Anybody got tips for making custom signatures work? I'm trying to rescue Unreal Engine game save files off an EXT4 drive where the containing directory was deleted. I put the `sav 0 "GVAS"` (GVAS is the UE save magic value) in my `.photorec.sig`. `fidentify` correctly works on reference UE saves I have. Grepping the raw partition device finds many hits for GVAS, but photorec runs and doesn't recover any files...
I love photorec and dd rescue. I have recovered many many disks and memory cards with it.
I even recovered a card that had been off to professional recovery and deemed unrecoverable. I think half the memory chips in the card were fried so I used DD rescue to recover what data I could and then photorec to sift the wreckage. The owner was delighted to receive some of the photos.
If you ever have to do this, use DD rescue to image the source media as a first step. Sometimes you don't get a second read!
You say it. A few years ago my homeserver behalved odd and i needed reboots. I took out the SSD, used dd-rescue and after that The SSD did not even show up as storage any more. Yhea. I also have backups since then. :)
PhotoRec has saved me many times. But I have noticed that the results aren’t nearly as good for Mac file formats or video, especially professional video formats. A lot of videos I’ve tried to recover have failed. I wish that there was an app like this for those formats, but I understand that may be more of a niche market for them.
My folks gave me a big box of hard drives from various family computers over the years. Learning to use ddrescue and photorec to get data off of them was a ton of fun. Really cool tools, and not wildly unfriendly to someone who’d never used them before. I even managed to recover the drive that crashed a few days before the start of my junior year of high school, leaving me to re-write all of my summer homework in a panic. A little late on that one.
When discarding storage, I do a random pass (even if the drive has always been part of an encrypted-at-rest arrangement, if only for the sake of habit), then a zero sweep, then it gets a filesystem created and filled with many copies of a few cat photos/videos¹² to give anyone running something like photorec a treat, then the partition table is emptied.
--------
[1] With filenames to suggest a bumper collection of photo/video backups from several people's phones/cameras, with some porn accidentally mixed in.
[2] If I'm in an evil mood the “treat” filesystem is filled with shock images and Rick Astley instead.
Photorec is great and has improved over the years; it did way better in 2010s than it had done in the early 2000s. (I have a dd image of a corrupt disk of baby photos.)
Anybody got tips for making custom signatures work? I'm trying to rescue Unreal Engine game save files off an EXT4 drive where the containing directory was deleted. I put the `sav 0 "GVAS"` (GVAS is the UE save magic value) in my `.photorec.sig`. `fidentify` correctly works on reference UE saves I have. Grepping the raw partition device finds many hits for GVAS, but photorec runs and doesn't recover any files...
[1] https://www.cgsecurity.org/testdisk_doc/photorec_custom_sign...
I love photorec and dd rescue. I have recovered many many disks and memory cards with it.
I even recovered a card that had been off to professional recovery and deemed unrecoverable. I think half the memory chips in the card were fried so I used DD rescue to recover what data I could and then photorec to sift the wreckage. The owner was delighted to receive some of the photos.
If you ever have to do this, use DD rescue to image the source media as a first step. Sometimes you don't get a second read!
You say it. A few years ago my homeserver behalved odd and i needed reboots. I took out the SSD, used dd-rescue and after that The SSD did not even show up as storage any more. Yhea. I also have backups since then. :)
PhotoRec has saved me many times. But I have noticed that the results aren’t nearly as good for Mac file formats or video, especially professional video formats. A lot of videos I’ve tried to recover have failed. I wish that there was an app like this for those formats, but I understand that may be more of a niche market for them.
PhotoRec saved my ass just earlier this week, after an accidental wipe of a CompactFlash card with client photos on it.
As another commenter noted, create an exact dupe/image of the volume as the very first thing you do.
Also: if it doesn't successfully retrieve files on the first go, try another configuration. I think it took me 3 attempts to get it right.
A fun perk, also noted in the article: you may get back some surprises along with the files you expect - older files revealed in the sediment!
My folks gave me a big box of hard drives from various family computers over the years. Learning to use ddrescue and photorec to get data off of them was a ton of fun. Really cool tools, and not wildly unfriendly to someone who’d never used them before. I even managed to recover the drive that crashed a few days before the start of my junior year of high school, leaving me to re-write all of my summer homework in a panic. A little late on that one.
I hit every thrift store storage device with photorec. I also use it on storage devices I'm getting rid of, just to be sure.
> storage devices I'm getting rid of
When discarding storage, I do a random pass (even if the drive has always been part of an encrypted-at-rest arrangement, if only for the sake of habit), then a zero sweep, then it gets a filesystem created and filled with many copies of a few cat photos/videos¹² to give anyone running something like photorec a treat, then the partition table is emptied.
--------
[1] With filenames to suggest a bumper collection of photo/video backups from several people's phones/cameras, with some porn accidentally mixed in.
[2] If I'm in an evil mood the “treat” filesystem is filled with shock images and Rick Astley instead.
Photorec is great and has improved over the years; it did way better in 2010s than it had done in the early 2000s. (I have a dd image of a corrupt disk of baby photos.)
This reminds me to try it again.