2

When recovering data from a formatted external hard disk with photorec command of the testdisk tool, if originally the hard disk had 2 partitions (NTFS and ext), does it make sense to run the command twice for each partition-filesystem type?

3

Although the official documentation states that "photorec ignores the filesystem", even if it was true (it's not), the partition could still play a role, moreso if it's not 4K-aligned.

Consider "How PhotoRec works"

PhotoRec first tries to find the data block (or cluster) size. If the file system is not corrupted, this value can be read from the superblock (ext2/ext3/ext4) or volume boot record (FAT, NTFS). Otherwise, PhotoRec reads the media, sector by sector, searching for the first ten files, from which it calculates the block/cluster size from their locations. Once this block size is known, PhotoRec reads the media block by block (or cluster by cluster).

So, not only does it not ignore the filesystem, it even makes assumptions if there is no filesystem. And all further actions then depend on these assumptions.

It even asks you for the filesystem first thing in the process:

To recover lost files, PhotoRec need to know the filesystem type where the
file were stored:
>[ ext2/ext3 ] ext2/ext3/ext4 filesystem
 [ Other     ] FAT/NTFS/HFS+/ReiserFS/...

As long as you set PhotoRec to analyze a single partition that was a single filesystem, and you didn't overwrite it with another filesystem (like when dd'ing ISO to the wrong device), all is (probably) well. I guess except if the first 10 files were randomly aligned to something that won't be true anymore later.

But as soon as there is a new partition, new filesystem, which might have a different alignment, a different block (cluster) size, a different layout... there is a chance that PhotoRec will read through it all, but recognize only a fraction of what is there.

So yes, it makes sense to run the command on (arbitrary) segments of disk.

Either that, or disable PhotoRec's assumption-making. Perhaps this could be done using the expert mode but I have not experimented with this mode in detail:

The expert mode option allows the user to force the file system block size and the offset. Each filesystem has his own block size (a multiple of the sector size) and offset (0 for NTFS, exFAT, ext2/3/4), these value are fixed when the filesystem has been created/formated. When working on the whole disk (ie. original partitions are lost) or a reformated partition, ★if PhotoRec has found very few files★, you may want to try the minimal value that PhotoRec let you select (it's the sector size) for the block size (0 will be used for the offset).

(★) So it turns out photorec being unable to find all files when not running it per-partition is even an officially documented feature. :-)

  • So it looks like expert mode should do the work by using the minimal block size Photorec allows to choose. Less smarter is to run it twice. – Francesco Boi Jul 25 at 12:10
  • Yeah, maybe. This answer is a bit too documentation-biased, didn't have time to run experiments. photorec not recovering files even though it should is something I experienced in the past... but it's much better to test these out in practise. – frostschutz Jul 25 at 12:47
  • I agree, the problem is that these "experiments" take a lot of time. – Francesco Boi Jul 25 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.