Recover deleted files with photorec

I was just watching a movie while suddenly all the files except the hidden ones in my home directory were gone, just as someone issued the command

sudo rm -rf /home/shakir/*

To avoid further data loss, I quickly power off and boot into my Ubuntu live CD to create an image of my /home partition. Here’s how to see in which partition is my /home directory:

shakir@herugrim ~ $ cat /proc/partitions
major minor  #blocks  name
8     0  156290904 sda
8     1   21494938 sda1
8     2    8795587 sda2
8     3    2939895 sda3
8     4          1 sda4
8     5    9775521 sda5
8     6  113282316 sda6

From the partition sizes I can tell my /home partition was in the /dev/sda6, and the next step is to really create an image of the partition to safely doing the recovery process without risking of losing more data. /media/usbdisk is where my external usb harddisk is mounted

sudo dd if=/dev/sda6 of=/media/usbdisk/herugrim-sda6-20071010.img

Photorec is part of testdisk package, and this is how to install it in ubuntu;

sudo apt-get update
sudo apt-get install testdisk

It’s time to actually do run the program

sudo photorec /home/shakir/temp/herugrim-sda6-20071010.img

After going through some options, photorec starts doing it’s job.

Photorec stores recovered files in recup_dir.<sequence>/<sequence>.<file extension> in the specified target directory, which is not very useful. Here’s a script I wrote to find all the recovered JPEG files and move/rename it accordingly. Almost the same technique can be used for other file formats.

#!/bin/bash
PHOTODIR=/home/shakir/temp/photorec
cd $PHOTODIR
mkdir JPEG
for i in `ls | grep recup`;do
	for j in `ls $i/*.jpg`; do
		if FILE=`exiv2 $j 2>/dev/null | grep timestamp | awk ‘{ print $4"-"$5 }’ | tr -d ‘:’ | grep 200`; then
			cp -v $j "JPEG/"$FILE".jpg"
		fi
	done
done

Tags: bash, linux, script

This entry was posted on Wednesday, October 31st, 2007 at 12:28 pm and is filed under Information Insemination. You can follow any comments to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.