Recovering Lost Photos with DEFT Linux and PhotoRec
DEFT Linux can be used for
forensics examination of a disk drive or to recover deleted or otherwise
lost files from a disk drive.
If you have lost files on a device, such as a memory card from a camera,
perhaps because you accidentally deleted them, you can use DEFT and
the PhotoRec utility that comes with
DEFT 7 to search for and recover
those files. PhotoRec 6.13 comes with
DEFT 7. PhotoRec was created by Christophe Grenier. It is also
available for
Mac OS X and Microsoft Windows systems.
To recover files using the Photorec utility, take the steps below after
booting the system from the DEFT boot DVD.
If you are trying to recover a large number of files or even a small number of
files that are sufficiently large that you may exceed the storage space
available in the computer's memory, you may also want to attach a USB
device, such as a USB "thumbdrive" to use as the storage location for
recovered files before you start Photorec. You may need to
use the
MountManager utility to mount the device in read/write mode.
-
Click on the "d" at the lower, left-hand corner of the screen.
-
Select DEFT.
-
Select Carving tools.
-
Select Photorec.
-
Select the device you wish to search for photos by using the cursor
keys and then hit Enter to proceed.
-
If you wish to select a particular partion, choose the relevant one,
otherwise you can choose "No partition" to search the whole disk. Hit
Enter when you've made your selection using the arrow keys.
-
Choose the type of file system for the device. A Linux filesystem will
typically be ext or ext3. If you are searching a memory card from a
camera, you would typically select "Other" for FAT/NTFS/HFS+/ReiserFS/...
-
Choose the output directory where the recovered files will be stored.
By default, PhotoRec will show you the disk from which it is run, but
if you are running it from a boot disc loaded into memory, you may not
have enough free storage space available in memory to hold all of
the available recovered files. In that case, you may need to change
the output location. In any case, you will likely want to store the
recovered files elsewhere than in the system's memory, since, otherwise when
you reboot they will no longer be available.
-
When you have chosen the output directory where you want to store the
recovered files, hit C to select it.
-
When the recovery process is completed, you will see a notice regarding how many
files were saved in the output directory you specified. The utility creates
recup_dir.n directories, where n is a number starting
at "1", to hold the recovered files beneath the directory you specified.
-
Hit Enter to quit the utility when the file recovery process
is completed. Keep selecting Quit until you see the "PhotoRec
exited normally message.
Created: Thursday April 5, 2012
