# PhotoRec > Mediated Wiki article. Canonical URL: https://mediated.wiki/source/PhotoRec > Markdown URL: https://mediated.wiki/source/PhotoRec.md > Source: https://en.wikipedia.org/wiki/PhotoRec > Source revision: 1343614109 > License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/) Open source data recovery software This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "PhotoRec" – news · newspapers · books · scholar · JSTOR (October 2025) (Learn how and when to remove this message) PhotoRec Demonstration of PhotoRec running in Linux Developer Christophe Grenier Release April 30, 2002; 24 years ago (2002-04-30) Stable release 7.2 / February 22, 2024; 2 years ago (2024-02-22) Written in C (nCurses) Operating system Cross-platform Platform CLI Type Data recovery License GNU GPL v2+ (free software) Website www.cgsecurity.org/wiki/PhotoRec Repository git.cgsecurity.org/cgit/testdisk/ **PhotoRec** is a [free and open-source](/source/Free_and_open-source) [utility software](/source/Utility_software) for [data recovery](/source/Data_recovery) with [text-based user interface](/source/Text-based_user_interface) using [data carving](/source/Data_carving) techniques, designed to recover lost files from various digital camera memory, [hard disk](/source/Hard_disk) and [CD-ROM](/source/CD-ROM). It can recover the files with more than 480 file extensions (about 300 file families).[1] It is also possible to add custom [file signature](/source/File_magic_number) to detect less known files.[2] PhotoRec does not attempt to write to the damaged media the user is about to recover from. Recovered files are instead written to the directory from which PhotoRec is run, any other directory may be chosen. It can be used for [data recovery](/source/Data_recovery) or in a [digital forensics](/source/Digital_forensics) context.[3][4][5][6][7] PhotoRec is shipped with [TestDisk](/source/TestDisk).[8] ## Functionality [FAT](/source/File_Allocation_Table), [NTFS](/source/New_Technology_File_System), [ext2](/source/Ext2)/[ext3](/source/Ext3)/[ext4](/source/Ext4) [file systems](/source/File_system) store files in data blocks (also called [data clusters](/source/Data_cluster) under Windows). The cluster or block size remains at a constant number of sectors after being initialized during the formatting of the filesystem. In general, most operating systems try to store the data in a contiguous way so as to minimize [data fragmentation](/source/Fragmentation_(computing)). The seek time of mechanical drives is significant for writing and reading data to/from a hard disk, so that is why it is important to keep the fragmentation to a minimum level. When a file is deleted, the meta-information about this file (filename, date/time, size, location of the first data block/cluster, etc.) is lost; e.g., in an ext3/ext4 filesystem, the names of deleted files are still present, but the location of the first data block is removed. This means the data is still present on the filesystem, but only until some or all of it is overwritten by new file data. To recover these "lost" files, PhotoRec first tries to find the data block (or cluster) size. If the filesystem is not corrupted, this value can be read from the superblock (ext2/ext3/ext4) or volume boot record (FAT, NTFS). Otherwise, PhotoRec reads the media, sector by sector, searching for the first ten files, from which it calculates the block/cluster size from their locations. Once this block size is known, PhotoRec reads the media block by block (or cluster by cluster). Each block is checked against a signature database; which comes with the program and has been growing in the type of files it can recover ever since PhotoRec's first version came out. It is a common data recovery method called [file carving](/source/File_carving). For example, PhotoRec identifies a [JPEG](/source/JPEG) file when a block begins with: - Start Of Image + APP0: 0xff, 0xd8, 0xff, 0xe0 - Start Of Image + APP1: 0xff, 0xd8, 0xff, 0xe1 - or Start Of Image + Comment: 0xff, 0xd8, 0xff, 0xfe If PhotoRec has already started to recover a file, it stops its recovery, checks the consistency of the file when possible and starts to save the new file (which it determined from the signature it found). If the data is not fragmented, the recovered file should be identical to (or possibly larger than) the original file in size. In some cases, PhotoRec can learn the original file size from the file header, so the recovered file is truncated to the correct size. If, however, the recovered file ends up being smaller than its header specifies, it is discarded. Some files, such as *.MP3 types, are data streams. In this case, PhotoRec parses the recovered data, then stops the recovery when the stream ends. When a file is recovered successfully, PhotoRec checks the previous data blocks to see whether a file signature was found but the file was not able to be successfully recovered (i.e., the file was too small), and it tries again. This way, some fragmented files can be successfully recovered.[9] ## Compatibility PhotoRec is compatible with:[10] - [MS-DOS](/source/MS-DOS) (either real or in a Windows 9x DOS box) - [Windows](/source/Windows): [NT4](/source/Windows_NT), [2000](/source/Windows_2000), [XP](/source/Windows_XP), [2003](/source/Windows_Server_2003), [2008](/source/Windows_Server_2008), [2016](/source/Windows_Server_2016), [Vista](/source/Windows_Vista), [Windows 7](/source/Windows_7), [Windows 8](/source/Windows_8), [Windows 8.1](/source/Windows_8.1), [Windows 10](/source/Windows_10), [Windows 11](/source/Windows_11) - [Linux](/source/Linux) - [FreeBSD](/source/FreeBSD), [NetBSD](/source/NetBSD), [OpenBSD](/source/OpenBSD) - [SunOS](/source/SunOS) - [macOS](/source/MacOS) ## Distribution PhotoRec and [TestDisk](/source/TestDisk) are shipped together. They can be downloaded from [CGSecurity](http://www.cgsecurity.org/wiki/TestDisk_Download) website. These utilities can be found on various [Linux](/source/Linux) [Live CDs](/source/Live_CD): - [GParted](/source/GParted) Live CD [11] - [Parted Magic](/source/Parted_Magic)[12] - Slax-LFI, a [Slax](/source/Slax)-derived distribution [13] - [SystemRescueCD](/source/SystemRescueCD)[14] - Ubuntu Rescue Remix, an [Ubuntu](/source/Ubuntu_(operating_system)) derivation [15] They are also packaged for numerous [*nix](/source/*nix) (mostly [Linux](/source/Linux) based) distributions: - [ALT Linux](/source/ALT_Linux)[16] - [Arch Linux](/source/Arch_Linux) Extra Repository[17] - [Debian](/source/Debian) contrib[18] - [Fedora](/source/Fedora_(operating_system)) Extras[19] - [Red Hat](/source/Red_Hat) Epel[20] - [FreeBSD](/source/FreeBSD) port[21] - [OpenBSD](/source/OpenBSD) port[22] - [Gentoo](/source/Gentoo_Linux)[23] and Gentoo Portage[24] - [Mandriva](/source/Mandriva) contrib - [Source Mage](/source/Source_Mage) Linux[25] - [Ubuntu](/source/Ubuntu_(operating_system))[26] ## See also - [Photo recovery](/source/Photo_recovery) - [List of free and open-source software packages](/source/List_of_free_and_open-source_software_packages) ## References 1. **[^](#cite_ref-FileFormats_1-0)** ["File Formats Recovered by PhotoRec"](http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec). April 2015. 1. **[^](#cite_ref-2)** ["Add your own extension to PhotoRec"](https://www.cgsecurity.org/wiki/Add_your_own_extension_to_PhotoRec). 18 May 2016. 1. **[^](#cite_ref-3)** Jack Wiles, Kevin Cardwell, Anthony Reyes (2007). *The best damn cybercrime and digital forensics book period*, p. 220. Syngress Publishing Inc. [ISBN](/source/ISBN_(identifier)) [978-1-59749-228-7](https://en.wikipedia.org/wiki/Special:BookSources/978-1-59749-228-7) 1. **[^](#cite_ref-4)** Cameron H. Malin, Eoghan Casey, James M. Aquilina (2008). *Malware Forensics: Investigating and Analyzing Malicious Code*, p. xxviii. Syngress Publishing Inc. [ISBN](/source/ISBN_(identifier)) [978-1-59749-268-3](https://en.wikipedia.org/wiki/Special:BookSources/978-1-59749-268-3). 1. **[^](#cite_ref-5)** Nathan Clarke (2010), *Computer Forensics: A Pocket Guide*, p. 67. IT Governance Publishing. [ISBN](/source/ISBN_(identifier)) [978-1-84928-039-6](https://en.wikipedia.org/wiki/Special:BookSources/978-1-84928-039-6). 1. **[^](#cite_ref-GraphicFileCarvingTool_6-0)** [NIST Test Results for Graphic File Carving Tool: PhotoRec v7.0-WIP](https://cyberfetch.org/groups/community/test-results-graphic-file-carving-tool-photorec-v70-wip)[*[permanent dead link](https://en.wikipedia.org/wiki/Wikipedia:Link_rot)*] 1. **[^](#cite_ref-VideoFileCarvingTool_7-0)** [NIST Test Results for Video File Carving Tool: PhotoRec v7.0-WIP](https://cyberfetch.org/groups/community/test-results-video-file-carving-tool-photorec-v70-wip) [Deprecated link](https://en.wikipedia.org/wiki/Wikipedia:Archive.today_guidance) archived 2015-04-22 at [archive.today](/source/Archive.today) 1. **[^](#cite_ref-8)** Scott Mueller, Brian Knittel (2008). *Upgrading and Repairing Microsoft Windows, Second Edition*, page 685. Pearson Education Inc. [ISBN](/source/ISBN_(identifier)) [978-0-7897-3695-6](https://en.wikipedia.org/wiki/Special:BookSources/978-0-7897-3695-6) 1. **[^](#cite_ref-PhotoRec_9-0)** [How PhotoRec works](http://www.cgsecurity.org/wiki/PhotoRec#How_PhotoRec_works) (Description from the author website). 