If you have accidentally deleted photos, documents, or videos and are looking for how to recover your files, PhotoRec is one of the most powerful free tools which you can use. It doesn't have a pretty interface, nor does it need one: it gets straight to the point and is capable of extracting data from hard drives, USB drives, SD cards, and even from a RAM image in many cases where you thought all was lost.
In the following lines you will find a A very comprehensive guide to understanding what PhotoRec is and how it works internally.It explains in what situations it can save your life, how to use it step by step on Windows and Linux, its limitations, when it won't be useful, and what alternatives exist when you need something simpler or with a graphical interface. Everything is explained in standard Spanish (from Spain), with examples and without unnecessary technical jargon, but without leaving out the more technical aspects if you like to delve deeper.
What is PhotoRec and what exactly is it used for?
PhotoRec is a Free, open-source, and cross-platform data recovery program Designed to recover lost files from all types of storage media. Although its name refers to photos, it actually specializes in recovering a huge variety of formats: images, videos, office documents, compressed files, executables, and much more.
Unlike other commercial solutions, PhotoRec It does not focus on the file system, but on the data itself that is recorded on the disk.This means it can work even when the partition is severely damaged, the partition table is corrupted, or the disk has been formatted. As long as the physical sectors remain readable and haven't been overwritten, there's a real chance of recovering data.
The project is distributed under license. GNU GPL v2+This allows you to use it for free, study its code, adapt it, and improve it. PhotoRec is usually distributed alongside TestDisk, another utility from the same author geared towards... Recover partitions and make bootable disks that have stopped bootingThe usual practice is to download the TestDisk & PhotoRec package together and have both tools on hand.
To protect your data, PhotoRec works on read-only mode on the source disk or memoryThis minimizes the risk that the recovery process itself will worsen the situation, which is crucial when you're on the brink and every sector counts.
Operating systems compatible with PhotoRec
One of the great advantages of this utility is that It works on virtually any modern operating system.It's not limited to a specific environment, so you can use it on almost any machine you have nearby.
Officially, PhotoRec can be run on:
- DOS and Windows 9x
- Windows NT 4, 2000, XP, 2003 and later versions such as Windows 7, 8, 10 and 11
- Linux (with kernel 2.6.18 or higher, both x86 and 64-bit)
- FreeBSD, NetBSD and OpenBSD
- Sun Solaris
- MacOS (both in older architectures like Intel, and even PowerPC in earlier versions)
Furthermore, the source code can be compiled in virtually any Unix-like systemThere are also specific builds for certain ARM-based NAS devices, such as some Synology, QNAP, and Seagate BlackArmor models. If you work with servers or network storage devices, having PhotoRec available directly on the NAS is a real peace of mind.
File systems and media types it supports
One of the keys to PhotoRec's success is that It almost completely ignores the logical structure of the file system.Instead of relying on partition information, it scans the device at a low level and looks for file signatures directly in the data blocks.
Thanks to this approach, you can recover information from formatted media or severely damaged file systems, provided the surface is readable. Systems it works particularly well with include:
- FAT (FAT12, FAT16, FAT32)
- NTFS
- exFAT
- ext2, ext3 and ext4
- HFS + (classic in older macOS versions)
In the case of ReiserFS, this system incorporates very specific optimizations in how it saves the ends of files and small filesThis even involves storing some of the data within the tree structure itself. This type of organization prevents PhotoRec from handling it correctly, making it ineffective with ReiserFS.
Regarding the type of devices, PhotoRec is capable of working with a huge variety of media, as long as the system sees it as a block device or as an image:
- Mechanical hard drives (HDD) and SSD
- optical drives such as CDs and DVDs
- Memory cards (CompactFlash, SD, microSD, Memory Stick, SmartMedia, MMC, Microdrive...)
- USB flash drives and USB drives
- Raw images of disks or partitions
- EnCase E01/EWF Forensic Imaging
- Portable devices such as some iPod and digital cameras from Canon, Nikon, Sony, Olympus, Casio, HP, Praktica and other manufacturers
In forensic settings, many professionals use it in combination with disk images, since It allows you to work on a copy instead of the original., something almost mandatory if the evidence is to be preserved.
File formats that PhotoRec can recover
PhotoRec bases its operation on locating specific signatures for each type of file in the disk blocks. When it detects a known header, it assumes that a file of a specific format begins there and tries to reconstruct it completely.
