Score:-1

PhotoRec outputs mostly text files in Ubuntu data recovery

cf flag

Last night I discovered that Ubuntu 20.04 had deleted most of the contents of one of my folders, about 50GB worth. I tried to recover them using PhotoRec, but most of what is output so far is text files, on the order of 900K of them. That is emphatically not what was originally in that folder. Some other formats, in the low thousands by number, are also being recovered, but many so far are not openable.

  1. Is the immense number of txt files normal? Does it indicate the process is failing somehow?

  2. Can the txt files be reprocessed into their original format if they are misrecovered files of some other type?

  3. If PhotoRec cannot complete this task correctly, is there an alternative which can?

  4. If there is an alternative, what would it be processing, the output .txt files or something else?

  5. In general, should I proceed with this or just let the data go and move forward? What would you do?

karel avatar
sa flag
PhotoRec recovered many hidden files maybe?
us flag
You should state in the question which type of files you were expecting to recover
Score:0
us flag

Depending on what types of files you wanted to recover, Photorec may not be your best recovery option in a case like this where your filesystem and device is still fine, and you just want to recover accidentally deleted files.

Photorec is a tool that, at its most basic level, works on the assumption that all information about the file system structure may be gone, and all it can do is find meaningful fragments of data in the partition that resemble files.

Thus, what it does is scan through the partition, a sector at a time (in almost all cases a filesystem cluster should start on a sector boundary even if it is more than one sector in size), and looks for signatures ("magic numbers") which would indicate the start of a particular type of file. When it finds one, it uses its knowledge of the structure of that type of file to estimate where the file ends.

Text files have no well defined header structure (except that their contents look like text, eg they avoid null bytes, bytes over 0xf7 and bytes below 0x20 apart from carriage returns, line feeds and tabs). This may lead to a lot of segments within files being misidentified as plain text files, so if you have text file identification turned on in Photorec it may result in a lot of false positives.

Photorec should be able to identify video, audio and image files in the partition, and in the case that the files aren't fragmented, will be able to recover the whole file. This is where it excels.

Because of the way it operates, Photorec typically can't recover the filename or folder structure of the files it finds.

There is an accompanying program to Photorec called Testdisk which is also a data recovery program, but operates at the filesystem level - that is, if you accidentally delete a partition, it will search through your device and find partitions and recover them whole - which would allow recovery of all data.

The best solution in your case, however, would be to have had backups of the lost files and restore them from backup. Second to that, however, would be to try some recovery tools specific to the filesystem you are using, that may have some better luck identifying file and folder structure of the deleted files. The ability to do this varies by filesystem, with the ability to recover intentionally deleted files seen as a possible security issue depending how you look at it.

For ext4 (and ext3), not much useful information is kept about deleted files, so in some cases you need to resort to something like Photorec. However, some people have luck recovering recently deleted files from the filesystem journal using ext4magic, the manpage of which is here

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.