{"id":772,"date":"2014-11-27T20:13:29","date_gmt":"2014-11-27T20:13:29","guid":{"rendered":"https:\/\/stevepedwards.today\/DebianAdmin\/?p=772"},"modified":"2025-07-03T17:30:11","modified_gmt":"2025-07-03T16:30:11","slug":"file-recovery-with-testdisk-photorec","status":"publish","type":"post","link":"https:\/\/stevepedwards.today\/DebianAdmin\/file-recovery-with-testdisk-photorec\/","title":{"rendered":"File Recovery with TestDisk + Photorec"},"content":{"rendered":"
<\/div>\n

<\/path><\/svg><\/i> \"Loading\"<\/p>\n

<\/div>\n


\nExample using a phone SIM card. In Windows, a deleted file from such flash type media does not go into the Recycle Bin so is \"lost\" immediately no?\u00a0<\/span><\/span><\/p>\n

The card is \/dev\/sdf1 in this case.<\/p>\n

Let's look at it with some Linux tools...<\/p>\n

# cfdisk \/dev\/sdf<\/span>\u00a0<\/span><\/p>\n

cfdisk (util-linux-ng 2.13.1.1)\u00a0<\/span><\/p>\n

Disk Drive: \/dev\/sdf\u00a0<\/span><\/p>\n

Size: 249823232 bytes, 249 MB\u00a0<\/span><\/p>\n

Heads: 16 Sectors per Track: 32 Cylinders: 953\u00a0<\/span><\/p>\n

Name Flags Part Type FS Type [Label] Size (MB)\u00a0<\/span><\/p>\n

Pri\/Log Free Space 0.09 *\u00a0<\/span><\/p>\n

sdf1 Boot Primary FAT16 [ ] 249.48 *\u00a0<\/span><\/p>\n

Pri\/Log Free Space 0.27\u00a0<\/span><\/p>\n

So it is formatted with FAT16 file system.<\/p>\n

Lets look at the boot sector with fdisk...
\n
\n<\/span># fdisk \/dev\/sdf<\/span>\u00a0<\/span><\/p>\n

Command (m for help): m\u00a0<\/span><\/p>\n

Command action\u00a0<\/span><\/p>\n

a toggle a bootable flag\u00a0<\/span><\/p>\n

b edit bsd disklabel\u00a0<\/span><\/p>\n

c toggle the dos compatibility flag\u00a0<\/span><\/p>\n

d delete a partition\u00a0<\/span><\/p>\n

l list known partition types\u00a0<\/span><\/p>\n

m print this menu\u00a0<\/span><\/p>\n

n add a new partition\u00a0<\/span><\/p>\n

o create a new empty DOS partition table\u00a0<\/span><\/p>\n

p print the partition table\u00a0<\/span><\/p>\n

q quit without saving changes\u00a0<\/span><\/p>\n

s create a new empty Sun disklabel\u00a0<\/span><\/p>\n

t change a partition's system id\u00a0<\/span><\/p>\n

u change display\/entry units\u00a0<\/span><\/p>\n

v verify the partition table\u00a0<\/span><\/p>\n

w write table to disk and exit\u00a0<\/span><\/p>\n

x extra functionality (experts only)\u00a0<\/span><\/p>\n

Command (m for help):\u00a0<\/span>
\n
\nType p for partition info...\u00a0<\/span><\/p>\n

Disk \/dev\/sdf: 249 MB, 249823232 bytes\u00a0<\/span><\/p>\n

16 heads, 32 sectors\/track, 953 cylinders\u00a0<\/span><\/p>\n

Units = cylinders of 512 * 512 = 262144 bytes\u00a0<\/span><\/p>\n

Disk identifier: 0x00000000\u00a0<\/span><\/p>\n

Device Boot Start End Blocks Id System\u00a0<\/span><\/p>\n

\/dev\/sdf1 * 1 952 243630+ 6 FAT16\u00a0<\/span><\/p>\n

Command (m for help):\u00a0<\/span>
\n
\nNow type x, then d to show hex info:\u00a0<\/span><\/p>\n

The last 55 AA shows a FAT file system:<\/p>\n

0x1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
\n0x1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 05
\n0x1C0: 04 00 06 0F E0 B7 A3 00 00 00 5D 6F 07 00 00 00
\n0x1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
\n0x1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
\n0x1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 *55 AA*<\/strong><\/span>\u00a0<\/span><\/p>\n

Type Q to quit.<\/p>\n

Install TestDisk and DDrescue<\/p>\n

# apt-get install testdisk ddrescue<\/span>\u00a0<\/span><\/p>\n

I will zero the whole card so we know it is totally blank to start...<\/p>\n

#\u00a0dd_rescue \/dev\/zero \/dev\/sdf\u00a0<\/span><\/p>\n

dd_rescue \/dev\/zero \/dev\/sdf\u00a0<\/span><\/p>\n

dd_rescue: (info): ipos: 31744.0k, opos: 31744.0k, xferd: 31744.0k\u00a0<\/span><\/p>\n

errs: 0, errxfer: 0.0k, succxfer: 31744.0k\u00a0<\/span><\/p>\n

+curr.rate: 319778kB\/s, avg.rate: 319778kB\/s, avg.load: 80.6%<\/span>\u00a0<\/span><\/p>\n

Once you see repeated info, Ctrl C to Quit...<\/p>\n

dd_rescue: (warning): \/dev\/sdf1 (92920448.0k): No space left on device\u00a0<\/span><\/p>\n

dd_rescue: (warning): assumption rd(65536) == wr(^Cvice!\u00a0<\/span><\/p>\n

dd_rescue: (fatal): Caught signal 2 \"Interrupt\". Exiting!\u00a0<\/span><\/p>\n

Now the partition should be blank...check what cfdisk says...<\/p>\n

# cfdisk \/dev\/sdf<\/span>\u00a0<\/span><\/p>\n

cfdisk (util-linux-ng 2.13.1.1)\u00a0<\/span><\/p>\n

Disk Drive: \/dev\/sdf\u00a0<\/span><\/p>\n

Size: 249823232 bytes, 249 MB\u00a0<\/span><\/p>\n

Heads: 8 Sectors per Track: 60 Cylinders: 1016\u00a0<\/span><\/p>\n

Name Flags Part Type FS Type [Label] Size (MB)\u00a0<\/span><\/p>\n

---------\u00a0<\/span><\/p>\n

Pri\/Log Free Space 249.70\u00a0<\/span><\/p>\n

YEP! It is blank...<\/p>\n

OK, let's create a partition and give it FAT file system...<\/p>\n

# fdisk \/dev\/sdf<\/span>\u00a0<\/span><\/p>\n

n add a new partition\u00a0<\/span><\/p>\n

o create a new empty DOS partition table\u00a0<\/span><\/p>\n

p print the partition table\u00a0<\/span><\/p>\n

q quit without saving changes\u00a0<\/span><\/p>\n

s create a new empty Sun disklabel\u00a0<\/span><\/p>\n

t change a partition's system id\u00a0<\/span><\/p>\n

u change display\/entry units\u00a0<\/span><\/p>\n

v verify the partition table\u00a0<\/span><\/p>\n

w write table to disk and exit\u00a0<\/span><\/p>\n

x extra functionality (experts only)\u00a0<\/span><\/p>\n

Command (m for help): n\u00a0<\/span><\/p>\n

Command action\u00a0<\/span><\/p>\n

e extended\u00a0<\/span><\/p>\n

p primary partition (1-4)\u00a0<\/span><\/p>\n

Command action\u00a0<\/span><\/p>\n

e extended\u00a0<\/span><\/p>\n

p primary partition (1-4)\u00a0<\/span><\/p>\n

p\u00a0<\/span><\/p>\n

Partition number (1-4): 1<\/span>\u00a0<\/span><\/p>\n

First cylinder (1-1016, default 1):\u00a0<\/span><\/p>\n

Using default value 1\u00a0<\/span><\/p>\n

Last cylinder or +size or +sizeM or +sizeK (1-1016, default 1016):\u00a0<\/span><\/p>\n

