I have a 1 TB ext2/ext3 hard drive that I store about 100 GB of pictures and videos on (the rest is unused). Ironically, this morning when I was backing up the data (over network) to disk through a CD burner on windows, some very sentimental video files (.MOD files) "magically" disappeared from the directory. And so my journey began with file recovery ...

After some researching I've been playing with testdisk and photorec. Aside from these few videos (~2 GB over 30 .MOD files), the file system is fine. Testdisk recognizes the files as deleted, but they are marked as zero bytes and I was unable to un-delete them.

So I tried out PhotoRec. My first attempt resulted in PhotoRec writing two 40GB MEPG files and pausing after the restore location filled up. The first of those two files ACTUALLY had one 5 minute video at the start, but otherwise I couldn't see video-related data. (Turns out .MOD files are recovered as .MPEG)

What would cause PhotoRec to write such MASSIVE video files? Is it somehow concatenating dozens of videos together? Is there any way to force smaller file sizes so it is more easily manageable and useable in for example mplayer or ffmpeg?


Alternately, since I know the exact file path of the missing files, and the file-system is still in-tact, is there an alternate linux recovery tool I should be using?

Thanks for your help!

Hi, My answer is NO!

You just need a bigger partition to transfer the files to.

With photorec (recover) you need to transfer the recovered partition to a partition that is the same size or larger.

My feeling is that if you can do that, you will recover "everything" from that partition you have lost files from.

Hoping this helps you, Regards Glenn

Here's an alternative recovery tool if you need it:
http://foremost.sourceforge.net/

Remember to recover the files to a different partition or HDD than the one they are on.

Thanks for the responses. I'm ok (and very impressed) with photorec. But I'm not sure what to do with the 40+ gb Individual mpeg files it generates. Any idea why it does that or how I can manage them? The largest original individual mpeg video file I had was around 500 mb

Photorec did not finish, you ran out of space.

It may apear to have only written one or two very large files, the operation was not complete.
it doesn't change anything, it's just the way photorec works. It reads from start to end, if for some reason it misses something it goes to the end and starts there comming backwards to the start.

So the files you have recovered may not actually represent the files you had, the operation was incomplete.


read more here, http://www.cgsecurity.org/wiki/PhotoRec

step 1, you need a free harddrive partition larger than the harddrive partition you are recovering.

Yeah I guess I was a little surprised that it was creating 40 gb files. the operation did stop in my above scenario, and exactly for that reason. My output partition was way too small.

But the good news is I recovered the precious files (family videos). I noticed in a hex editor that these mod files (from a camera) had very specific headers. Heck, it had the word CANON in the header . So I figured with a signature like that I can pinpoint the files a little more precisely.

Using foremost (thx for the rec) I added this signature to the conf file and ran. It found the files but occasionally stopped short because I didn't define a good footer to stop at (couldn't find the .mod standard and no patterns noticable). But since I copied these files all at one time, they were luckily at the same disk region and somewhat in sequence. So I then ran "dd" to pull that binary region of the disk to a big video file and I'm good to go! I just need to sort and split with a video editor now.

....just wanted to post my results for completion. Thank you all for the help!!!!