PhotoRec - Recover deleted files
Introduction
A tool that I prefer to recover deleted files or to analyze a memory in search of evidence is Photorec by CGSecurity.
As explained on the program website:
PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media’s file system has been severely damaged or reformatted. PhotoRec is a companion program to TestDisk, an application for recovering lost partitions on a wide variety of file systems and making non-bootable disks bootable again. For lost/deleted partitions or deleted files from a FAT or NTFS file system, try TestDisk first - it’s usually faster and TestDisk can retrieved the original file names.
For more information about the supported file types and how PhotoRec works you can consult the relevant paragraphs on the main page of the website:
https://www.cgsecurity.org/wiki/PhotoRec
See: Known file formats and How PhotoRec works.
There is also an excellent manual about data recovery using TestDisk & PhotoRec and other tools.
PhotoRec can also be used to recover data from an iPhone :) (Jailbroken).
Download
The program is available for different platforms, in GNU/Linux distros it can generally be installed through the preferred package manager, for example on Kali Linux I installed the package testdisk, while on Windows you can install and run the executable, also TestDisk and PhotoRec can be run as portable executables or from LiveCD.
For more information about program installation and running, consult the related page: TestDisk Download
How to
Now that we are familiar with this program, let’s see how to use it to recover files, for this demonstration I used a USB flash drive as the target memory. The program offers an interactive shell that is very easy to use, the steps necessary for the procedure are well explained on the website: PhotoRec Step by Step
Note: The following steps are a demonstration of how PhotoRec works and therefore do not belong to a proper forensic analysis procedure.
In this demonstration I will delete the files present and then format the USB flash drive with the FAT32 filesystem, after which I will scan the memory for deleted files.
Memory content
1 - Exploring the memory with a file manager we can see that inside there are some files of different formats:
2 - I delete the files as we normally do, for example with the command rm on Linux:
3 - Now the flash drive is “empty”:
4 - After formatting the flash drive, I check the filesystem:
Analysis and recovery
1 - Start PhotoRec with the /log parameter to record the details of the procedure to a log file called photorec.log:
sudo photorec /log
2 - Select the disk to analyze, in my case it’s /dev/sda:
3 - Select the partition, for this device, it’s the FAT32 partition labeled with the “P” letter:
4 - Select the correct filesystem for the partition, generally PhotoRec recognizes the filesystem by itself, Unless it is an ext2/ext3/ext4 filesystem, choose Other:
5 - Select the space where the files will be searched, if the option for unallocated space is selected, deleted files will be recovered:
6 - Select where the recovered files will be written, in this case I have created a folder to work in, you can use an external disk for this purpose (the correct method). Moving with the arrows, go to the favorite folder and press c to confirm:
7 - The program starts searching for files showing the progress:
8 - Recovered files are saved to folders called recup.dir:
Working with recovered files
1 - Previously deleted files have been recovered, named with the prefix “f” plus an identifying number, some also have the original name after the number:
2 - On the program’s website there is an excellent guide on how to work with recovered files: After Using PhotoRec
In this case, I sort the files by extension with the python script shown in the guide:
You need to create the folder in which to copy the sorted files and run the script with the “source” and “destination” parameters:
A more advanced script is available that gives you more options on file sorting: sort-PhotorecRecoveredFiles
3 - The script creates a folder for each type of file:
Some tips
-
If you are looking for a specific file you can check the date/time attribute, PhotoRec uses time information (metadata) when available in the file header to set the file modification time:
-
With .JPEG files you can use exiftool to view the image metadata for additional information about the file:
-
Thumbnails of the images found are saved as “t*.jpg”
-
If you have chosen to keep corrupted files/file fragments, their filenames will beginning by the letter “b” (broken).
by Brainfuck
Credits: PhotoRec