Using Photorec on memorydump - FAIL

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
miksi
Posts: 2
Joined: 10 Jun 2014, 05:47

Using Photorec on memorydump - FAIL

#1 Post by miksi » 10 Jun 2014, 05:55

Hello everybody. I have a memorydump (mymemory.dmp) which DOES contain several JPGs as i can see the data with a hex editor. I use "photorec_win.exe mymemory.dmp" and expected JPGs beeing extracted by Photorec. But Photorec does not find one single image. Regardless what options i select. I even unchecked every other file extensions in the options and manually checked only the JPG extension.
This is very weird because i can copy the JPGs by hand from within a hex editor and have valid images that way; why does Photorec fail here?


Thanks for infos, ciao!

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 4390
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Using Photorec on memorydump - FAIL

#2 Post by cgrenier » 14 Jun 2014, 17:24

Enable the expert mode, force a blocksize of 512 when asked. If it doesn't work, try
"photorec_win.exe /cmd mymemory.dmp blocksize,1,search"

miksi
Posts: 2
Joined: 10 Jun 2014, 05:47

Re: Using Photorec on memorydump - FAIL

#3 Post by miksi » 27 Jun 2014, 14:13

Thanks, that worked. :)

Post Reply

Who is online

Users browsing this forum: Bing [Bot] and 2 guests