homepage/content/post/restore-lost-data-with-photorec.md

date	title	author	tag
2014-12-15T00:00:00+01:00	Restore lost data with Photorec	jochum	howto photorec lost data

A friend of mine lost his NTFS Partition (think it was a power outage). As he has some data on it he needs, i tought about restoring it.

Helpful Links:

• Authors Step-by-Step Guide
• German Ubuntu wiki article on Data Recovery

This is what i came out with:

1. Downloaded TestDisk (with Photorec)
2. Extracted it.
3. Make a store directory on the other disk: $ mkdir /media/<username>/<my_usb_disk>/<friends_name>
4. run it as root: sudo photorec_static /media/<username>/<friends_disk>/the_dd_image_we_made_before.img
5. I set it "whole" and "NTFS", after about 18 Hours it was over that 300GB.

To split the files up in one directory per extension:

cd /media/<username>/<my_usb_disk>;

# Create a list of Extensions found: http://stackoverflow.com/questions/1842254
find <friends_name>/ -type f | perl -ne 'print $1 if m/\.([^.\/]+)$/' | sort -u > found_extensions.txt

#
# You might want to edit the "found_extensions.txt" file you just generated,
# - filter out crap
# - remove duplicated extensions, the script below is case insensetive
#

# Create the directory where we copy these files in one folder per extension.
mkdir <friends_name>_extensions/
cd <friends_name>_extensions/

# Now mkdir one directory per extension and copy of all files of this extension into it.

#!/bin/sh
for i in $(cat ../found_extensions.txt); do
    count=$(find ../<friends_name>/ -type f -iname "*.$i" | wc -l)
    echo "Copying \"$count\" files for extension: $i..."
    mkdir -p $i
    for src in $(find ../<friends_name>/ -type f -iname "*.$i"); do
        dest=$i/$(basename $src)
        if [ ! -f "$dest" ]; then
            echo "Copying \"$src\" to \"$dest\""
            cp $src $dest # Use mv here instead of cp if you known what you do.
        elif ! $(cmp -s $src $dest); then
            echo "Overwriting \"$dest\" with \"$src\""
            cp $src $dest
        fi
    done
done