Recuperando Arquivos Excluídos com PhotoRec

Quando Usar

• Ao recuperar arquivos excluídos de uma imagem forense de disco ou dispositivo de armazenamento
• Quando o sistema de arquivos está corrompido, formatado ou sobrescrito
• Durante investigações que exigem a recuperação de documentos, imagens, vídeos ou bancos de dados
• Quando metadados do sistema de arquivos não estão disponíveis, mas os setores de dados brutos permanecem intactos
• Para recuperar arquivos de cartões de memória, unidades USB e discos rígidos

Pré-requisitos

• PhotoRec instalado (parte do pacote TestDisk)
• Imagem forense de disco ou acesso direto ao dispositivo (somente leitura)
• Espaço de armazenamento de saída suficiente (potencialmente maior que a origem)
• Bloqueador de gravação se estiver trabalhando com a mídia original
• Privilégios de root/sudo para acesso ao dispositivo
• Conhecimento dos tipos de arquivo de destino para recuperação focada

Fluxo de Trabalho

Passo 1: Instalar o PhotoRec e Preparar o Ambiente

# Install TestDisk (includes PhotoRec) on Debian/Ubuntu
sudo apt-get install testdisk

# On RHEL/CentOS
sudo yum install testdisk

# On macOS
brew install testdisk

# Verify installation
photorec --version

# Create output directory structure
mkdir -p /cases/case-2024-001/recovered/{all,documents,images,databases}

# Verify the forensic image
file /cases/case-2024-001/images/evidence.dd
ls -lh /cases/case-2024-001/images/evidence.dd

Passo 2: Executar o PhotoRec em Modo Interativo

# Launch PhotoRec against a forensic image
photorec /cases/case-2024-001/images/evidence.dd

# Interactive menu steps:
# 1. Select the disk image: evidence.dd
# 2. Select partition table type: [Intel] for MBR, [EFI GPT] for GPT
# 3. Select partition to scan (or "No partition" for whole disk)
# 4. Select filesystem type: [ext2/ext3/ext4] or [Other] for NTFS/FAT
# 5. Choose scan scope: [Free] (unallocated only) or [Whole] (entire partition)
# 6. Select output directory: /cases/case-2024-001/recovered/all/
# 7. Press C to confirm and begin recovery

# For direct device scanning (with write-blocker)
sudo photorec /dev/sdb

Passo 3: Executar o PhotoRec com Opções de Linha de Comando para Recuperação Direcionada

# Non-interactive mode with specific file types
photorec /d /cases/case-2024-001/recovered/documents/ \
   /cmd /cases/case-2024-001/images/evidence.dd \
   partition_table,options,mode,fileopt,search

# Recover only specific file types using photorec command mode
photorec /d /cases/case-2024-001/recovered/documents/ \
   /cmd /cases/case-2024-001/images/evidence.dd \
   options,keep_corrupted_file,enable \
   fileopt,everything,disable \
   fileopt,doc,enable \
   fileopt,docx,enable \
   fileopt,pdf,enable \
   fileopt,xlsx,enable \
   search

# Recover only image files
photorec /d /cases/case-2024-001/recovered/images/ \
   /cmd /cases/case-2024-001/images/evidence.dd \
   fileopt,everything,disable \
   fileopt,jpg,enable \
   fileopt,png,enable \
   fileopt,gif,enable \
   fileopt,bmp,enable \
   fileopt,tif,enable \
   search

# Recover database files
photorec /d /cases/case-2024-001/recovered/databases/ \
   /cmd /cases/case-2024-001/images/evidence.dd \
   fileopt,everything,disable \
   fileopt,sqlite,enable \
   fileopt,dbf,enable \
   search

Passo 4: Organizar e Catalogar Arquivos Recuperados

# PhotoRec outputs files into recup_dir.1, recup_dir.2, etc.
ls /cases/case-2024-001/recovered/all/

# Count recovered files by type
find /cases/case-2024-001/recovered/all/ -type f | \
   sed 's/.*\.//' | sort | uniq -c | sort -rn > /cases/case-2024-001/recovered/file_type_summary.txt

# Sort recovered files into directories by extension
cd /cases/case-2024-001/recovered/all/
for ext in jpg png pdf docx xlsx pptx zip sqlite; do
   mkdir -p /cases/case-2024-001/recovered/sorted/$ext
   find . -name "*.$ext" -exec cp {} /cases/case-2024-001/recovered/sorted/$ext/ \;
done

# Generate SHA-256 hashes for all recovered files
find /cases/case-2024-001/recovered/all/ -type f -exec sha256sum {} \; \
   > /cases/case-2024-001/recovered/recovered_hashes.txt

# Generate file listing with metadata
find /cases/case-2024-001/recovered/all/ -type f \
   -printf "%f\t%s\t%T+\t%p\n" | sort > /cases/case-2024-001/recovered/file_listing.txt

Passo 5: Validar e Filtrar Arquivos Recuperados

# Verificar a integridade dos arquivos usando assinaturas de arquivo
find /cases/case-2024-001/recovered/all/ -type f -exec file {} \; \
   > /cases/case-2024-001/recovered/file_signatures.txt

# Encontrar arquivos com extensão/assinatura incompatível
while IFS= read -r line; do
   filepath=$(echo "$line" | cut -d: -f1)

…