# PhotoRec Passo Dopo Passo

### From CGSecurity

english version deutsche Version version française Русская версия

Questo Esempio di recupero ti guida attraverso PhotoRec passo dopo passo per recuperare file cancellati o dati persi dovuti a una partizione formattata o a un filesystem corrotto. Translation of this PhotoRec manual to other languages are welcome.

## Avvia l'eseguibile PhotoRec

Se PhotoRec non è ancora installato, può essere scaricato da TestDisk Download. Estrai i file dall'archivio includendo le sottocartelle.

Per recuperare dei file dall'hard disk, chiavetta USB, Smart Card, cd-rom, dvd..., devi possedere sufficienti diritti d'accesso al dispositivo fisico.

- In ambiente Dos, esegui photorec.exe
- In ambiente Windows, esegui PhotoRec (ad esempio testdisk-6.9/win/photorec_win.exe) da un account del Gruppo Admministratori. In ambiente Vista, clicca col tasto destro del mouse "esegui come amministratore" per lanciare PhotoRec.
- In ambiente Unix/Linux/BSD, devi essere utente root per eseguire PhotoRec (ad es. `sudo testdisk-6.9/linux/photorec_static`)
- In ambiente MacOSX, esegui PhotoRec (ad es. testdisk-6.9/darwin/photorec). se non sei root, PhotoRec si riavvierà automaticamenteusando sudo dopo la conferma da parte dell'utente.
- In ambiente OS/2, PhotoRec non gestisce dispositivi fisici, ma solo immagini disco, ci spiace.

Per recuperare i file da dall'immagine di un dispositivo, esegui

- `photorec image.dd` per ritagliare un'immagine raw di un disco
- `photorec image.E01` per recuperare file da un'immagine Encase EWF
- `photorec 'image.E*'` se l'immagine Encase è divisa in vari file.
- `photorec '/cygdrive/d/evidence/image.E*'` se l'immagine Encase è divisa in vari file nella cartella d:\evidence

Per recuperare file da altri dispositivi, esegui `photorec device`, per esempio.

- `photorec /dev/mapper/truecrypt0` per recuperare i file da una partizione TrueCrypt. Lo stesso metodo funziona con filesystem codificati con cryptsetup/dm-crypt/LUKS.
- `photorec /dev/md0` per recuperare file da un dispositivo Raid software Linux.

Utilizzatori scrupolosi possono usare il parametro `/log` per creare un file file di log chiamato `photorec.log`; registra l'ubicazione dei file recuperati da PhotoRec.

## Disk selection

Available media are listed. Use up/down arrow keys to select the disk that holds the lost files. Press `Enter` to proceed.

## Partition table type selection

Select the partition table type, usually the default value is the correct one as PhotoRec auto-detects the partition table type.

## Source partition selection

Choose

- `Search` after selecting the partition that holds the lost files to start the recovery,
- `Options` to modify the options,
- `File Opt` to modify the list of file types recovered by PhotoRec.

## PhotoRec options

- `Paranoid` By default, recovered files are verified and invalid files rejected.

Enable `bruteforce` if you want to recover more fragmented JPEG files, note it's a very CPU intensive operation.

- `Allow partial last cylinder` modifies how the disk geometry is determined, only non-partitioned media should be affected.
- The `expert mode` option allows the user to force the filesystem blocksize and the offset.
- Enable `Keep corrupted files` to keep files even if they are invalid in the hope that data may still be salvaged from an invalid file using other tools.
- Enable `Low memory` if your system doesn't have enough memory and crashes during recovery. It may be needed for large filesystems heavily fragmented. Don't use this option unless absolutely necessary.

## Selection of files to recover

Enable or disable the recovery of certain file types, e.g.

    [X] tif  Tag Image File Format and some raw file formats (pef/nef/dcr/sr2/cr2)
    ...
    [X] zip  zip archive including OpenOffice and MSOffice 2007

The whole list of file formats recovered by PhotoRec contains more than 100 file families representing more than 180 file extensions.

## Filesystem type

Once a partition has been selected, PhotoRec needs to know how the data blocks are allocated. Unless it's ext2/ext3 filesystem, choose `Other`.

## Carve the partition or unallocated space only

PhotoRec can search files from

- from the whole partition (useful if the partition is badly corrupted) or
- from the unallocated space only (Available for ext2/ext3, FAT12/FAT6/FAT32 and NTFS). With this option only deleted files are recovered.

## Select where recovered files should be written

Choose the directory where the recovered files should be written.

- Select `..` several times to get the drive list (C:, D:, E:...)
- Filesystem from external disk may be available in a `/media` or `/mnt` sub-directory.
- Partitions from external disk are usually mounted in `/Volumes`.

## Recovery in progress

Number of recovered files is updated in real time.

- During pass 0, PhotoRec searches the first 10 files to determine the blocksize.
- During pass 1 and later, files are recovered including some fragmented files.

Recovered files are written in recup_dir.1, recup_dir.2... sub-directories. It's possible to access the files even if the recovery is not finished.

## Recovery is completed

When the recovery is complete, a summary is displayed. Note that if you interrupt the recovery, the next time PhotoRec is restarted you will be asked to resume the recovery.

Category: Data Recovery

##### Data Recovery

- TestDisk
- PhotoRec
- download