PhotoRec - Tool to recover lost data

PhotoRec ignores the underlying file system and data tracking, so it will still work even if the file system on your media has been severely damaged or reformatted.

This free, open-source, cross-platform PhotoRec application is distributed under the GNU General Public License (GPLV v2+). PhotoRec is a companion program to TestDisk, an application to recover lost partitions on multiple file systems and make non-bootable drives bootable again.

For extra safety, PhotoRec uses read-only access to handle the drive or memory card from which you are about to recover lost data.

Important Note: As soon as a photo or file is accidentally deleted, or you discover any missing photos or files, DO NOT save any more photos or files to that memory device or hard drive; otherwise you can overwrite your lost data. This means that while using PhotoRec, you cannot choose to write the recovered files to the same partition where they were stored.

Supported operating systems

PhotoRec - Tool to recover lost data Picture 1

PhotoRec can run on:

1. DOS/Windows 9x
2. Windows 10/8.1/8/7/Vista/XP, Windows Server 2016/2012/2008/2003
3. Linux
4. FreeBSD, NetBSD, OpenBSD
5. Sun Solaris
6. Mac OS X
7. And can be compiled on almost any Unix system.

File system

PhotoRec ignores the file system; in this way, it can work even if the file system is severely damaged. PhotoRec can recover lost files from as little as possible

1. FAT
2. NTFS
3. exFAT
4. file system ext2/ext3/ext4
5. HFS+

Supported devices

PhotoRec works with hard drives, CD-ROMs, memory cards (CompactFlash, Memory Stick, Secure Digital/SD, SmartMedia, Microdrive, MMC, etc.), USB, DD raw images, EnCase E01 images, etc.

PhotoRec has been successfully tested with various portable music players including iPod and the following digital cameras:

1. Canon EOS 10D, 60D, 80D, 300D
2. Casio Exilim EX-Z 750
3. Fujifilm X-T10
4. HP PhotoSmart 620, 850, 935
5. Nikon CoolPix 775, 950, 5700
6. Olympus C350N, C860L, Mju 400 Digital, Stylus 300
7. Sony Alpha DSLR, DSC-P9, NEX-6
8. Pentax K20D
9. Praktica DCZ-3.4

Known file formats

PhotoRec searches for known file headers. If there is no common data fragmentation, it can recover the entire file. PhotoRec recognizes and recovers many file formats including ZIP, Office, PDF, HTML, JPEG and various graphic file formats. The entire list of file formats recovered by PhotoRec contains more than 480 file extensions (about 300 file families).

Want to know if PhotoRec can recover your files? Upload sample files via PhotoRec online tester (BETA).

How PhotoRec . Works

PhotoRec - Tool to recover lost data Picture 2

The FAT, NTFS, ext2/ext3/ext4 file systems store files in data blocks (also known as clusters in Windows). The cluster or block size remains at a constant amount after being initialized during file system formatting. In general, most operating systems try to store data in a contiguous manner to minimize data fragmentation. A mechanical drive's seek time is critical to writing and reading data to/from the hard drive, so that's why it's important to keep fragmentation to a minimum.

When a file is deleted, metadata about this file (filename, date/time, size, location of the first data block/cluster, etc.) is lost. For example, in the ext3/ext4 file system, the names of the deleted files remain, but the location of the first data block is deleted. This means that the data is still present on the file system, but only until some or all of the data is overwritten by the new file data.

To recover these lost files, PhotoRec first tries to find the block (or cluster) size of the data. If the file system is not corrupted, this value can be read from the superblock - superblock - (ext2/ext3/ext4) or the volume boot record (FAT, NTFS). On the other hand, PhotoRec reads the media in chunks, searches for the first 10 files, from which it calculates the block/cluster size of their locations. When this block size is known, PhotoRec will read the media block in chunks (or bursts). Each block is checked against the signature database that comes with the program and has evolved in terms of file types it can recover since the first version of PhotoRec was released.

For example, PhotoRec identifies a JPEG file when a block begins with:

1. 0xff, 0xd8, 0xff, 0xe0
2. 0xff, 0xd8, 0xff, 0xe1
3. or 0xff, 0xd8, 0xff, 0xfe

If PhotoRec has already started file recovery, it will stop the restore process, check file consistency when possible, and start saving a new file (determined from the signature it finds).

If the data is not fragmented, the recovered file must be the same or larger than the original file size. In some cases, PhotoRec can learn the original file size from the file header, so the recovered file will be truncated to the correct size. However, if the final restored file is smaller than the header it specifies, it will be discarded. Some files, such as the .MP3 type, are data streams. In this case, PhotoRec parses the recovered data, then stops the recovery when the stream ends.

When a file is successfully restored, PhotoRec checks previous blocks of data to see if a file signature was found, but failed to recover the file successfully (i.e. the file is too small) and it tries again. In this way, some fragmented files can be recovered successfully.

Isabella Humphrey

Update 11 July 2022