdebug to learn if compression is used on a given file
http://hints.macworld.com/article.php?s ... 2223042255
nobootabledevice
Posts: 6
Joined: 29 Jul 2014, 12:53

Re: PhotoRec: Specific Files/Sectors?

#8 Post by nobootabledevice »

cgrenier wrote: To ignore data before a certain sector, start a recovery using PhotoRec 6.14-WIP or later, stop it, edit the photorec.ses with a text editor like wordpad or notepad++, modify the sector near the end of the second line (a very long line) just before ",inter"..
I did this and it's now completely stuck at a new sector when I opened it up. It's not even moving, the only thing moving is the 'estimated time to completion'.
Deity666
Posts: 19
Joined: 29 Jul 2014, 20:40

Re: PhotoRec: Specific Files/Sectors?

#9 Post by Deity666 »

I started a large file last night and it was still running this morning. This, being the first time I had seen it, made me think the worse. What the hell, maybe if I hit the right arrow key it will show me how many files are left? I did, presto! it was finished. I don't know if it finished last night or just that moment, but you might try it? I don't see how that can have any negative consequences, but I'm up to my neck in my own problems, so who's to say - but the people in charge.
Locked