Linux Picture Recovery

While Linux has a number of digital forensics, recovery, and repair tools, there is only one application that can recover files that were stored on a damaged storage device or from formatted hard drives. PhotoRec was written with recovering digital photographs in mind, but has since expanded to include a number of common file types. It reads the storage device and scans the underlying data, even in unallocated space, to find deleted files by type based upon their header, a set of numbers that delineate whether a piece of data is an image file or another document type.

• 1

  Download and install PhotoRec using your Linux distribution's package management utility. You may have to search for "testdisk" to find it since the application is often bundled with the partition recovery tool, TestDisk, from the same developer.

• 2

  Create a directory to save your recovered digital photographs in. This directory should be on a partition that the images were not stored on, so if you are recovering deleted files from a hard drive you may want to consider using a networked storage option or an external hard drive.

• 3

  Launch a terminal window and type "sudo photorec" to start the application. If you do not use "sudo" with your distribution, you will need to gain root or superuser access using the "su" command and entering the root account's password. PhotoRec must be run as root.

• 4

  Use the arrow keys to select the hard drive or storage medium you wish to recover from, then select the partition table type of this medium from the next screen. PhotoRec will usually recognize the table type automatically, but you should double-check to be sure.

• 5

  Arrow to the "FileOpts" button and press "Enter." Scroll down the list and press the space bar to un-check any file types that you do not need recovered. This will speed up PhotoRec's operation later since you are just recovering image files. Save your settings when you are done.

• 6

  Arrow to select the source partition where your files were saved. Most likely this will be the "/home" partition, where your personal user directory is located. Typically this will be the partition with the most sectors, but you could open another terminal window and execute "sudo fdisk -l" to see the list of partitions and their mount points if you want to be certain.

• 7

  Arrow to select the file system type from the next pane. Unless you are using ext2 or ext3, very common Linux file system types, you should select the "Other" option. If you do not know your partition's file system type you can find it out by opening another terminal window and executing the "mount" command without any arguments.

• 8

  Arrow to select if you want to examine the "Whole" partition or just the "Free" unallocated space. The "Free" option is probably best if you are just trying to recover files you have recently deleted. The "Whole" option is more from recovering as much as possible from a damaged storage device and will recover every image file that it can from your entire partition.

• 9

  Arrow to select the restoration directory you created earlier as the save point for recovered files, then press "Y" to begin. PhotoRec will run its course and provide a step by step report of what it has been able to recover. When the process is complete, select "Done," then "Quit" to exit the application. Your recovered photos will be in the directory you created.