Scan repeatedly restarts from lower point

Using PhotoRec to recover lost data
Post Reply
Message
Author
nickd
Posts: 3
Joined: 09 Mar 2017, 22:27

Scan repeatedly restarts from lower point

#1 Post by nickd » 09 Mar 2017, 22:31

Howdy! I'm running PhotoRec on a drive, curious why it's restarting. It appears to have recovered a lot files, but now it starts from an earlier point over and over every couple of days.

So it'll go from e.g.:

Pass 1 - Reading sector 316755605/976745984, 51485 files found
Elapsed time 101h23m43s - Estimated time to completion 211h16m00

to

Pass 1 - Reading sector 97068011/976745984, 51487 files found
Elapsed time 334h44m47s - Estimated time to completion 3033h38m10

to

Pass 1 - Reading sector 131172202/976745984, 51488 files found
Elapsed time 389h26m13s - Estimated time to completion 2510h25m21


It's reading a lower number of sectors, even though it's found lots of files. It might recover 1 or 2 more before it restarts.

Thoughts on why this may be? Should we just end the scan?

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3555
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Scan repeatedly restarts from lower point

#2 Post by cgrenier » 10 Mar 2017, 06:51

Please try using latest 7.1-WIP version.
To avoid to restart from the beginning, you can copy the photorec.ses file from the old version of photorec to the directory where the latest version is.
If needed, https://www.cgsecurity.org/testdisk.pdf explains how to install the latest version.

nickd
Posts: 3
Joined: 09 Mar 2017, 22:27

Re: Scan repeatedly restarts from lower point

#3 Post by nickd » 16 Mar 2017, 17:26

Thanks! I just ran 7.1-WIP and it completed the scan successfully. Appreciate the help.

One more thing, though: instead of generating a bunch of directories with files in them as before, photorec appears to have generated two files:

f905091823.diskimage, which is 293.5GB
report.xml, which is 2kb (and is pasted).

What's the best way to unzip the diskimage file and access its contents? Disk Utility and hdiutil appear to not work. Thanks!

Code: Select all

<?xml version='1.0' encoding='UTF-8'?>
<dfxml xmloutputversion='1.0'>
  <metadata 
  xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML' 
  xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' 
  xmlns:dc='http://purl.org/dc/elements/1.1/'>
    <dc:type>Carve Report</dc:type>
  </metadata>
  <creator>
    <package>PhotoRec</package>
    <version>7.1-WIP</version>
    <build_environment>
      <compiler>GCC 4.0</compiler>
      <compilation_date>2017-03-03T06:48:04</compilation_date>
      <library name='libext2fs' version='1.42.8'/>
      <library name='libewf' version='20120504'/>
      <library name='libjpeg' version='62'/>
      <library name='libntfs' version='libntfs-3g'/>
      <library name='zlib' version='1.2.3'/>
    </build_environment>
    <execution_environment>
      <os_sysname>Darwin</os_sysname>
      <os_release>16.4.0</os_release>
      <os_version>Darwin Kernel Version 16.4.0: Thu Dec 22 22:53:21 PST 2016; root:xnu-3789.41.3~3/RELEASE_X86_64</os_version>
      <host>squeller</host>
      <arch>x86_64</arch>
      <uid>0</uid>
      <start_time>2017-03-10T08:51:33-0600</start_time>
    </execution_environment>
  </creator>
  <source>
    <image_filename>/dev/disk7</image_filename>
    <sectorsize>4096</sectorsize>
    <image_size>4000752599040</image_size>
    <volume>
      <byte_runs>
        <byte_run offset='0' img_offset='4096' len='4000751550464'/>
      </byte_runs>
      <block_size>4096</block_size>
    </volume>
  </source>
  <configuration>
  </configuration>
  <fileobject>
    <filename>f905091823.diskimage</filename>
    <filesize>293495443456</filesize>
    <byte_runs>
      <byte_run offset='0' img_offset='3707256111104' len='293495443456'/>
    </byte_runs>
  </fileobject>
</dfxml>

nickd
Posts: 3
Joined: 09 Mar 2017, 22:27

Re: Scan repeatedly restarts from lower point

#4 Post by nickd » 31 Mar 2017, 14:55

Hello! Just following up on this – how does one read .diskimage files?

Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests