PhotoRec FAQ

PhotoRec is file data recovery software that recovers lost files—including photos, video, documents, and archives—from hard disks (HDD/SSD), CD-ROMs, and memory cards. It uses signature-based recovery (data carving): it searches for known file headers and extracts data block by block, so it works even when the file system is damaged or the drive was reformatted. It recognizes hundreds of file formats (480+ extensions, 300+ file families).

Yes. Because PhotoRec ignores the file system and works on raw data, it can recover files from reformatted partitions or drives—as long as the actual file data has not been overwritten. The new file system may have reallocated some space, so the sooner you run recovery after formatting, the better. Always save recovered files to a different drive.

When the file system is corrupted, reformatted, or missing, metadata (directory entries, allocation tables) is lost or unreliable. PhotoRec bypasses that by scanning the media for known file signatures (headers/footers). That way it can still find and extract file content even when the file system cannot be read. The trade-off is that original filenames and folder structure are often not recoverable.

PhotoRec can recover lost files from media that use (or used) FAT, NTFS, exFAT, ext2/ext3/ext4, and HFS+. It does not rely on the file system for carving—it reads blocks and matches signatures—so it works even when the file system is severely damaged. ReiserFS has special storage behavior that PhotoRec does not handle well. Block size is detected from the superblock, boot record, or from the first files found if the file system is corrupted.

In most cases, no. PhotoRec names recovered files using logical sector information and adds the correct extension; it may append the original filename or document title when that information is stored inside the file itself, but that is not common. For intact file systems and simple deletion, TestDisk can often undelete files with original names on FAT, NTFS, and ext2. Use TestDisk first when the file system is still readable.

Yes. PhotoRec is free and open-source, distributed under the GNU General Public License (GPL) v2 or later. You can use, study, modify, and distribute it under the terms of the GPL. There is no paid version or feature lock.

PhotoRec only reads from the source drive; it does not write to it. So it does not add wear or modify the failing drive. However, reading a failing drive can accelerate hardware failure. If the drive is critical, consider creating a disk image first (e.g. with dd or similar) and running PhotoRec on the image. Use at your own risk; we cannot guarantee the drive will survive the read process.

Writing recovered files to the same partition or device you are recovering from can overwrite the very data you are trying to recover. The space where your deleted files still exist could be reused by new files. Always choose a destination on another physical drive or partition (e.g. another internal disk, USB drive, or network share).

It depends on the size of the media, interface speed (USB, SATA, etc.), and options (e.g. bruteforce for fragmented JPEGs is CPU-intensive). Deep scans on large drives can take hours. There are no fixed numbers; smaller media and “unallocated only” scans are generally faster than full-partition scans on multi-TB drives.

PhotoRec can run on SSDs like any other block device. However, SSDs use TRIM (and similar commands) to erase blocks when files are deleted. Once TRIM has been executed, the data may be gone and recovery is often impossible. If TRIM is disabled or has not yet run (e.g. recently deleted files), recovery may still work. We do not promise recovery on SSDs; results depend on the drive and OS behavior.

Yes. PhotoRec recovers many file types: video (MP4, MOV, AVI, MKV, etc.), documents (PDF, DOC/DOCX, XLS/XLSX, ODT, etc.), and archives (ZIP, 7z, RAR, gzip, etc.), in addition to photos and RAW formats. You can enable or disable whole file families in the File Opt menu. See the full list on CGSecurity.

In PhotoRec, before starting the search, open File Opt (file options). There you can enable or disable entire file families (e.g. JPEG, TIFF/RAW, ZIP, Office documents). Leaving all enabled is fine but may produce more files and take longer; disabling types you do not need can speed up the scan and reduce clutter in the output.

Yes. Run PhotoRec with the image file as the argument, e.g. photorec image.dd for a raw image, or photorec image.E01 for an EnCase EWF image. For split E01 files, use a pattern like photorec 'image.???'. Working from an image is safer for the original media and allows repeatable forensics.

Recovery tools need low-level access to disks, which is also a capability used by some malware. Antivirus software may use heuristics that flag such behavior. PhotoRec is not malware; it is open-source and widely used. To stay safe: download only from the official CGSecurity site, verify checksums, and scan the downloaded archive. A single heuristic alert after verification is often a false positive.

Stop using the device immediately. Do not save new files, install software, or run the system from that drive if possible. Extract or install PhotoRec (and run it) from another drive. Choose a recovery destination on a different drive. The less you write to the affected media, the better the chance of recovery.

No. PhotoRec uses read-only access to the drive or memory card you are recovering from. It only reads sectors; it does not write to the source device. All recovered data is written to the destination folder you choose, which must be on a different drive or partition.

Data was overwritten (new files written after deletion or formatting); TRIM/secure erase on SSDs; severe fragmentation so the file cannot be reassembled; physical damage to the media; or the file type is not in PhotoRec’s signature database. Recovery is never guaranteed. Stopping use of the device right after loss and saving output to another drive gives the best chance.