Using default value 1016\u00a0<\/span><\/p>\n

Command (m for help):<\/span>
\n<\/span>p<\/span>\u00a0<\/span><\/p>\n

Disk \/dev\/sdf: 249 MB, 249823232 bytes\u00a0<\/span><\/p>\n

8 heads, 60 sectors\/track, 1016 cylinders\u00a0<\/span><\/p>\n

Units = cylinders of 480 * 512 = 245760 bytes\u00a0<\/span><\/p>\n

Disk identifier: 0x1d3b765e\u00a0<\/span><\/p>\n

Device Boot Start End Blocks Id System\u00a0<\/span><\/p>\n

\/dev\/sdf1 1 1016 243810 83 Linux\u00a0<\/span><\/p>\n

# mkfs.vfat \/dev\/sdf1\u00a0<\/span><\/p>\n

mkfs.vfat 3.0.1 (23 Nov 2008)\u00a0<\/span><\/p>\n

Looking at the card with Hexedit...<\/p>\n

# apt-get install hexedit\u00a0<\/span><\/p>\n

# hexedit \/dev\/sdf1\u00a0<\/span><\/p>\n

00000000 EB 3C 90 6D 6B 64 6F 73 66 73 00 00 02 08 01 00 .<.mkdosfs......
\n00000010 02 00 02 00 00 F8 EE 00 20 00 10 00 00 00 00 00 ........ .......
\n00000020 5C 6F 07 00 00 00 29 D8 29 DF AF 20 20 20 20 20 \\o....).)..
\n00000030 20 20 20 20 20 20 46 41 54 31 36 20 20 20 0E 1F FAT16 ..
\n00000040 BE 5B 7C AC 22 C0 74 0B 56 B4 0E BB 07 00 CD 10 .[|.\".t.V.......
\n00000050 5E EB F0 32 E4 CD 16 CD 19 EB FE 54 68 69 73 20 ^..2.......This
\n00000060 69 73 20 6E 6F 74 20 61 20 62 6F 6F 74 61 62 6C is not a bootabl
\n00000070 65 20 64 69 73 6B 2E 20 20 50 6C 65 61 73 65 20 e disk. Please
\n00000080 69 6E 73 65 72 74 20 61 20 62 6F 6F 74 61 62 6C insert a bootabl
\n00000090 65 20 66 6C 6F 70 70 79 20 61 6E 64 0D 0A 70 72 e floppy and..pr
\n000000A0 65 73 73 20 61 6E 79 20 6B 65 79 20 74 6F 20 74 ess any key to t
\n000000B0 72 79 20 61 67 61 69 6E 20 2E 2E 2E 20 0D 0A 00 ry again ... ...
\n000000C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................<\/span>\u00a0<\/span><\/p>\n

CtrlC to quit prog...<\/p>\n

Mount the card in a test directory and put some test files on it....<\/p>\n

# mount \/dev\/sdf1 \/mstest<\/span>
\n<\/span><\/p>\n

I have already used these cmds so can call the cmd history to save re-typing them...<\/span><\/span><\/p>\n

# history | grep cp<\/span>\u00a0<\/span><\/p>\n

581 cp -vr\u00a0\/College\/ReportWriting\/front\\ cover.doc \/mstest\/<\/em>\u00a0<\/span><\/p>\n

582 cp -vr\u00a0\/College\/ReportWriting\/ReportTemplate.doc \/mstest\/<\/em>\u00a0<\/span><\/p>\n

# !581; !582<\/span>\u00a0<\/span><\/p>\n

cp -vr\u00a0\/College\/ReportWriting\/front\\ cover.doc \/mstest\/<\/em>; cp -vr\u00a0\/College\/ReportWriting\/ReportTemplate.doc \/mstest\/<\/em>\u00a0<\/span><\/p>\n

`\/College\/ReportWriting\/front cover.doc' -> `\/mstest\/front cover.doc'\u00a0<\/span><\/p>\n

`\/College\/ReportWriting\/ReportTemplate.doc' -> `\/mstest\/ReportTemplate.doc'\u00a0<\/span><\/p>\n

