Monday, January 31, 2011

Recover Deleted Data using Photorec in Ubuntu

Photorec is a free data recovery software distributed under GNU/GPL which can recover lost files of nearly all types including the most common files such as text, pictures, videos, documents, archives etc. It is a companion program of testdisk which is even able to recover lost or un-bootable partitions.

Whenever you delete  a file accidently and plan to recover it, don't write any data to that partition until you get your lost files back or you may overwrite the sectors with your old file with the new ones and then, you won't be able to do any recovery.

This also applies when you are recovering files. You need to use another partition for saving your recovered files and not the same partition from where they are being recovered.

Installation

If possible, boot an Ubuntu Live CD or Live USB and carry on the operation in Live environment. If not possible, you can do it from Ubuntu booted from your hard drive as well.

You need to install the parent package i.e, testdisk for using photorec. It is in the universe repositories. Make sure universe repositories are enabled by going to Software Center > Edit > Software Sources.

Follow this command for installing test disk.

sudo apt-get update && sudo apt-get install testdisk

Recovery

Photorec is a command line software. To start photorec, type in Terminal,

sudo photorec

You need to run photorec with root privileges or it may not perform as expected.

Once it starts, you'll see a screen similar to this where you'll choose your HDD.

Photorec, Source Selection

Choose the HDD which contains partition from which you want to recover lost files and hit <Enter>.

Tip: You'll use up/down arrow keys to toggle disks and right/let arrow keys to toggle options (Proceed, Quit in above picture).

On the next screen, it would give you some information about your HDD size, heads and sectors.

Photorec, Device Information

The only thing you need to check on the information page is that it is reporting your HDDs size correctly or not. If the size is not being read correctly, the recovery might not be successful. In that case, check your Jumper Settings on the HDD or switch cables and reboot.

If the size is ok, hit Continue.

Photorec, Partition Type

On the next page, you need to select your partition table type. For a PC, it would be Intel in most cases. There are some other options as well for Macs and Sun partition types etc. Highlight Intel and hit <Enter>.

Photorec, Choose Partition


On the next screen, you'll need to choose your source partition from which the files will be recovered. Choose your partition and hit <Enter>.

Photorec, Filesystem Selection

Here you need to choose your source partition's filesystem. For a Linux system it is ext2/ext3 (this option includes ext4 as well) in most cases which is auto detected by photorec. Just hit <Enter>.

Photorec Options

Now you'll get an option to whether scan only the Free sectors on that partition or the Whole partition including those sectors which currently have data on them. Choose Free at first. If you can't find files you were looking for, start over and choose Whole. Scanning the Whole partition will take a lot more time than scanning the Free sectors.


Photorec, Destination Selection

Now you need to choose a location for your recovered files where they will be stored. Remember, it shouldn't be on the same partition from where the files are being recovered.

Tip: To go to a top level directory, navigate to '..' and hit <Enter> e.g, if you want to save your files to another partition, hit '..' twice and then go to Media directory where your mounted partitions will be listed.

When you are ready, press 'y' and it would start searching for recoverable files. All the recovered files will be copied to your selected directory.

If you run out of space during the process, you'll get an option to choose another directory for storage.

Enjoy!

Related Posts:

File System