1. **[^](#cite_ref-10)** ["PhotoRec - CGSecurity"](http://www.cgsecurity.org/wiki/PhotoRec). Retrieved March 1, 2013. 1. **[^](#cite_ref-11)** ["GParted -- Live CD/USB/PXE/HD"](https://gparted.sourceforge.net/livecd.php). Retrieved March 1, 2013. 1. **[^](#cite_ref-12)** ["programs – Parted Magic"](https://web.archive.org/web/20110102154349/http://partedmagic.com/doku.php?id=programs#.UTDEoT4-jbU). Archived from [the original](https://partedmagic.com/doku.php?id=programs#.UTDEoT4-jbU) on January 2, 2011. Retrieved March 1, 2013. 1. **[^](#cite_ref-13)** ["Recover file with PhotoRec"](https://web.archive.org/web/20130502052914/http://wiki.slaxlfi.fr/doku.php?id=recuperation:recuperer_des_fichiers_avec_photorec). Archived from [the original](http://wiki.slaxlfi.fr/doku.php?id=recuperation:recuperer_des_fichiers_avec_photorec) on May 2, 2013. Retrieved March 1, 2013. 1. **[^](#cite_ref-14)** ["System-tools - SystemRescueCd"](http://www.sysresccd.org/System-tools). Retrieved March 1, 2013. 1. **[^](#cite_ref-15)** ["Software Ubuntu Rescue Remix"](https://web.archive.org/web/20130123212330/http://ubuntu-rescue-remix.org/Software). Archived from [the original](http://ubuntu-rescue-remix.org/Software) on 2013-01-23. Retrieved March 1, 2013. 1. **[^](#cite_ref-ALT_Linux_16-0)** ["TestDisk on ALT Linux"](https://web.archive.org/web/20110811093212/http://alt.linux.kiev.ua/srpm/testdisk/get). Archived from [the original](http://alt.linux.kiev.ua/srpm/testdisk/get) on 2011-08-11. Retrieved 2011-05-25. 1. **[^](#cite_ref-Arch_Linux_17-0)** [ArchLinux Extra Repository](https://www.archlinux.org/packages/?q=testdisk) 1. **[^](#cite_ref-Debian_contrib_18-0)** [TestDisk on Debian](http://ftp.debian.org/debian/pool/main/t/testdisk/) 1. **[^](#cite_ref-Fedora_Extras_19-0)** [TestDisk in Fedora](http://download.fedora.redhat.com/pub/fedora/linux/releases/) [Archived](https://web.archive.org/web/20110310080333/http://download.fedora.redhat.com/pub/fedora/linux/releases/) 2011-03-10 at the [Wayback Machine](/source/Wayback_Machine) 1. **[^](#cite_ref-RedHat_Epel_20-0)** ["RepoView: "Fedora EPEL 6 - x86_64""](https://web.archive.org/web/20150913070321/https://dl.fedoraproject.org/pub/epel/6/x86_64/repoview/testdisk.html). Archived from [the original](https://dl.fedoraproject.org/pub/epel/6/x86_64/repoview/testdisk.html) on 2015-09-13. Retrieved 27 July 2013. 1. **[^](#cite_ref-FreeBSD_ports_21-0)** [TestDisk in FreeBSD ports](http://www.freshports.org/sysutils/testdisk/) 1. **[^](#cite_ref-OpenBSD_ports_22-0)** [TestDisk in OpenBSD ports](http://ports.su/sysutils/testdisk) 1. **[^](#cite_ref-Gentoo_23-0)** [TestDisk in Gentoo](http://packages.gentoo.org/package/app-admin/testdisk) 1. **[^](#cite_ref-Gentoo_Portage_24-0)** [TestDisk in Gentoo Portage](https://web.archive.org/web/20110607004725/http://www.gentoo-portage.com/app-admin/testdisk) 1. **[^](#cite_ref-Source_Mage_25-0)** [TestDisk in Source Mage](http://distro.ibiblio.org/pub/linux/distributions/sourcemage/codex/test/disk/testdisk/) [Archived](https://web.archive.org/web/20110519140907/http://distro.ibiblio.org/pub/linux/distributions/sourcemage/codex/test/disk/testdisk/) 2011-05-19 at the [Wayback Machine](/source/Wayback_Machine) 1. **[^](#cite_ref-technicalmamas_26-0)** ["Delete Hui Photo Waapas Kese Laaye || डिलीट हुई फ़ोटो वापस कैसे लाए 2 मिनट में ?"](https://web.archive.org/web/20190608041613/https://www.technicalmamas.com/2019/06/how-to-get-deleted-photos-back.html). Archived from [the original](https://www.technicalmamas.com/2019/06/how-to-get-deleted-photos-back.html) on 2019-06-08. Retrieved 2019-06-08. ## External links - [Official website](https://www.cgsecurity.org/wiki/PhotoRec) --- Adapted from the Wikipedia article [PhotoRec](https://en.wikipedia.org/wiki/PhotoRec) by Wikipedia contributors ([contributor history](https://en.wikipedia.org/wiki/PhotoRec?action=history)). Available under [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). Changes may have been made.