# ls \/mstest\u00a0<\/span><\/p>\n

front cover.doc ReportTemplate.doc\u00a0<\/span><\/p>\n

To see if file recovered is identical...<\/p>\n

# shasum\u00a0\/mstest\/<\/em>* > \/mstest\/hashes.txt\u00a0<\/span><\/p>\n

# ls\u00a0\/mstest\/<\/em>\u00a0<\/span>
\n
\n<\/span>front cover.doc hashes.txt ReportTemplate.doc\u00a0<\/span><\/p>\n

# cat \/mstest\/hashes.txt\u00a0<\/span><\/p>\n

3846af692dfbdee3dbc88f7a6b78c6d79cde07c7 \/mstest\/front cover.doc\u00a0<\/span><\/p>\n

5ccd582e7ec047b0f79aa7efc864dc09b4a31089 \/mstest\/ReportTemplate.doc\u00a0<\/span><\/p>\n

Now to \"accidently\" delete a file...<\/p>\n

# rm -v \/mstest\/front\\ cover.doc\u00a0<\/span><\/p>\n

removed `\/mstest\/front cover.doc'<\/span>
\n<\/span># ls\u00a0\/mstest\/<\/em><\/span>
\n<\/span><\/p>\n

hashes.txt ReportTemplate.doc\u00a0<\/span>
\n<\/span><\/span><\/p>\n

Now, front\\ cover.doc\u00a0is missing.
\n<\/span><\/p>\n

Now to recover the lost file using TestDisk....
\n<\/span><\/p>\n

NOTE! Choose the whole disk NOT the partition...\u00a0<\/span><\/p>\n

Unmount the card first else TD won't find the partition!!!\u00a0<\/span><\/p>\n

# umount \/mstest\u00a0<\/span><\/p>\n

# testdisk \/dev\/sdf\u00a0<\/span><\/p>\n

TestDisk 6.11, Data Recovery Utility, April 2009\u00a0<\/span><\/p>\n

Christophe GRENIER<\/span>\u00a0<\/span><grenier@cgsecurity.org><\/span>\u00a0<\/span><\/p>\n

https:\/\/www.cgsecurity.org<\/span><\/a>\u00a0<\/span><\/p>\n

TestDisk is free software, and\u00a0<\/span><\/p>\n

comes with ABSOLUTELY NO WARRANTY.\u00a0<\/span><\/p>\n

Select a media (use Arrow keys, then press Enter):\u00a0<\/span><\/p>\n

*Disk \/dev\/sdf - 249 MB \/ 238 MiB - Generic USB MS Reader*<\/strong>\u00a0<\/span><\/p>\n

[Proceed ]<\/strong>\u00a0[ Quit ]\u00a0<\/span>
\n
\nDisk \/dev\/sdf - 249 MB \/ 238 MiB - CHS 1016 8 60\u00a0<\/span><\/p>\n

Partition Start End Size in sectors\u00a0<\/span><\/p>\n

*1 P FAT16 >32M 0 1 1 1015 7 60 487620*<\/strong>\u00a0<\/span><\/p>\n

[ Type ] [ Boot ] [Image Creation]\u00a0*[Undelete] *<\/strong>\u00a0[ Quit ]\u00a0<\/span><\/p>\n

*1 P FAT16 >32M 0 1 1 1015 7 60 487620*<\/span>\u00a0<\/span><\/p>\n

Directory \/\u00a0<\/span><\/p>\n

*-rwxr-xr-x 0 0 19456 14-May-2012 00:23 front cover.doc*\u00a0<\/span><\/p>\n

-rwxr-xr-x 0 0 36352 14-May-2012 00:23 ReportTemplate.doc<\/span>\u00a0<\/span>
\n<\/span>-rwxr-xr-x 0 0 135 14-May-2012 00:24 hashes.txt\u00a0<\/span><\/p>\n

Use Right arrow to change directory, *c *to copy,\u00a0h to hide deleted files, q to quit\u00a0<\/span><\/p>\n

Are you sure you want to copy\u00a0\/front cover.doc to the directory \/ ? [Y\/<\/strong><\/em>*N<\/strong>]*\u00a0<\/span><\/p>\n

