How to recover deleted files using photorec

When files are deleted from a storage device, they may still be recoverable, even if they no longer appear in the file system. The photorec tool is designed to recover lost files, including documents, images, and videos, from various file systems and storage devices. Unlike other recovery tools, photorec works by ignoring the file system and directly recovering files based on their signatures.

Photorec is highly effective for recovering files from hard drives, memory cards, USB drives, and other storage devices. It works with a wide range of file systems, including FAT, NTFS, ext2/3/4, and more. The tool scans the disk for recoverable files without modifying the file system, making it safe to use even on corrupted file systems.

This guide explains how to use photorec to recover deleted files. It's important to stop using the storage device immediately after discovering a deletion to prevent overwriting the deleted data.

1. Boot from a live CD or installer disk** to prevent overwriting the deleted files (optional).

     Insert the live CD or installer disk (e.g., Ubuntu Live CD).
     Boot from the disk and choose "Try Ubuntu" or similar option.

   Booting from a live CD or installer disk ensures that the operating system is not actively writing to the disk, preventing further overwriting of deleted files.

2. Install photorec on the live system if necessary.

   $ sudo apt update
   $ sudo apt install testdisk  # For Ubuntu/Debian systems

   Photorec is included in the testdisk package. Make sure it's installed on the live system before proceeding with file recovery.

3. Run photorec as root to start the recovery process.

   $ sudo photorec

   Running photorec with root privileges ensures that the tool can access all partitions and storage devices connected to the system.

4. Select the disk or partition to scan for deleted files.

     Please select a media (use Arrow keys, then press Enter):
     Disk /dev/sda - 500 GB / 465 GiB (RO) - WDC WD5000LPCX-24VHAT0
     Disk /dev/sdb - 32 GB / 29 GiB (RO) - USB Flash Drive

   Choose the disk or partition from which the files were deleted. Be cautious to select the correct drive to avoid scanning the wrong storage device.

5. Choose the type of file system for the selected partition.

     Please select the file system type:
     [ ext2/ext3/ext4 ]
     [ FAT/NTFS/exFAT ]

   Photorec will ask you to specify the file system type. If you're unsure, choose the default option that matches your device’s file system (e.g., ext4 for most Linux systems).

6. Select the directory where recovered files will be saved.

     Save recovered files to:
     /home/user/recovery/

   Ensure that the recovery directory is not on the same partition or disk where the files were deleted. This prevents overwriting recoverable data.

7. Start the scanning process to search for deleted files.

     Photorec is now analyzing the disk...

   The scanning process may take time, depending on the size of the disk and the number of files. You can monitor the progress as photorec runs.

8. Review and recover the files saved in the chosen directory.

   $ ls /home/user/recovery/
     file0001.jpg  file0002.doc  file0003.mp4

   Once the scan completes, recovered files will be stored in the specified directory. You can review the files and move or rename them as needed.

9. Organize and filter recovered files based on file types.

   $ mv *.jpg ~/Pictures/
   $ mv *.mp4 ~/Videos/

   Photorec recovers files based on their file signatures, so you may want to organize the recovered files by type (e.g., images, documents, videos) for easier sorting.