0

I'm using photorec on last version Ubuntu to find a file in my old hard drive (not damaged just formatted) but I realised that it was an hidden file. However, when I try recover the files using photorec it does not show this hidden text file that I'm looking for (I checked using find command). Is there any chance to recover it?Or other utility that I can use? Thanks in advance

Improve this question
2
  • How was the file hidden? If it's name just started with a dot or similar, PhotoRec shouldn't have any trouble, I believe it scans the entire drive looking for the "magic bits" (file headers or signatures). But if the file was encrypted somehow to hide it, PhotoRec may have no chance (unless it recognized the encrypted container). Or the fomatting could have overwritten it. And like the answers state, PhotoRec does not recover original filenames (usually, mp3's or some docuemnts, files with embedded metadata, sometimes get renamed appropriately)
    – Xen2050
    Apr 30, 2017 at 20:58
  • What was the original file system of your old hard drive (before formatting)?
    – Andrea Lazzarotto
    Apr 30, 2017 at 22:04

2 Answers 2

Reset to default
1

When I used photorec in the past(with Hirens Boot CD), it didn't pull the files metadata, so searching by name didn't work. It did save the file extensions though. The file names were just changed to just numbers, so searching by the original files name wouldn't bring anything up. Try checking out the files manually, if you see this is true in your case as well your best bet is to search for the file by extension and you'll have to manually search through the results.

An example to search by extensions if looking for a MP3 file is like this sudo find ./ *.mp3 2> /dev/null

the 2> /dev/null just gets rid of errors so you get a cleaner output. I recommend using sudo to run the command just so you don't have issues with permissions. you can cd to the the directories you want to search or just type in the full path in place of ./ to the drives location. I remember data recovery with photorec was time consuming cause it mixes OS files and personal data files, and loses the names. So many files to sort through.

Improve this answer
2
  • yep so true mate. but I cannot recover the hidden file so this I'm wondering if I'm capable of. Sorry if I was not clear on my questions. Thanks for your help anyway
    – ScottEd
    Apr 30, 2017 at 7:11
  • If you have to run PhotoRec as root (sudo) then it's output files are owned by root too, but a sudo chown -R is helpful. And a script using find & mv to sort filetypes into folders would help a lot, then viewing/sorting by size can usually throw out a lot of tiny (usually useless) files.
    – Xen2050
    Apr 30, 2017 at 21:06
1

I think photorec doesn't give you the name of the recovered files, so you will need to use grep in order to find some content of the file you're looking for

grep "I'm sure this is in my file" recup_dir.*/*

this should give you the 'new' name of your file

hope this help

Improve this answer
2
  • Thanks for your answer, but I cannot recover the hidden file this I'm wondering if I'm capable of. Or photorec recover all files enabling all options?
    – ScottEd
    Apr 30, 2017 at 7:10
  • 1
    I think photorec just doesn't care if the file was hidden or not, it just find what use to finish whith .txt, .jpeg, .png... then recover it with new name like f1234567.txt, f1234567.jpeg, f1234567.png...so if you don't have extension (like .bashrc or .vimrc) it will be more difficult
    – Vimman
    Apr 30, 2017 at 7:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .