The most important thing to remember about hard disks is that they will fail. Often, they will do it without warning. So you must make back ups and keep them current.

Recently, I had a drive fail with excessive bad sectors. It happened after I had moved a new set of photos off my memory card, but before I had copied the files to my backup drive. The bad sectors corrupted the directory structure on the drive, but I doubted the actual file data was effected. It was time for a PhotoRec recovery.

PhotoRec is a program that will scan a hard disk or disk image for the “signature” of a wide range of file types. The current version is available from: http://www.cgsecurity.org/wiki/PhotoRec. The software will locate files, and copy them to a different hard disk. Files will be randomly named, and placed in successive directories with a recup_dir.### naming convention. Sadly, filenames and directory structure cannot be retrieved with this method.

An issue you will run into is: The software will find all files on the drive. There is no way to detect specific files. So, the software must recover everything including temporary files and even previously deleted files. In my case, it was going to be interesting since I had over 50,000 photos from my DSLR on the drive, plus the backup data of a few friends. I needed to recover about 400 photos, but to do so, I’d need to sort through many more files.

I did this in Windows XP, but similar methods can be used in later Windows versions and other operating systems. The  method I used to re-organize recovered photos is to first delete the small temporary files found, delete the duplicates, then rename/move the remaining files based on the stored EXIF data.

Step by Step:

  1. Navigate to the directory/folder where you stored the recovered files.
  2. Press F3 to open the Windows Search panel.
  3. Click on All files and folders.
  4. Under the What size is it? option field, select Small (less than 100 KB). In my experience about half of the files found are temporary Internet/cache files. Rather than waste our time with them, we will delete them straight off. (If you are sure of the file sizes you want to keep, feel free to select a different size option.)
  5. Click Search to begin a search for small files. 
  6. Once the search is complete, select at most 10,000 files and delete them. (It is possible to delete all files at one time, but you will experience extremely long waits for the system to catch up.)
    1. Click on the first file. Watch out! All folders will be listed also. Do not delete them.
    2. Hold the shift key.
    3. Hold the page down key until roughly 10,000 files are selected. Look in the bottom left of the Window, if the status bar is enabled, to see the file count.
    4. While still holding the shift key, press the delete key to directly delete all selected files.
    5. Repeat until no small files exist.
  7. Download and install Duplicate Cleaner from: http://www.digitalvolcano.co.uk/content/duplicate-cleaner (There are many software packages that perform duplicate deletion, but I like the ease of use of this one.)
  8. Run Duplicate Cleaner, select your recovery directory for the Search Path, and click Go.
  9. Once the software has completed the search, if any duplicates are found, click on the Selection Assistant button.
  10. Within the field titled Select for deletion by group, click the Select button, then the Close button.
  11. At this point, I often go and double check the found duplicate files.
  12. If they look correct, click the Remove Selected button. If not, check the Duplicate Cleaner documentation.
  13. The Delete, Move, or Hardlink Files window will come up. I suggest you click the Delete Files button, but that is up to you. If you aren’t sure about the duplicates, then use the Move to Folder option.
  14. Once the duplicates have been moved/deleted, close the Duplicate Cleaner software.
  15. Download and install AmoK Exif Sorter from: http://www.amok.am/en/freeware/amok_exif_sorter/ (I like the program, although it seems to freeze up when given a directory containing more than 20,000 files at one time.)
  16. Run AmoK Exif Sorter.
  17. Click File->Add Directory and select your file recovery directory. Wait for the software to process a search all files.
  18. I recommend you click Move as your Sort method, otherwise you are going to make a whole other set of duplicate files.
  19. In the Target directory field select a target directory to move the files to.
  20. The Directory and Filename fields allow you to adjust the resulting directory structure and file names. The file’s EXIF data can be used in any field. I prefer to remove the day from the directory structure, but that is up to you. 5. If you have more files than AmoK Exif Sorter can quickly process, break apart the directories in your recovery directory. Move groups containing less than 20,000 files to sub-directories. 6. I was only looking for large images from a particular camera, so I used the Make EXIF data in the directory structure, to weed out all unneccesary files.
  21. When you’ve set the options to your satisfaction, click Start to begin the renaming and moving process.

There are many ways to rename and move files recovered with PhotoRec. This is just one method. Previously, I have used the Ubuntu shell and cygwin, but this was the most convenient method at the time.

Comments

(Statically copied from previous site)

Luis Fernandez replied on May 14, 2012 - 2:05am

I have just made a script for sorting Photorec results in order to help to found what you are interested on recover or simply to improve the delivery of your data recovery work to your customers.

You can download it in my website: http://system-tricks.com/index.php/datarecovery/sort-testdisk-photorec-d…

Hope it is useful to you.

newrecover replied on October 8, 2013 - 4:58pm

I found Unique Filer to work better than Duplicate Cleaner. Dupe Cleaner now has limits on pro version that makes it harder to compare images visually. Unique filer allows you to easily compare images visually.

Rodger Dodger replied on January 29, 2014 - 2:55pm

Photorec does have options to only recover a few types of files (and I think I remember it had that option back in 2011 too) like only jpg, or photoshop, or one out of dozens of different types of files it can recover. It’s under it’s FileOpt option right before pressing search. Should cut way down on the types of files you probably don’t want that OS’s have thousdands of.

ps. Is this post really from 2011? WinXP? Not 2001? :)

brad replied on February 8, 2014 - 7:41am

Yes, really 2011. :P I now dual boot Linux Mint and Win7 on that computer, but at the time I had the same working XP install for six years. I had work to do, no reason to rebuild the OS.

I was limiting PhotoRec’s search to only a few file types, but since your browser(s) cache website images you’ll find all of those also during recovery.