Lose important photos, videos or documents Accidental deletion, a quick format, or a memory card failure is more common than you might think. When it happens, the shock is significant, and the feeling that you've lost everything forever is quite overwhelming, but in many cases, there's still a chance to recover a good portion of that data.
Among the most powerful and well-known tools For this task, PhotoRec and Recuva stand out, two programs capable of scanning hard drives, USB drives, or SD cards and recovering deleted files. PhotoRec is free and open source, works on almost any operating system, and focuses on deep recovery; Recuva, on the other hand, offers a more user-friendly graphical interface on Windows and can also be a good lifesaver for less experienced users.
What is PhotoRec and what makes it different?
PhotoRec is data recovery software Specializing in locating and restoring lost files on all types of media: hard drives, SSDs, CD-ROMs, camera memory cards, MP3 players, USB drives, etc. Although its name might suggest it's only for photos, it can actually recover more than 180 different file types organized into about 100 families (more than 480 recognized extensions, including Office documents, PDFs, ZIPs, videos, and audio files).
The key to PhotoRec is that it completely ignores the file system. It focuses directly on the data on the disk. This means it can work even when the partition is severely damaged, the partition table is corrupted, or the drive has been reformatted. Instead of reading the logical system structure (folders, filenames, etc.), it scans sector by sector for known file signatures.
Another important feature is that it always works in read-only mode. PhotoRec never writes to the source disk or memory. This reduces the risk of overwriting potentially recoverable data. All recovered files are saved to a different location that you choose when starting the process.
PhotoRec is distributed as free and cross-platform software. Licensed under the GNU GPL v2+ license, it is downloaded alongside TestDisk, a sister tool designed to recover lost partitions and make damaged disks bootable again. This combination makes it a very powerful solution for both advanced home users and administrators who frequently deal with problematic disks.
On what operating systems and media does PhotoRec work?
One of the great advantages of PhotoRec is its enormous compatibilityThe program is available for virtually all common desktop operating systems, and can also be compiled on most Unix variants, making it especially flexible in technical environments.
Operating systems officially supported by PhotoRec (in their various versions) include:
- DOS and Windows 9x
- Windows NT 4, 2000, XP, 2003 and later versions such as Vista, 7, 8, 8.1, 10, as well as Windows Server 2003, 2008, 2012, 2016
- Linux in multiple distributions
- FreeBSD, NetBSD and OpenBSD
- Sun Solaris
- Mac OS X / macOS
In terms of physical media, PhotoRec works with almost everything that's usual. In everyday use: mechanical hard drives (HDD), solid state drives (SSD) viewed as disks, CD-ROM, Compact Flash cards, Memory Stick, SecureDigital/SD, SmartMedia, Microdrive, MMC, USB flash drives, raw disk images, and even EnCase E01 forensic images.
The program has been successfully tested on a wide variety of portable devices.including iPods and numerous digital cameras from brands such as Canon (EOS 300D, 10D), HP (PhotoSmart 620, 850, 935), Nikon (CoolPix 775, 950, 5700), Olympus (C350N, C860L, Mju 400 Digital, Stylus 300), Sony (Alpha DSLR, DSC-P9), Praktica (DCZ-3.4), and Casio (Exilim EX-Z 750), among others. In practice, if the system sees the device as a storage unit, PhotoRec can usually work with it, and guides exist for Retrieve videos on Android.
At the file system level, PhotoRec can recover data from the most common formatsFAT, exFAT, NTFS, ext2, ext3, ext4, and HFS+. This is all done without relying on the logical structure of these systems, but rather on a direct inspection of the physical blocks. The major exception is ReiserFS, which incorporates specific optimizations (data inclusion in tree nodes, special handling of small files, etc.) that prevent PhotoRec from handling it correctly.
How PhotoRec works on the inside
To understand why PhotoRec can recover data even from severely damaged disks It's worth briefly reviewing how the most common file systems (FAT, NTFS, ext2/3/4, HFS+) store information. They all store data in fixed-size blocks or clusters, defined during formatting. Typically, the operating system attempts to place the blocks of the same file contiguously to reduce fragmentation and improve performance.
When you delete a file, what is usually deleted is not the data itself.but rather the control information: name, location of the first block, size, status (busy/free), etc. In systems like ext2/ext3, for example, the name can remain for a while, but the pointer to the first block is lost. The space where the data was located is then considered free, and the system can reuse it at any time for other files.
PhotoRec starts by trying to determine the block or cluster size. from the drive it's analyzing. If the file system isn't completely corrupted, it will read that value from the superblock (in ext2/3/4) or the Volume Boot Record (in FAT and NTFS). If that information isn't reliable, it resorts to a more basic technique: it examines the volume sector by sector, looking for the first recognizable files and, based on their distribution, calculates the most probable block size.
