Recover deleted files with photorec
Posted on 31 Oct, 2007, categorized under Information Insemination
I was just watching a movie while suddenly all the files except the hidden ones in my home directory were gone, just as someone issued the command
sudo rm -rf /home/shakir/*
To avoid further data loss, I quickly power off and boot into my Ubuntu live CD to create an image of my /home partition. Here’s how to see in which partition is my /home directory:
shakir@herugrim ~ $ cat /proc/partitions major minor #blocks name 8 0 156290904 sda 8 1 21494938 sda1 8 2 8795587 sda2 8 3 2939895 sda3 8 4 1 sda4 8 5 9775521 sda5 8 6 113282316 sda6
From the partition sizes I can tell my /home partition was in the /dev/sda6, and the next step is to really create an image of the partition to safely doing the recovery process without risking of losing more data. /media/usbdisk is where my external usb harddisk is mounted
sudo dd if=/dev/sda6 of=/media/usbdisk/herugrim-sda6-20071010.img
Photorec is part of testdisk package, and this is how to install it in ubuntu;
sudo apt-get update sudo apt-get install testdisk
It’s time to actually do run the program
sudo photorec /home/shakir/temp/herugrim-sda6-20071010.img
After going through some options, photorec starts doing it’s job.
Photorec stores recovered files in recup_dir.<sequence>/<sequence>.<file extension> in the specified target directory, which is not very useful. Here’s a script I wrote to find all the recovered JPEG files and move/rename it accordingly. Almost the same technique can be used for other file formats.
#!/bin/bash
PHOTODIR=/home/shakir/temp/photorec
cd $PHOTODIR
mkdir JPEG
for i in `ls | grep recup`;do
for j in `ls $i/*.jpg`; do
if FILE=`exiv2 $j 2>/dev/null | grep timestamp | awk ‘{ print $4"-"$5 }’ | tr -d ‘:’ | grep 200`; then
cp -v $j "JPEG/"$FILE".jpg"
fi
done
done