The database included in the program recognizes more than 100 families of different formatswhich in practice translates into more than 180 file extensionsOver the years it has been expanded to cover more and more real-life cases.
Among the most common types of files that can be recovered are:
- ImagesJPEG, PNG, TIFF, GIF and many RAW camera formats (CR2, NEF, DCR, SR2, PEF…)
- Office documents: DOC, DOCX, XLS, XLSX, PPT, as well as OpenOffice and LibreOffice files
- PDF and HTML files
- PillsZIP files, including packages containing modern Office documents
- Audio and video, such as MP3 and other common containers
- Executables and other binaries in different systems
In many cases, if the data is not fragmented, The recovered file may be identical to the original.In other cases, the file may appear larger (because it includes junk files at the end), and PhotoRec trims it based on the information it finds in the file header. If the resulting file is smaller than what that header indicates, it considers it corrupt and discards it, unless you explicitly tell it to keep damaged files.
How PhotoRec works internally
To understand why PhotoRec is so effective, it's worth taking a very brief look. How do file systems manage data? Typical file systems include FAT, NTFS, and ext. These systems store information in blocks (or clusters), the size of which is fixed at the time of formatting and remains constant.
Operating systems try to write the files contiguously To reduce fragmentation and speed up access, especially on mechanical disks where head seek time is critical. However, with use, writes and erases inevitably cause data fragmentation.
When you delete a file, what usually happens is that The metadata is removed (name, date, size, block list, etc.), but the data remains on disk until another file overwrites it. In ext2/ext3/ext4 systems, for example, the name may still remain for a while, but the reference to the first block disappears, so the system no longer knows where the file actually begins.
PhotoRec begins by determining the block or cluster size of the volumeIf the file system is still minimally readable, it extracts that data from the superblock (in ext) or the Volume Boot Record (in FAT and NTFS). Otherwise, it makes an initial pass to locate the first valid files and, based on their positions, calculates the most likely block size.
With that size identifying the basic structure, the program scans the disk block by blockcomparing each one against its signature database. If it finds the header of, for example, a JPEG (0xff, 0xd8, 0xff, 0xe0 / 0xe1 / 0xfe), it starts reconstructing a new file with the corresponding extension. If it later detects another file start, it checks that the previous one makes sense and, if everything matches, closes that recovered file and starts with the next one.
“Data stream” type files (like some MP3 or audio/video streamThey don't always have a fixed header size, so PhotoRec analyze the content until it considers the flow to be complete. In parallel, it reviews previous blocks looking for headers that it could not reconstruct on the first pass, thus attempting to recover even some fragmented files.
Install PhotoRec and TestDisk on Windows and Linux
The first step to harnessing this full potential is Install the program correctly according to your operating system.Although the process is simple, it's advisable to follow some guidelines to avoid mistakes and, above all, to avoid accidentally writing to the disk you want to recover.
In Windows, the usual thing to do is to enter the official project page and download the package that includes TestDisk and PhotoRec. It's completely free, and it usually comes compressed in a ZIP file that you just have to extract to a folder of your choice (preferably on a different drive than the one you want to recover).
Inside that folder you will find the executable photorec_win.exewhich is the classic text-based version, and also qphotorec_win.exewhich offers a minimalist graphical interface, somewhat more user-friendly for those unfamiliar with console menus. In any case, it's recommended to run them. with administrator permissions (right click > Run as administrator) so that they can access the physical devices without restrictions.
In Linux, the process is usually even more straightforward: in Debian/Ubuntu-based distributions, simply open a terminal and type:
sudo apt-get install testdisk
When you install TestDisk, the system will also add PhotoRec. To start it, run it from the terminal with:
sudo photorec
In Unix, BSD, or macOS systems, the idea is similar: Run PhotoRec as root (using sudo) to ensure full access to the devices. On macOS, for example, you would launch the corresponding binary (photorec) from the folder where you extracted the TestDisk package.
Basic use of PhotoRec step by step
Although its text-based interface might seem a bit intimidating at first, PhotoRec's workflow is quite linear and with a certain assistant-like feelWith just a few keys (arrows, Enter, C and Q) you can complete the whole process without overcomplicating things.
Upon startup, the program displays a list with all disks and memory detectedUsing the up/down arrow keys, select the physical device containing the deleted files and press Enter. If you are on a system where a "RAW" version of the device exists (such as /dev/rdisk instead of /dev/disk), it is recommended to choose the RAW variant because access is usually much faster.
