Hi,

I am running PhotoRec on a Debian Live distribution booted via USB drive. The PC with the deleted files (encrypted then deleted via ransom-ware) has a 100GB hard drive. The USB drive I am booting from has 1TB of free space. I keep running into the error "Warning: not enough free space available" after recovering a few hundred files. Clearly this is not true, as there is enough free space to copy the entire hard drive ten times over.

Any idea what might be causing this? My only thought so far is that Debian Live might not be letting PhotoRec see the whole external drive. If that's the case, is there a way around this or a better way to boot?

Thanks in advance.

If you are booting Debian Live that you put on a 1TB drive, the same drive you are trying to save files to, you need to first create a partition on that drive from Debian Live, then create a mount point for the partition, format the partition, mount it and then tell photorec to save/move the recovered files there. Have you done that? You will need to let photorec finish. If you reboot, you will need to go through the process again as Live systems don't save changes such as mount points.

Make an 8G usb flash drive and then attach the 1Tb drive and see if you can recover.

This worked for me. I didn't realize that almost all the space was unallocated. I GParted a 200GB partition and recovered the files to that.

Thanks!