2007-10-29 22:38:52 +01:00
|
|
|
TestDisk checks the partition and boot sectors of your disks.
|
|
|
|
It is very useful in recovering lost partitions.
|
|
|
|
|
|
|
|
It works with :
|
|
|
|
- DOS/Windows FAT12, FAT16 and FAT32
|
|
|
|
- NTFS ( Windows NT/2K/XP )
|
|
|
|
- Linux Ext2 and Ext3
|
|
|
|
- BeFS ( BeOS )
|
|
|
|
- BSD disklabel ( FreeBSD/OpenBSD/NetBSD )
|
|
|
|
- CramFS (Compressed File System)
|
|
|
|
- HFS and HFS+, Hierarchical File System
|
|
|
|
- JFS, IBM's Journaled File System
|
|
|
|
- Linux Raid
|
|
|
|
- Linux Swap (versions 1 and 2)
|
|
|
|
- LVM and LVM2, Linux Logical Volume Manager
|
|
|
|
- Netware NSS
|
|
|
|
- ReiserFS 3.5, 3.6 and 4
|
|
|
|
- Sun Solaris i386 disklabel
|
|
|
|
- UFS and UFS2 (Sun/BSD/...)
|
|
|
|
- XFS, SGI's Journaled File System
|
|
|
|
|
|
|
|
PhotoRec is file data recovery software designed to recover
|
|
|
|
lost pictures from digital camera memory or even Hard Disks.
|
|
|
|
It has been extended to search also for non audio/video headers.
|
|
|
|
It searches for
|
|
|
|
- Sun/NeXT audio data (.au)
|
|
|
|
- RIFF audio/video (.avi/.wav)
|
|
|
|
- BMP bitmap (.bmp)
|
|
|
|
- bzip2 compressed data (.bz2)
|
|
|
|
- Source code written in C (.c)
|
|
|
|
- Canon Raw picture (.crw)
|
|
|
|
- Canon catalog (.ctg)
|
|
|
|
- FAT subdirectory
|
|
|
|
- Microsoft Office Document (.doc)
|
|
|
|
- Nikon dsc (.dsc)
|
|
|
|
- HTML page (.html)
|
|
|
|
- JPEG picture (.jpg)
|
|
|
|
- MOV video (.mov)
|
|
|
|
- MP3 audio (MPEG ADTS, layer III, v1) (.mp3)
|
|
|
|
- Moving Picture Experts Group video (.mpg)
|
|
|
|
- Minolta Raw picture (.mrw)
|
|
|
|
- Olympus Raw Format picture (.orf)
|
|
|
|
- Portable Document Format (.pdf)
|
|
|
|
- Perl script (.pl)
|
|
|
|
- Portable Network Graphics (.png)
|
|
|
|
- Raw Fujifilm picture (.raf)
|
|
|
|
- Contax picture (.raw)
|
|
|
|
- Rollei picture (.rdc)
|
|
|
|
- Rich Text Format (.rtf)
|
|
|
|
- Shell script (.sh)
|
|
|
|
- Tar archive (.tar )
|
|
|
|
- Tag Image File Format (.tiff)
|
|
|
|
- Microsoft ASF (.wma)
|
|
|
|
- Sigma/Foveon X3 raw picture (.x3f)
|
|
|
|
- zip archive (.zip)
|
|
|
|
|
|
|
|
TestDisk and PhotoRec run under:
|
|
|
|
- Dos, Win9x
|
|
|
|
- Windows (NT 4/2000/XP/2003)
|
|
|
|
- Linux
|
|
|
|
- FreeBSD, NetBSD, OpenBSD
|
|
|
|
- SunOS
|
|
|
|
|
|
|
|
Both are under GNU General Public License.
|
|
|
|
|
|
|
|
Christophe GRENIER
|
|
|
|
grenier@cgsecurity.org
|
|
|
|
http://www.cgsecurity.org/
|
2011-04-27 22:10:52 +02:00
|
|
|
|
|
|
|
================================================================
|
|
|
|
PhotoRec - Theory of operation:
|
|
|
|
|
|
|
|
Carvers are plugable. Each carver consists of:
|
|
|
|
|
|
|
|
struct file_hint_t - describes extension, name, max size, enable by default, etc.
|
|
|
|
file_enable_t list_file_enable[] - array with all file hints and whether enabled or not.
|
|
|
|
|
|
|
|
|
|
|
|
phmain.c - Contains the main() and driver logic for photorec.
|
|
|
|
|
|
|
|
main():
|
|
|
|
- reads parameters
|
|
|
|
- scans for available devices
|
|
|
|
- parses the HD (or image)
|
|
|
|
- resets the list of which file carvers are enabled
|
|
|
|
- Initializes ncurses
|
|
|
|
- Calls do_curses_photorec() (in pdisksel.c)
|
|
|
|
- shuts down ncurses
|
|
|
|
|
|
|
|
|
|
|
|
pdisksel.c -
|
|
|
|
int do_curses_photorec(int verbose, const char *recup_dir, const list_disk_t *list_disk,
|
|
|
|
file_enable_t *file_enable, char *cmd_device, char **current_cmd)
|
|
|
|
|
|
|
|
- runs either photorec_disk_selection_cli() or photorec_disk_selection_ncurses()
|
|
|
|
- Both of these eventually call menu_photorec() in ppartsel.c
|
|
|
|
|
|
|
|
ppartsel.c - menu_photorec():
|
|
|
|
- Implements Search/Options/File Opt/Geometry/Quit menu
|
|
|
|
- Search Option:
|
|
|
|
- Creates new recup_dir
|
|
|
|
- Runs ext2_fix_group and ext2_fix_inode if necessary
|
|
|
|
- runs photorec()
|
|
|
|
|
|
|
|
phrecn.c - photorec()
|
|
|
|
- runs multiple passes until status==STATUS_QUIT
|
|
|
|
- calls photorec_mkdir() to actually make the output directory
|
|
|
|
|
|
|
|
photorec.c: - file_finish()
|
|
|
|
- called when file is done.
|
|
|
|
|
|
|
|
called by:
|
|
|
|
- photorec_bf()
|
|
|
|
- photorec_bf_pad()
|
|
|
|
- photorec_bf_frag()
|
|
|
|
- photorec_bf_aux()
|
|
|
|
|
|
|
|
file_recovery_t *file_recovery -
|
|
|
|
|
|
|
|
photorec.c - file_finish2()
|
|
|
|
- called when a file is done.
|
|
|
|
|
|
|
|
called by:
|
|
|
|
- photorec_aux() (in three places)
|
|
|
|
- photorec()
|
|
|
|
|
|
|
|
Some utility functions:
|
|
|
|
phbf.c - set_filename(file_recovery,recup_dir,dir_num,disk_car,partition,nn)
|
|
|
|
- Figures out a file name
|
|
|
|
|
|
|
|
================================================================
|
|
|
|
XML Report Integration
|
|
|
|
|
|
|
|
xml output file is always made and always placed in recup_dir
|