0

First, I'm no expert, so don't assume I know much about data recovery. I'm using ddrescue and photorec to try to rescue files from a USB stick. It's a 32GB stick that has no more partition information so I had no success using testdisk.

I'm using ddrescue to try to rescue data. It is insane slow (like a couble kb/s when I'm lucky) but after a few days it got some data. Here is the command I used:

ddrescue -d -n /dev/sdd imagefile logfile

I used photorec to see what I could get from the generated image. I'm mostly interested in some PDF forms that were in the stick. I managed to recover some of them (around 20) but to my surprise after my brief moment of happiness I noticed that ALL PDFs were empty. Those are PDFs with form fields that had been filled up with text. The PDFs have all the pages, but all fields are empty!

So now I wonder, why is that? Where would that information be? Would that be because the recovery wasn't complete? But how come the PDFs look fine and the text is missing? Maybe photorec doesn't work well for forms? Maybe the content is stored somewhere else? (it would be weird)

Anyway, I'm running ddrescue again, but not sure what parameters to use to make it try to squeeze more data out.

Do you guys have any suggestion or idea that could help me? Do you know any other recovery software that can read from an image file?

  • PDF is a file format where you can stick more content on the end that overrides or amends earlier content. (That's at least how acroread fills forms, by putting the text on the end.) If your rescue software looks for the first feasible end of the pdf only, it will not find it. If the incremental portion is incomplete, maybe it will be ignored altogether. – Ulrich Schwarz May 1 '15 at 6:54
  • 1
    Did you read forum.cgsecurity.org/phpBB3/…, maybe you can ask the author on how photorec deals with pdf forms? – Lambert May 1 '15 at 9:13
0

I would suggest using a program like R-Studio to first make an image of your memory stick. You can then run a detailed scan on the image file. Also go through the extra files found when done.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.