Episode: 656
Title: HPR0656: My first steps in recovering pictures
Source: https://hub.hackerpublicradio.org/ccdn.php?filename=/eps/hpr0656/hpr0656.mp3
Transcribed: 2025-10-08 00:28:45

---

Hmm.
Welcome to HDR, my name is Sven and this is my very first podcast.
So a disclaimer up front maybe, I'm not in the studio or anything, cats are wondering
around here, a lot of wind outside so you could have some background noises.
Sorry for that guys, bear with me.
So the subject, I would like to talk to you about my first steps into data recovery.
It's not much but at least it gives you guys a head start and saves you some googling.
So the other day, a friend of mine dropped in with a broken laptop and a broken disk in it
obviously, with one big question, if I could recover some data and will most notably
her pictures from the trashed disk.
I never attempted something like that before, but she had nothing at that point, so what
was worse than nothing, nothing right?
So I started googling to find some procedure on how to proceed.
I stumbled upon parted magic, DD Rescue and Photorec.
I'm sure there are plenty of tools to choose from, but this is what I used.
If you guys have some knowledge about other stuff, please let me know with all your other
greatly appreciated feedback of course.
But I'm ahead of things, so recovery.
The first thing you want to do is get as much data from your broken disk as possible and
well as quickly as you can of course.
For that, we're going to use DD Rescue.
It's like the ordinary DD, but it's more resilient when it comes to reading errors.
It also has some fancy switches to tackle all of that, like direct access, so disabling
the cache.
You can read in different directions, it's automatically scales down the block size when
it encounters problems, fancy stuff.
You can interrupt DD Rescue and resume at some other time, because when it processes it
writes a log file in the meantime, along with the image, so it knows exactly where it stopped
if you choose to interrupt it and you can just resume it where it left off.
I took a peek on their website and chose to do the recovery in two steps, or well, to
get an image in two steps, that is.
First, a quick sweep, in fact, with as target all the good blocks, so you start with getting
as much good data out of it as possible, then a second sweep, which is going to search
for recoverable data in the bad sectors.
After that, you have a nice looking image, or at least on the outside, that is.
And from then on, you can unleash all these fancy tools to get your data or your files
out of it.
Beware that it takes a lot of time to get the image, well, depending on how much damage
you have to bypass, of course, or well, you have to find your way through that is.
In my particular case, it took two weeks and a half to complete the second pass.
But you can, of course, always interrupt the process before you completely finish and
have a look already.
Just make sure that you have a lot of this space so you can make a copy of your image first.
So you always have a backup when something goes wrong, when you're filling around with
all kinds of utilities in an attempt to get your data out.
In my particular case, I could already stop and call it day because I was already able
to mount the disk or the image that is without serious problems.
It was not a clean mount, but I could mount it so I could get the pictures out of it,
or at least most of them.
At that point, my friend was already very, very happy with the results, but well, I wanted
to continue some more and have a go with photo rack.
It's short for photo recovery, and the new thing about this is that it doesn't need an
actual file system.
It can work on severely damaged file systems or well, unmountable file systems, because
it goes looking for the file signatures in the data.
It doesn't care about NTFS or extended whatever.
It just goes through the data stream and tries to locate the files.
It points to pictures, but don't worry, it also recovers other files like Word documents,
for example, but there are a lot of identifiable file types, it recognizes, so if you want something
recovered, go and have a look, it could be in there as well.
Two simple tools and you already have a lot of data back, or well, maybe not simple
tools, but easy to use, that's for sure.
So while it's part of magic, it's just that I wasn't really willing to give up my machine
for the recovery for days, weeks, well, I didn't know up front, of course, so no, I figured
I used this broken laptop to recover its own data.
That's where a live distro, like part of magic, is really nice, all the tools included
and you just booted up with standard options.
It loads everything into RAM, so you get yourself a really quiet system, which can just sit
in a corner and well, you just wait, so that's what I did, so that's it.
You take yourself a broken disk, a lot of time, a lot of this space, and some good tools
like photorec file system checkers, or whatever might cross your path.
So thanks for listening, maybe until next time, who knows, I'll put some links in the
show notes, and feedback is of course greatly appreciated, send it to Sven at noblanks.org.
See you, bye.
Thank you for listening to HACRA Public Radio, HPR is sponsored by Carol.net, so head on over
to C-A-R-O dot N-E-C for all of us in need.
Thank you very much for listening to HACRA Public Radio, and I'll see you in the next video.