Next, PhotoRec will ask you to select the partition table type (MBR, GPT, etc.). It usually detects the correct value automatically, so just accept the default option unless you are absolutely certain it is incorrect.
On the next screen you will see the disk partitions and unallocated spaceThere you can:
- Choose a specific partition and select
Searchto begin the recovery from that area. - Ir a
OptionsIf you want to adjust advanced parameters. - Walk into
File Optto select which types of files you want to recover and which you don't.
When you launch the search, the program will ask you to specify the file system typeIf the partition is ext2/ext3/ext4, you should choose that option. If it's FAT, NTFS, exFAT, HFS+, or similar, you'll need to select the corresponding option. Other, which is the one that encompasses most common systems in Windows and macOS.
FotoRec lets you select whether you want to scan only the free space or the entire partitionScanning unallocated space focuses on deleted files that haven't yet been overwritten, and is usually faster and cleaner. Scanning the entire disk is more thorough, but also slower and can return many more results that aren't always relevant.
The key step comes when you have to choose the destination folder where the recovered files will be savedIt is crucial that you DO NOT save anything to the same partition you are analyzing, as this could overwrite recoverable data. Ideally, use a different disk, partition, or even a different USB drive.
You will navigate the directory tree using the arrow keys and the option to go up one level using the ".." key. Once you have selected the folder, press the key C And then the real analysis begins. From there, it's a matter of letting it work: depending on the size of the medium and the condition of the unit, The process can take anywhere from a few minutes to several hours..
Advanced options and forensic usage modes
PhotoRec includes a series of advanced options designed for complex scenarios or for users who need finer control over how the recovery process works. You don't have to touch them for normal use, but it's good to know they exist.
Among the most interesting is the mode ParanoidThis feature, which is enabled by default, causes the program to check the validity of recovered files, discarding any that are detected as invalid. Disabling this mode will increase the number of recovered files, but also the amount of junk and corrupted files.
The option bruteforce It attempts to piece together more fragmented JPEG files at the cost of using much more CPU, so it's only worth enabling if you're really desperate to recover certain photos and don't mind the process becoming much slower.
The call expert fashion It allows you to manually force the block size and offset, which only makes sense when you know exactly what you're doing or in forensic investigations. You can also allow it to retain corrupt fileswhich is useful if you plan to run those parts through other repair tools later.
For systems with very little RAM or giant, highly fragmented file systems, there is a mode to low memory consumptionThis reduces resource usage but can affect speed and, in some cases, the depth of the analysis. It is a last resort function used when the machine hangs during recovery.
If you work with forensic images, PhotoRec can be invoked directly on files such as image.dd o image.E01, and even on sets of files of type image.???It also supports routes such as /cygdrive/d/evidence/image.??? in Cygwin environments. Additionally, you have a mode / log which generates a photorec.log file with the list of recovered files and their location, very useful for documenting the process.
Recover files from Windows with PhotoRec
In Windows, the actual procedure doesn't differ much from what's been described, but it's worth clarifying because many users will use it there. To begin, Open PhotoRec with an administrator account of the team to ensure access to the physical disks.
When the list of disks appears, use the arrows to select the one containing the lost data and press Enter. Then choose the correct partition (or the "no partition" option if you want PhotoRec to perform a raw scan of the entire disk) and follow the wizard: file system, free space or entire disk, destination folder, and press C to start the scan.
During the process, you will see it increasing on the screen. the file found counterThe read speed and progress are displayed. You can interrupt the search at any time; the files already recovered will remain in the recup_dir.1, recup_dir.2, etc. folders, so nothing saved up to that point is lost.
At the end, PhotoRec displays a Summary with the number of files found and their destination where they have been saved. Keep in mind that the original names and folder structure are almost never preserved, as the program works with raw data. Instead, you will see files with generic names and extensions depending on the type detected.
It's a good idea to temporarily disable the real-time antivirus protection to speed up the process, but once you finish it's a good idea to analyze the recovered files, because you might also recover files that were already infected on the original disk.
File recovery from Linux and other systems
In Linux and other Unix-like systems, the flow is virtually identical, with the nuance that it almost always You will launch PhotoRec from a terminal with sudoUpon execution, it will detect most devices, including software RAID arrays (e.g., /dev/md0) and volumes encrypted with cryptsetup, dm-crypt, LUKS, or similar tools.