Once it knows the block size, PhotoRec traverses the volume block by block.The tool compares the contents of each block to an internal database of file signatures. Each file type has one or more characteristic headers that identify it; for example, a JPEG might start with sequences like 0xff,0xd8,0xff,0xe0 or 0xff,0xd8,0xff,0xe1. When the tool finds one of these signatures, it assumes it has located the beginning of a file and starts copying the following blocks to a new file.
If during recovery you encounter the signature of another filePhotoRec attempts to close the current file (verifying, if possible, the internal consistency of the format) and creates a new file for the second detected signature. In formats with a header that indicates the size (many documents, images, etc.), it can trim the recovered file to the length specified by that header, discarding any excess data that doesn't fit.
In the case of continuous data streams such as MP3sSince files don't have a fixed size defined in the header, PhotoRec uses the internal structure of the stream itself as a guide and stops reading when it detects that it has reached the end of a valid sequence. If the recovered file turns out to be smaller than it should be according to its header, the program discards it to avoid delivering corrupted, worthless files.
To improve the recovery of fragmented filesEach time PhotoRec successfully completes a file, it checks the previous blocks for signatures that didn't result in a valid recovery at the time (for example, because the file was too small). If, with more context, it now sees that the file could be reconstructed, it tries again. Thanks to this behavior, it can recover some files that aren't completely contiguous on disk.
PhotoRec installation and first run
PhotoRec does not usually require complex installationIn many cases, simply download the package that includes TestDisk and PhotoRec for your system, extract it to a folder, and run the corresponding binary. On Windows, for example, you'll find a file like photorec_win.exe that you can open with a double-click; on Linux and macOS, the console version is usually used directly from the terminal.
On Linux distributions based on Debian or UbuntuThe easiest way is to install the testdisk package from the official repositories. This also adds PhotoRec. Then, simply open a terminal and run the command:
sudo photorec
When the program is launched, a text-mode interface opens. You'll have to navigate using the keyboard (arrow keys, Enter, specific letters depending on the option). Although it might seem a bit basic at first glance, with a few pointers anyone can use it without too much trouble. However, it's not your typical window with buttons and a mouse, so you need to carefully read what appears on the screen.
On Windows, if you use a system like Windows 7 or laterIt is recommended to run photorec_win.exe as administrator (right-click → "Run as administrator") to ensure that the program can smoothly access all the drives you need to analyze, especially if they are internal disks.
First steps: choosing disk, partition and file types
As soon as PhotoRec starts, the tool displays the list of disks and memory. that the system has connected: internal hard drives, SSDs, USB drives, memory cards, etc. To select the device you want to work with, move with the up/down arrows and press Enter when you have selected the correct drive.
It is essential to correctly identify the drive from which you want to recover The data. You can use either the disk size or the model number next to the name as a guide (for example, a Kingston DataTraveler in the case of a USB drive). If you choose the wrong drive, you'll be wasting your time or, worse, you could end up filling it with unnecessarily recovered files.
After choosing the disk, PhotoRec will ask you about the partition table type.On PCs, the usual option is "Intel/PC partition" for disks formatted as MBR or GPT, but it also offers other options: EFI GPT, Mac (Apple partition map), None (unpartitioned media), Sun (Sun Solaris), or Xbox. On a typical USB drive formatted in FAT32, for example, you would normally select "Intel" and continue.
In the next step you will see the list of disk partitions You'll need to select the partition where the deleted files were located. If your case is simple, there's probably only one partition. If you want the program to scan the entire disk (for example, when the partition table is damaged), you can choose the "no partition" or "non-partitioned media" option to force a global scan.
Several additional options appear at the bottom of the screen. such as "File Opt," "Search," "Options," or "Quit." If you go into "File Opt," you can choose which file types you want to recover. By default, PhotoRec has many formats selected; if you want to focus on a specific one (for example, only JPG photos), it's a good idea to deselect them all by pressing the "s" key and then select only the desired extensions using the spacebar. Save the changes with the "b" key and go back.
The list of supported types is very extensiveFrom JPG, BMP, GIF, TIFF, or PSD images to MOV/MP4/3GP videos, MP3 audio, ZIP, GZ, or TAR compressed files, DOC, XLS, PPT, and PDF documents, MDB or SQL databases, EXE executables, BKF backup files, ISO images, emails from certain clients, Windows logs, etc. Filtering reduces noise and makes subsequent review more manageable.
Advanced options and expert mode
PhotoRec includes an advanced options sectionThis is accessible from "Options" at the bottom of the interface. There you can adjust various parameters designed for users who need to get the most out of the tool and know exactly what they're doing.
Among the available options are parameters such as:
- Paranoid: a kind of brute-force mode that attempts to be even more thorough in reconstructing files, at the cost of more analysis time.
