LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices



Reply
 
Search this Thread
Old 03-28-2010, 01:27 AM   #1
plarser46
LQ Newbie
 
Registered: Mar 2010
Posts: 4

Rep: Reputation: 1
Using PhotoRec - Recovers 30+ GB files ...


I have a 1 TB ext2/ext3 hard drive that I store about 100 GB of pictures and videos on (the rest is unused). Ironically, this morning when I was backing up the data (over network) to disk through a CD burner on windows, some very sentimental video files (.MOD files) "magically" disappeared from the directory. And so my journey began with file recovery ...

After some researching I've been playing with testdisk and photorec. Aside from these few videos (~2 GB over 30 .MOD files), the file system is fine. Testdisk recognizes the files as deleted, but they are marked as zero bytes and I was unable to un-delete them.

So I tried out PhotoRec. My first attempt resulted in PhotoRec writing two 40GB MEPG files and pausing after the restore location filled up. The first of those two files ACTUALLY had one 5 minute video at the start, but otherwise I couldn't see video-related data. (Turns out .MOD files are recovered as .MPEG)

What would cause PhotoRec to write such MASSIVE video files? Is it somehow concatenating dozens of videos together? Is there any way to force smaller file sizes so it is more easily manageable and useable in for example mplayer or ffmpeg?


Alternately, since I know the exact file path of the missing files, and the file-system is still in-tact, is there an alternate linux recovery tool I should be using?

Thanks for your help!
 
Old 03-28-2010, 02:44 AM   #2
GlennsPref
Senior Member
 
Registered: Apr 2004
Location: Brisbane, Australia
Distribution: Mageia Studio-13.37 Kubuntu.
Posts: 3,325
Blog Entries: 33

Rep: Reputation: 199Reputation: 199
Hi, My answer is NO!

You just need a bigger partition to transfer the files to.

With photorec (recover) you need to transfer the recovered partition to a partition that is the same size or larger.

My feeling is that if you can do that, you will recover "everything" from that partition you have lost files from.

Hoping this helps you, Regards Glenn
 
Old 03-28-2010, 05:54 AM   #3
H_TeXMeX_H
Guru
 
Registered: Oct 2005
Location: $RANDOM
Distribution: slackware64
Posts: 12,928
Blog Entries: 2

Rep: Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269
Here's an alternative recovery tool if you need it:
http://foremost.sourceforge.net/

Remember to recover the files to a different partition or HDD than the one they are on.
 
Old 03-28-2010, 09:10 AM   #4
plarser46
LQ Newbie
 
Registered: Mar 2010
Posts: 4

Original Poster
Rep: Reputation: 1
Thanks for the responses. I'm ok (and very impressed) with photorec. But I'm not sure what to do with the 40+ gb Individual mpeg files it generates. Any idea why it does that or how I can manage them? The largest original individual mpeg video file I had was around 500 mb
 
Old 03-28-2010, 06:59 PM   #5
GlennsPref
Senior Member
 
Registered: Apr 2004
Location: Brisbane, Australia
Distribution: Mageia Studio-13.37 Kubuntu.
Posts: 3,325
Blog Entries: 33

Rep: Reputation: 199Reputation: 199
Photorec did not finish, you ran out of space.

It may apear to have only written one or two very large files, the operation was not complete.
it doesn't change anything, it's just the way photorec works. It reads from start to end, if for some reason it misses something it goes to the end and starts there comming backwards to the start.

So the files you have recovered may not actually represent the files you had, the operation was incomplete.


read more here, http://www.cgsecurity.org/wiki/PhotoRec

step 1, you need a free harddrive partition larger than the harddrive partition you are recovering.

Last edited by GlennsPref; 03-28-2010 at 07:01 PM.
 
Old 03-28-2010, 10:21 PM   #6
plarser46
LQ Newbie
 
Registered: Mar 2010
Posts: 4

Original Poster
Rep: Reputation: 1
Yeah I guess I was a little surprised that it was creating 40 gb files. the operation did stop in my above scenario, and exactly for that reason. My output partition was way too small.

But the good news is I recovered the precious files (family videos). I noticed in a hex editor that these mod files (from a camera) had very specific headers. Heck, it had the word CANON in the header . So I figured with a signature like that I can pinpoint the files a little more precisely.

Using foremost (thx for the rec) I added this signature to the conf file and ran. It found the files but occasionally stopped short because I didn't define a good footer to stop at (couldn't find the .mod standard and no patterns noticable). But since I copied these files all at one time, they were luckily at the same disk region and somewhat in sequence. So I then ran "dd" to pull that binary region of the disk to a big video file and I'm good to go! I just need to sort and split with a video editor now.

....just wanted to post my results for completion. Thank you all for the help!!!!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How to remove multiple Photorec files (recup_dir.) ausber71 Linux - Newbie 2 01-14-2010 01:12 PM
LXer: Recover deleted files in linux with Photorec LXer Syndicated Linux News 0 10-12-2009 10:41 AM
Is there a native Linux application that recovers Windows .chk files? toshibalaptoplinux Linux - Software 6 01-09-2009 07:38 AM
recover directories & files from ext. HDD using testdisk or photorec esteeven Linux - Hardware 1 11-13-2008 11:48 AM
What program recovers formatted data? tearinox Linux - General 1 03-27-2004 12:56 PM


All times are GMT -5. The time now is 06:39 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration