testdisk & photorec

What they do

testdisk inspects and repairs partition tables and filesystem boot sectors — recovering whole partitions whose entries were deleted or damaged. photorec carves files by signature (like foremost/scalpel) but is optimized for image, document, and archive types. Both come in one package and are written for data-recovery use, but appear in forensic toolkits for the same reason: they work from raw media without mounting.

Install

apt install testdisk
dnf install testdisk
pacman -S testdisk

testdisk: recovering partitions

Run it against the whole disk (not the partition) to rebuild the partition table:

# interactive menu: 1) select media  2) Intel/DOS layout  3) Analyse
testdisk /dev/sdb

# Analyse scans for missing/deleted partitions
# found partitions are marked with P (primary) / D (deleted)
# Press P to list files and verify, then Write the table when confident

# non-interactive analysis equivalent:
testdisk /list /dev/sdb   # list partitions only, no writes

photorec: carving media files

# interactive: pick media, file types, output dir
photorec /dev/sdb1

# carve a partition IMAGE instead of a live device:
photorec /evidence/part2.dd
  # choose [Partitioned] -> select the partition image
  # choose [Whole] to scan the entire file
  # set output dir to separate evidence media
  # FileOpt: restrict to specific extensions

Files are written as f0000001.jpg, f0000002.png, etc., grouped by type into recup_dir.1, recup_dir.2, ...

Forensic caveats

• Like all carving, fragmented files may come out truncated or mis-assembled.
• Renamed output loses original filenames and paths — keep the audit log testdisk produces.
• Run against image files, not mounted filesystems, for defensibility.
• photorec is a good cross-check against foremost for exotic media types.

← Previous: strings & grep  ·  Next: bulk_extractor →