If available, use the raw device, /dev/rdisk* instead of /dev/disk* for faster data transfer. Use up/down arrow keys to select the disk that holds the lost files. To recover files from other devices, run photorec device.įorensics users can use the parameter /log to create a log file named photorec.log it records the location of the files recovered by PhotoRec.Īvailable media are listed. Most devices should be autodetected including Linux software RAID (that is, /dev/md0) and file system encrypted with cryptsetup, dm-crypt, LUKS or TrueCrypt (ie. photorec '/cygdrive/d/evidence/image.?' if the Encase image is split into several files in the directory d:\evidence.photorec 'image.?' if the Encase image is split into several files.photorec image.E01 to recover files from an Encase EWF image.photorec image.dd to carve a raw disk image.Under OS/2, PhotoRec doesn't handle physical devices, only disk images.Sudo will ask for a password - enter your Mac OS X user password. If you are not root, PhotoRec will restart itself using sudo after a confirmation on your part. Under Mac OS X, start PhotoRec (ie testdisk-6.13/photorec).Under Unix/Linux/BSD, you need to be root to run PhotoRec (ie.Under Windows Vista or later, right click photorec_win.exe and then click Run as administrator to launch PhotoRec. Under Windows, start PhotoRec (ie testdisk-6.13/photorec_win.exe) from an account in the Administrator group.To recover files from hard disk, USB key, Smart Card, CD-ROM, DVD, etc., you need enough rights to access the physical device. Extract the files from the archive including the sub-directories. If PhotoRec is not yet installed, it can be downloaded from TestDisk Download. 8 Select where recovered files should be written.7 Carve the partition or unallocated space only.
0 kommentar(er)