- Allow partial last cylinder: allows the program to work with the last cylinder even if it is not complete according to the classic geometry of the disk.
- Expert mode: activates the so-called "expert mode", which unlocks additional advanced settings such as disk geometry or manual block size.
- low-memoryDesigned for systems with little RAM, it reduces power consumption at the cost of some performance.
If you activate expert mode, a new menu called "Geometry" appears. where you could manually alter values ​​such as the number of cylinders, heads, sectors per track, or sector size. In most home scenarios, you don't need to touch anything here; it only makes sense if you know exactly what you're doing and need to adjust the device's detection for a very specific reason.
Upon returning to the partition's main menu and selecting "Search"PhotoRec will ask you to specify the file system type: you'll usually have to choose between "ext2/ext3/ext4" or "Other (FAT/NTFS/HFS+/ReiserFS)." This doesn't affect the fact that it ignores the logical structure, but rather minor details of how it interprets free space, blocks, and other internal parameters.
In expert mode, just before starting the scan You may be asked some additional questions, such as whether you want to attempt to "unformat" a FAT partition (an attempt to recover data after formatting), what exact block size you want to use, or from what offset to start the analysis. If you're unsure, it's best to accept the default values ​​suggested by the tool.
Choose the area to scan and the destination folder
Another important point is deciding whether you're going to scan only the free space or the entire partitionPhotoRec usually offers two clear options:
- FreeThis method searches for files only in the space the system marks as free (unallocated). It's faster and, if the deleted data hasn't been overwritten, it's usually sufficient.
- WholeThis analyzes the entire partition, including both used and free space. It's slower, but can be useful if the file system is severely corrupted or you suspect serious errors.
As a general rule, it makes sense to start by trying Free.Especially in large units, to save time. If you can't find what you're looking for or suspect the system is badly compromised, then you can repeat the process, selecting Whole, and be patient.
PhotoRec then asks you to choose the folder where you want to save the recovered files.This is critical: you should never select the same partition as the destination from which you are trying to recover data. Doing so could cause the recovery process itself to overwrite sectors that still contain useful information.
You must navigate through the directory tree using the arrow keys.Enter subfolders by pressing Enter and going up one level by selecting "..". Once you have selected the desired folder (ideally on a different physical drive or, at least, a different partition), confirm by pressing the key indicated by the program, usually "y" or "C" depending on the version. The scanning and copying of found files will then begin.
During the process you will see on screen The current sector, the total number of sectors to be analyzed, the elapsed time, an estimate of the remaining time, and a counter of files recovered by type are displayed. If you need to stop the search early, simply press Enter or the key labeled "Stop." Everything recovered up to that point will be saved in the destination folder.
What happens to the original names and folders?
One of the points that most confuses those who use PhotoRec for the first time The problem is that the recovered files don't retain their original names or folder structure. Instead, the program creates numbered directories (recup_dir.1, recup_dir.2, etc.) and generates generic names like f1234567.jpg, based solely on the order and type of files it finds.
This is not a flaw or a one-off limitation, but a direct consequence of how it worksPhotoRec doesn't rely on the system's file system table, but rather on the raw data signatures stored on the disk. Since file metadata (name, original path, permissions, etc.) is usually the first thing lost when a file is deleted, the program simply has no reliable way to reconstruct that information.
The advantage of this approach is that it allows data recovery even in extreme situations. (formatted partitions, unrecoverable file systems, etc.), but the downside is that you then have to manually review what it has recovered to locate what you're actually interested in. On very large volumes with many files, this can be quite laborious.
If what you need is to maintain the original folder structure and namesPhotoRec is not the ideal tool by design. In such cases, it is usually better to use programs that do read the logical structure of the partition (MFT in NTFS, directory tree, etc.), such as Recuva, R-Studio, Disk Drill, or other commercial software that attempts to reconstruct complete hierarchies as long as the file table is not completely destroyed.
What level of effectiveness can PhotoRec offer?
The success rate of PhotoRec varies greatly depending on the situationThere is no 100% guarantee with this or any other tool, but several factors can be identified that directly influence the probabilities:
- Type of fileAlthough PhotoRec initially focused on photographs, it now recognizes over 480 different file extensions. It is especially effective with images, videos, and other multimedia files in common formats, but it also handles Office documents, PDFs, ZIP files, and more.
- File system and drive statusIt works very well on FAT, NTFS, exFAT, ext2/3/4, and HFS+. If the file system is severely damaged, its signature-based approach can make all the difference. On disks with physical damage or serious bad sectors, its capacity is limited by the hardware itself.
- Data overwritingIf you continued using the drive after deleting the files (saving new photos, copying files, installing software, etc.), it's likely that some of those blocks were overwritten. Once that happens, the previous contents are irreversibly lost to all software.
