cgsecurity.org

Hello,

I have three drives:
- MacintoshHD internal disc with OS (500GB)
- OhneTItel: disc to be recovered (2TB) external
- OHneTitel1: disc to save the recovered files to. (3TB) external

after running photorec and recovering the files successfully (1.5TB had been written to "OhneTItel1") my internal disc is full and only 225MB free. I can find no files that have been written to the disc.

During the recovery process I assumed the 500GB HDD was used as a buffer (allthough only 13GB of my 16GB RAM had been used). After quiting photorec and rebooting the drive space is still full. I deleted photorec.ses now and it is still full.

The recovered data is written to my external drive (I can see folders named "recup_dir.15" and so on. It started there after pass2 as far as I know.

Two questions, 1. why is my internal disk full, allthough there are no new files 2. why can't I find recup_dir.1, recup_dir.2 and so on?

Update:

DaisyDisk (app) shows me, that there is 90GB of space used, that is not visible in Finder. The 90GB files are named recup_dir.1 till 14. So Photorec must have started to recover to my internal drive and then went on with recup_dir.15 to 71 on my external drive, allthough I had selected the big external drive as destination.
It seems photorec has made a logical Volume combined of the 100GB free space on my internal drive and the 2,16TB free space on my external drive, allthough I only selected the external drive as destination.