If you want to work on a disk image instead of the actual device, you can pass the filename as an argument: photorec image.dd o photorec image.E01This way, you ensure that the physical device is no longer touched and everything is done on a copy, which is highly recommended when the data is particularly sensitive.
On macOS systems, the process is similar: you choose the disk (for example, /dev/disk2 or /dev/rdisk2), select the partition, and follow the usual steps. However, you should be cautious with external drives, as macOS can mount and unmount disks on the fly; ideally, leave them mounted in read-only mode or work directly on an image created with Disk Utility.
In less common environments such as OS / 2PhotoRec only handles image files and not directly physical disks, due to limitations of the operating system itself. In those cases, the workflow always involves first writing the device to a file and then processing that image.
PhotoRec vs. other data recovery programs
Although PhotoRec is incredibly powerful, it's not the perfect tool for everyone. Its text-based interface can be unfriendly, and some advanced features can be intimidating. That's why other tools exist. alternatives with a more "for all audiences" approachwhich is worth knowing in case PhotoRec doesn't meet your needs or you find it difficult.
On one hand there are programs like RecuvaVery popular on Windows, it offers a quick scan for recently deleted files and a deep scan for more serious cases. It has a very simple graphical interface, filters by file type, and works well with hard drives, USB drives, and SD cards, although its raw power often falls short of tools like PhotoRec.
Another common name is EaseUS Data Recovery Wizard, a commercial solution with a limited free version that stands out for its guided interface with previewsIt supports damaged drives, formatted volumes, and multiple operating systems, and its ease of use is ideal for those who don't want to deal with command-line interfaces. Within the PhotoRec community, it's often recommended as a simple alternative when the command-line interface becomes too complex.
There is also Disk DrillAvailable for both Windows and macOS, this program combines a polished design with robust recovery capabilities. It allows you to scan partitions, external devices, and all types of media, and its free version is useful for checking if the files you need can be recovered before purchasing.
Finally, it is impossible not to mention TestDiskPhotoRec's "sibling," developed by the same author, focuses on... individual filesTestDisk specializes in lost partitions and disks that have stopped bootingIn many cases, before you start scanning with PhotoRec, it's a good idea to try TestDisk, because recovering the partition can restore your entire folder system intact and save you a lot of work.
Limitations, actual effectiveness, and best practices
However good a recovery program may be, there are situations in which There's simply nothing to be doneUnderstanding the limitations of PhotoRec will help you avoid creating false expectations and make more sensible decisions when data is critical.
If the hard drive has serious physical damage (broken head, motor that won't spin, completely unreadable sectors), PhotoRec can't work miracles. In these cases, recovery must be done physically, in a specialized lab with professional tools, and the safest course of action is to turn off the drive and avoid putting any further stress on it. The more you try to fix it at home, the more you risk damaging the drive.
Regarding records formatted multiple times or with low-level formattingThings get much more complicated. PhotoRec can recover files if formatting hasn't yet overwritten the sectors where they were located, but once the content has been repeatedly overwritten, the old information disappears completely. The same thing happens when performing a secure erase based on write patterns.
If the volume is encryption (For example, with BitLocker, VeraCrypt, LUKS…), PhotoRec cannot read anything useful unless the encryption layer is active and the key or password is available. Encryption is specifically designed to prevent this type of access, so unless the volume is decrypted, the tool will only see random data.
Another important limitation is that The original names and folder structure are not recoveredThe files are saved in numbered recup_dir directories with generic names, so you then have to manually search for what you need, often relying on the extension, size, modification date or preview.
Even so, PhotoRec is very effective when the right conditions are met: the storage medium is not severely damaged, it hasn't been used intensively after deletion (to avoid overwriting), the file system is one it handles well, and the files aren't extremely fragmented. As a general rule, The sooner you act and the less you touch the device after the incident, the better the chances of success..
Finally, it's worth remembering a couple of good practices: whenever you can, It works on an image of the disk instead of the original.And never save recovered files to the same volume you're scanning. These two details make all the difference between recovering almost everything and further damaging what little remained intact.
With everything we've seen, it's clear that PhotoRec is an essential tool in any computer emergency kitIt combines power, support for a huge number of systems and formats, and an absolute focus on not touching the source media; it's not perfect, it requires some patience and a certain amount of console experience, but in return it offers a recovery capacity that few free solutions can match, and if you accompany it with TestDisk and some alternative with a graphical interface you have practically all the usual data loss scenarios covered.