When recovering deleted files from a forensic disk image or storage device
When the file system is corrupted, formatted, or overwritten
During investigations requiring recovery of documents, images, videos, or databases
When file system metadata is unavailable but raw data sectors remain intact
For recovering files from memory cards, USB drives, and hard drives
Detection Gaps & Validation
Signature carving recovers bytes, not files-as-the-user-knew-them. Understand what PhotoRec structurally cannot do before reporting results:
Fragmentation is the core limitation. PhotoRec carves contiguously from a header until a footer or size cap; if a file was stored in non-contiguous clusters (common for large/edited files on a busy volume), you get a truncated or corrupt result and the tail is silently lost. A "recovered" 4 KB DOCX from a 2 MB original is a fragment — validate, don't assume completeness.
No file names, paths, or original timestamps. Carving bypasses the file system, so output is recup_dir.N/fNNNNNNN.ext with the recovery time as mtime, not the evidentiary timestamp. To restore names/MAC times you must correlate with $MFT/USN, ext inode/journal, or directory entries separately — never present the carve mtime as when the file was created or deleted.
Overwritten/secure-wiped data is gone. PhotoRec only recovers data still resident in unallocated sectors (data remanence). Reused clusters, TRIM'd SSD blocks (most deleted data on SSDs is unrecoverable after TRIM), and wiped media yield nothing — note this as a limitation, not a clean drive. Image to a file and carve the image, with a write-blocker on originals.
Validate every carved artifact. Run file/signature checks and format-specific validators (jpeginfo -c, open the PDF/SQLite) to separate genuine files from header-only false positives. Hash all output and filter known-good against NSRL/hashsets so review focuses on unique, intact, evidence-relevant files.
Interpretation false positives. Headerless or footerless formats over-carve, embedded thumbnails surface as standalone JPEGs, and one logical file can yield several partial carves — inflating counts. A recovered file's presence in unallocated space shows the data existed on the media, not who put it there or when; corroborate provenance with file-system and timeline artifacts.
Prerequisites
PhotoRec installed (part of TestDisk suite)
Forensic disk image or direct device access (read-only)
Sufficient output storage space (potentially larger than source)
Write-blocker if working with original media
Root/sudo privileges for device access
Knowledge of target file types for focused recovery
Workflow
Step 1: Install PhotoRec and Prepare the Environment
# Install TestDisk (includes PhotoRec) on Debian/Ubuntusudo apt-get install testdisk
# On RHEL/CentOSsudo yum install testdisk
# On macOS
brew install testdisk
# Verify installation
photorec --version
# Create output directory structuremkdir -p /cases/case-2024-001/recovered/{all,documents,images,databases}
# Verify the forensic image
file /cases/case-2024-001/images/evidence.dd
ls -lh /cases/case-2024-001/images/evidence.dd
Step 2: Run PhotoRec in Interactive Mode
# Launch PhotoRec against a forensic image
photorec /cases/case-2024-001/images/evidence.dd
# Interactive menu steps:# 1. Select the disk image: evidence.dd# 2. Select partition table type: [Intel] for MBR, [EFI GPT] for GPT# 3. Select partition to scan (or "No partition" for whole disk)# 4. Select filesystem type: [ext2/ext3/ext4] or [Other] for NTFS/FAT# 5. Choose scan scope: [Free] (unallocated only) or [Whole] (entire partition)# 6. Select output directory: /cases/case-2024-001/recovered/all/# 7. Press C to confirm and begin recovery# For direct device scanning (with write-blocker)sudo photorec /dev/sdb
Step 3: Run PhotoRec with Command-Line Options for Targeted Recovery
Alternative file carver originally developed by US Air Force OSI
Scalpel
High-performance file carver based on Foremost
hashdeep
Recursive hash computation and audit tool
jpeginfo
JPEG file integrity verification
file
Unix utility identifying file types by magic bytes
exiftool
Extract metadata from recovered image and document files
Common Scenarios
Scenario 1: Recovering Deleted Evidence from a Suspect's USB Drive
Image the USB drive with dcfldd, run PhotoRec targeting document and image formats, organize by file type, hash all recovered files, compare against known-bad hash sets, extract metadata from images for GPS and timestamp information.
Scenario 2: Formatted Hard Drive Recovery
Run PhotoRec in "Whole" mode against the entire formatted partition, recover all file types, expect higher false positive rate due to file fragmentation, validate recovered files with signature checking, catalog and hash for evidence chain.
Scenario 3: Memory Card from a Surveillance Camera
Recover deleted video files (AVI, MP4, MOV) from the memory card image, use targeted file type selection to speed recovery, verify video files are playable, extract frame timestamps, document recovery in case notes.
Scenario 4: Corrupted File System on Evidence Drive
When file system metadata is destroyed, PhotoRec bypasses the file system entirely and carves from raw sectors, recover maximum possible data, accept that file names and directory structure will be lost, rename files based on content during review.
