PhotoRec

PhotoRec is a free, open-source file recovery tool created by Christophe Grenier of CGSecurity and distributed alongside its sister tool, TestDisk. Despite the name, it recovers far more than photos: videos, documents, archives and hundreds of other file formats from hard drives, SSDs, memory cards, USB drives and disk images.

PhotoRec uses file carving: it ignores the damaged or formatted file system and searches the raw data for known file signatures, which lets it recover files even when a drive has been reformatted or corrupted. It opens the source drive in read-only mode, runs on Windows, Linux and macOS, and is also built into forensic suites such as Autopsy.

On Cracking Station you’ll find PhotoRec tutorials and comparisons with other data carving and forensics tools such as Scalpel, Bulk Extractor, Autopsy and X-Ways, written for digital forensics learners and CHFI candidates.