- Formatting and reformattingAfter a quick format, there's usually still a fair amount of time left to recover some data. However, if you've performed repeated full or low-level formats, the chances plummet, and it can become virtually impossible to salvage anything useful.
- Physical damagePhotoRec cannot repair discs with mechanical problems, electronic failures, damaged heads, etc. In those cases, only a specialized laboratory that opens the disc in a cleanroom and performs a physical extraction can attempt anything.
- FragmentationWhen files are heavily fragmented on disk, reconstructing them completely is much more difficult. PhotoRec has some mechanisms for recovering scattered fragments, but it's not foolproof, and sometimes you'll end up with corrupted or incomplete files.
Under reasonable conditions (recent deletion and little subsequent use of the drive)PhotoRec can recover a surprising amount of data. But it's not magic: the longer the time and the more activity has passed since the deletion, the lower the success rate. Therefore, it's best to immediately stop using the affected device and, if possible, work on a cloned image of the disk instead of the original.
Frequently Asked Questions about PhotoRec
Can PhotoRec recover data from a physically damaged disk? No. If the problem is physical (strange noises from the disk, completely unreadable sectors, mechanical failure, burned-out electronics, etc.), no software will fix it. PhotoRec can only work when the operating system is still able to read, even partially, the logical contents of the drive. In the case of serious physical damage and truly important data, the sensible thing to do is to use a professional data recovery service.
Is it possible to recover files from disks that have been formatted multiple times? With each format, the chances of recovery decrease, especially with full formats that rewrite sectors. PhotoRec might recover something if the formats were quick and the area containing the data wasn't overwritten, but in many cases, recovery becomes very difficult or simply impossible.
Does PhotoRec work on encrypted drives? You can only recover anything if the volume is decrypted at the time of the scan—that is, if you entered the key or disabled encryption. If the disk is fully encrypted and PhotoRec doesn't have access to the decrypted data, all it will see is a block of random data without any recognizable signature.
What happens if the recovery process is interrupted? If you stop the scan midway, PhotoRec simply stops searching for more files, but it keeps all the ones it has already saved in the destination folder. Later, you can run the program again and repeat the scan; however, since the original scan wasn't completed, some potentially recoverable files might not have been detected.
Does PhotoRec recover the original names? No. As already mentioned, the program works directly on the underlying data and not on the directory structure, so it only generates generic names based on order and type (for example, f1698453.jpg). The organization into numbered folders, recup_dir.xxx, also bears no relation to the original hierarchy.
Is it safe to use PhotoRec on a disk with critical information? Yes, as long as you respect the golden rule of not writing anything to the source disk. PhotoRec accesses the disk in read-only mode, so it won't modify the contents of the drive you're trying to recover. To further minimize risks, many technicians first create a full disk image (a sector-by-sector clone) and always work on that copy, leaving the original untouched only as a last resort.
Recuva and other alternatives to PhotoRec
Although PhotoRec is very powerful, it won't always be the most convenient tool.Especially if you're not comfortable with text-based interfaces or if you need to maintain your folder structure. Luckily, there are several alternatives with different approaches that can complement it or serve as a backup plan if PhotoRec doesn't meet your needs.
EaseUS Data Recovery Wizard is a commercial solution It offers a limited free version and a more comprehensive paid version. In exchange for payment, it provides a polished interface, step-by-step guides, and advanced features for recovering deleted files, lost partitions, data after operating system crashes, malware attacks, and more. It allows you to preview what can be recovered before paying, helping you decide if the investment is worthwhile.
Disk Drill is another well-known option, available for Windows and macOS.It combines a modern interface with fast and in-depth analysis algorithms, and also offers backup and data protection features. Its free version allows you to scan and recover a limited amount of data, enough to check if the files you need are there before considering purchasing a license.
TestDisk, from the same author as PhotoRec, has a different approachThis tool is designed to recover partitions and make bootable disks that have become inaccessible due to damage to the partition table or boot sector. While it can also help copy files from damaged partitions, its primary purpose is not so much to recover individual files as to save the disk's structure and restore it to working order.
There are also many other tools on the market such as R-Studio, GetDataBack, PC Inspector, FlashPhoenix, MediaRecover, and many others, usually paid services, that offer highly advanced solutions for professional environments. Some are especially powerful for RAID recovery, others for forensic environments, and so on. Choosing one or the other depends on the level of data criticality, the available budget, and whether the problem is logical or physical.
Ideally, in a complicated home scenario, you should combine several programs.Try free solutions like PhotoRec or Recuva first, and if neither works and the data is truly valuable, consider upgrading to professional software or even a specialized lab service. Each tool can find files that another misses, so it's worth trying more than one.
In short, recovering deleted files with PhotoRec, Recuva, and similar services It's a race against time and against data overwriting; if you react quickly, stop using the affected device and apply these tools in a certain order, the chances of saving important photos, documents or videos are higher than you might think.
