The operating system no longer can detect the file because it’s metadata is lost and hence considers the blocks free for writing new data. Each block of data is written one at a time at the speed of the hard drive. The first block usually contains the metadata for the file in question. When you store data on your hard drive, the data is stored in blocks. Noticed how saving a file on the hard disk takes time, but deleting is almost instantaneous? Let’s understand that first. You can look for the file that you want here since the filenames aren’t restored by PhotoRec. Great, we now have a list of all the files that we deleted previously. That’s not to say PhotoRec cannot be used for other file types, you sure can. That’s why the name “PhotoRec” which is short for “Photo Recovery”. PhotoRec, on the other hand, was created to recover media files that were deleted from SD Cards and other removable media. TestDisk was created by CGSecurity to recover deleted partitions.
Let’s find out how to use PhotoRec to recover deleted files. In a previous tutorial, we discussed the steps to recover deleted files using a Linux utility named TestDisk and the PhotoRec utility is created by the same company. Md5sum usr/bin/testdisk > DEBIAN/md5sumsĥ.Accidentally deleted files or photos? In this tutorial, we’ll learn how to recover deleted files in Linux using PhotoRec. Md5sum usr/bin/qphotorecbin > DEBIAN/md5sums Md5sum usr/bin/qphotorec > DEBIAN/md5sums Md5sum usr/bin/fidentify > DEBIAN/md5sums Md5sum usr/share/pixmaps/qphotorec.png > DEBIAN/md5sums Md5sum usr/share/doc/testdisk/README.md > DEBIAN/md5sums Md5sum usr/share/doc/testdisk/copyright > DEBIAN/md5sums Md5sum usr/share/doc/testdisk/NEWS > DEBIAN/md5sums Md5sum usr/share/doc/testdisk/changelog.Debian > DEBIAN/md5sums Md5sum usr/share/menu/qphotorec > DEBIAN/md5sums Md5sum usr/share/polkit-1/actions/qphotorec.policy > DEBIAN/md5sums Md5sum usr/share/man/man8/qphotorec.8 > DEBIAN/md5sums Md5sum usr/share/man/man8/testdisk.8 > DEBIAN/md5sums Md5sum usr/share/man/man8/photorec.8 > DEBIAN/md5sums Md5sum usr/share/man/man8/fidentify.8 > DEBIAN/md5sums Md5sum usr/share/applications/sktop > DEBIAN/md5sums
Rather than hacking around on blocking the TestDisk repo download, I decided to package my own full Debian package of TestDisk 7.2-WIP for 64-bit Debian-based Linux distros with a working version of QPhotoRec complete with the menu entries (they don't come with a source installation, unfortunately). Because dpkg (and as such, apt) are only aware of packages they install, I could not reinstall forensics-extra without having a duplicate, older version of TestDisk sitting in /usr/bin/. Further, when I built the TestDisk source locally (tl dr is below), it installed it in /usr/local/bin/ instead of the repository installation target which is /usr/bin/. Unfortunately, upon deleting the original package, I found that it took the forensics-extra package with it. Rather than hacking around on that particular debian package (okay, I did and I figured out why it was failing), I decided it would be more fruitful to build it locally. It was meant to be a part of Parted Magic and would generally fail out rather than allowing one to bypass the opening screen and actually use it. deb package I found online (which was mentioned everywhere.) was for the first edition.
Instead, you traditionally instal TestDisk via sudo apt install testdisk -y which comes only with testdisk and photorec. They do not have a standalone version or anyting installable from any package manager I am familiar with. I wanted to install QPhotoRec, which is created by the maker of TestDisk and PhotoRec.
(todo: fix sudo permissions so it opens as root by default)
TestDisk, PhotoRec, and QPhotoRec 7.2-WIP for 64 bit Debian-based systems