> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-5/data-recovery/trick-0324/forensics-data-recovery-utility.md).

# Utility

## Recover Deleted Files via PhotoRec

Use PhotoRec for data recovery by scanning for file signatures, bypassing filesystem metadata. This is particularly useful for recovering deleted files from disk images or partitions. PhotoRec recovers files based on their signatures, so the recovered files are not necessarily named correctly. It ignores the filesystem and recovers files from the underlying media.

Start the tool, often requiring root privileges:

```bash
sudo photorec
```

The tool runs interactively using a text-based interface. You will be prompted to:

1. **Select the source medium (disk image or partition).** Choose the disk or partition you want to recover files from.
2. **Specify the filesystem type.** Options include `ext2/ext3` or `Other`. If the partition is formatted as ext4, you should choose `Other`. This option is often the best choice when recovering files from FAT, NTFS, HFS+, ReiserFS, or other filesystems, as PhotoRec doesn't use the filesystem information anyway.
3. **Select the scan type.** Choose `Free` to scan only the unallocated space, or `Whole` to scan the entire partition/disk. Scanning the `Whole` partition is generally recommended for thorough recovery.
4. **Designate a destination directory** where recovered files will be saved. It is critical to choose a destination directory on a *different* partition or disk than the one you are scanning. Saving recovered files to the same drive being scanned can overwrite the very data you are trying to recover.

PhotoRec will scan for known file headers and footers, recovering files into numbered directories within the destination path, typically named `recup_dir.1`, `recup_dir.2`, and so on. After the scan, you will find the recovered files sorted into these directories.