To select another directory, use the arrow keys.<\/p>\n

drwxr-xr-x 0 0 4096 14-May-2012 00:19 .\u00a0<\/span><\/p>\n

drwxr-xr-x 0 0 4096 14-May-2012 00:19 ..\u00a0<\/span><\/p>\n

drwx------ 1000 0 4096 26-Jun-2010 14:39 College\u00a0<\/span><\/p>\n

drwxr-xr-x 0 0 4096 5-Oct-2009 20:41 Files\u00a0<\/span><\/p>\n

drwxr-xr-x 0 0 4096 13-May-2012 19:31 bin\u00a0<\/span><\/p>\n

drwxr-xr-x 0 0 4096 7-May-2012 13:29 black......\u00a0<\/span><\/p>\n

*drwxrwxrwt 0 0 4096 14-May-2012 00:02 tmp*<\/strong>\u00a0<\/span><\/p>\n

drwxr-xr-x 0 0 4096 30-Aug-2008 16:37 usr\u00a0<\/span><\/p>\n

drwxr-xr-x 0 0 4096 20-Feb-2010 22:50 var\u00a0<\/span><\/p>\n

Are you sure you want to copy \/front cover.doc to the directory \/tmp ?\u00a0[*Y*\/<\/strong>N]<\/span>\u00a0
\n<\/span>
\n1 P FAT16 >32M 0 1 1 1015 7 60 487620\u00a0<\/span><\/p>\n

Directory \/\u00a0<\/span><\/p>\n

*Copy done!*<\/strong>\u00a0<\/span><\/p>\n

-rwxr-xr-x 0 0 *19456* 14-May-2012 00:23 front cover.doc\u00a0<\/span><\/p>\n

-rwxr-xr-x 0 0 36352 14-May-2012 00:23 ReportTemplate.doc\u00a0<\/span><\/p>\n

-rwxr-xr-x 0 0 135 14-May-2012 00:24 hashes.txt\u00a0<\/span><\/p>\n

Now check the recovered file size and checksum in the \/tmp directory...<\/p>\n

# ls -ls \/tmp\/front\\ cover.doc<\/span>\u00a0<\/span><\/p>\n

20 -rw-r--r-- 1 root root *19456*<\/strong> 2012-05-14 00:23 \/tmp\/front cover.doc<\/span>\u00a0<\/span><\/p>\n

# shasum \/tmp\/front\\ cover.doc<\/span>\u00a0<\/span><\/p>\n

3846af692dfbdee3dbc88f7a6b78c6d79cde07c7<\/strong>\u00a0\/tmp\/front cover.doc<\/span>\u00a0<\/span><\/span><\/p>\n

From earlier dir...\u00a0<\/span><\/p>\n

3846af692dfbdee3dbc88f7a6b78c6d79cde07c7<\/strong>\u00a0\/mstest\/front cover.doc\u00a0<\/span><\/p>\n

As the checksum is the same, the file size has to be the same by definition!\u00a0<\/span><\/p>\n

Cool huh?<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/div>\n

<\/path><\/svg><\/i> \"Loading\"<\/p>\n

<\/div>\n

Example using a phone SIM card. In Windows, a deleted file from such flash type media does not go into the Recycle Bin so is \"lost\" immediately no?\u00a0 The card is \/dev\/sdf1 in this case. Let's look at it with some Linux tools... # cfdisk \/dev\/sdf\u00a0 cfdisk (util-linux-ng 2.13.1.1)\u00a0 Disk Drive: \/dev\/sdf\u00a0 Size: 249823232 bytes, ...\u00a0 File Recovery with TestDisk + Photorec<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-772","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"a3_pvc":{"activated":true,"total_views":1,"today_views":0},"_links":{"self":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts\/772","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/comments?post=772"}],"version-history":[{"count":1,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts\/772\/revisions"}],"predecessor-version":[{"id":10564,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts\/772\/revisions\/10564"}],"wp:attachment":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/media?parent=772"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/categories?post=772"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/tags?post=772"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}