PhotoRec Passo Dopo Passo

From CGSecurity

Jump to: navigation, search

en.png english version de.png deutsche Version fr.png version française ru.png Русская версия


Questo Esempio di recupero ti guida attraverso PhotoRec passo dopo passo per recuperare file cancellati o dati persi dovuti a una partizione formattata o a un filesystem corrotto. Translation of this PhotoRec manual to other languages are welcome.

Contents

Avvia l'eseguibile PhotoRec

Se PhotoRec non è ancora installato, può essere scaricato da TestDisk Download. Estrai i file dall'archivio includendo le sottocartelle.

Per recuperare dei file dall'hard disk, chiavetta USB, Smart Card, cd-rom, dvd..., devi possedere sufficienti diritti d'accesso al dispositivo fisico.

  • dos.png In ambiente Dos, esegui photorec.exe
  • win.png In ambiente Windows, esegui PhotoRec (ad esempio testdisk-6.9/win/photorec_win.exe) da un account del Gruppo Admministratori. In ambiente Vista, clicca col tasto destro del mouse "esegui come amministratore" per lanciare PhotoRec.
  • linux.png In ambiente Unix/Linux/BSD, devi essere utente root per eseguire PhotoRec (ad es. sudo testdisk-6.9/linux/photorec_static)
  • macosx.png In ambiente MacOSX, esegui PhotoRec (ad es. testdisk-6.9/darwin/photorec). se non sei root, PhotoRec si riavvierà automaticamenteusando sudo dopo la conferma da parte dell'utente.
  • os2.png In ambiente OS/2, PhotoRec non gestisce dispositivi fisici, ma solo immagini disco, ci spiace.

Per recuperare i file da dall'immagine di un dispositivo, esegui

  • photorec image.dd per ritagliare un'immagine raw di un disco
  • photorec image.E01 per recuperare file da un'immagine Encase EWF
  • photorec 'image.E*' se l'immagine Encase è divisa in vari file.
  • photorec '/cygdrive/d/evidence/image.E*' se l'immagine Encase è divisa in vari file nella cartella d:\evidence

linux.png macosx.png Per recuperare file da altri dispositivi, esegui photorec device, per esempio.

  • photorec /dev/mapper/truecrypt0 per recuperare i file da una partizione TrueCrypt. Lo stesso metodo funziona con filesystem codificati con cryptsetup/dm-crypt/LUKS.
  • photorec /dev/md0 per recuperare file da un dispositivo Raid software Linux.

Utilizzatori scrupolosi possono usare il parametro /log per creare un file file di log chiamato photorec.log; registra l'ubicazione dei file recuperati da PhotoRec.

Disk selection

Image:PhotoRec_startup.png

Available media are listed. Use up/down arrow keys to select the disk that holds the lost files. Press Enter to proceed.

Partition table type selection

Image:PhotoRec_part_type.png

Select the partition table type, usually the default value is the correct one as PhotoRec auto-detects the partition table type.

Source partition selection

Image:PhotoRec_src.png

Choose

  • Search after selecting the partition that holds the lost files to start the recovery,
  • Options to modify the options,
  • File Opt to modify the list of file types recovered by PhotoRec.

PhotoRec options

Image:PhotoRec_options.png
  • Paranoid By default, recovered files are verified and invalid files rejected.

Enable bruteforce if you want to recover more fragmented JPEG files, note it's a very CPU intensive operation.

  • Allow partial last cylinder modifies how the disk geometry is determined, only non-partitioned media should be affected.
  • The expert mode option allows the user to force the filesystem blocksize and the offset.
  • Enable Keep corrupted files to keep files even if they are invalid in the hope that data may still be salvaged from an invalid file using other tools.
  • Enable Low memory if your system doesn't have enough memory and crashes during recovery. It may be needed for large filesystems heavily fragmented. Don't use this option unless absolutely necessary.

Selection of files to recover

Image:PhotoRec_files.png

Enable or disable the recovery of certain file types, e.g.

[X] tif  Tag Image File Format and some raw file formats (pef/nef/dcr/sr2/cr2)
...
[X] zip  zip archive including OpenOffice and MSOffice 2007

The whole list of file formats recovered by PhotoRec contains more than 100 file families representing more than 180 file extensions.

Filesystem type

Image:PhotoRec_filesystem.png

Once a partition has been selected, PhotoRec needs to know how the data blocks are allocated. Unless it's ext2/ext3 filesystem, choose Other.

Carve the partition or unallocated space only

Image:PhotoRec_free.png

PhotoRec can search files from

  • from the whole partition (useful if the partition is badly corrupted) or
  • from the unallocated space only (Available for ext2/ext3, FAT12/FAT6/FAT32 and NTFS). With this option only deleted files are recovered.

Select where recovered files should be written

Image:PhotoRec_dst.png

Choose the directory where the recovered files should be written.

  • dos.png win.png os2.png Select .. several times to get the drive list (C:, D:, E:...)
  • linux.png Filesystem from external disk may be available in a /media or /mnt sub-directory.
  • macosx.png Partitions from external disk are usually mounted in /Volumes.

Recovery in progress

Image:PhotoRec_running.png

Number of recovered files is updated in real time.

  • During pass 0, PhotoRec searches the first 10 files to determine the blocksize.
  • During pass 1 and later, files are recovered including some fragmented files.

Recovered files are written in recup_dir.1, recup_dir.2... sub-directories. It's possible to access the files even if the recovery is not finished.

Recovery is completed

Image:PhotoRec_end.png

When the recovery is complete, a summary is displayed. Note that if you interrupt the recovery, the next time PhotoRec is restarted you will be asked to resume the recovery.

Data Recovery