Scripted run

From CGSecurity

Jump to: navigation, search

en.png english version de.png deutsche Version es.png versión español fr.png version française


TestDisk and PhotoRec can run automatically using their own built-in commands. A script file (such as .cmd or .bat 'Batch files' under MS-DOS/Windows, or some shell under Linux) may also be helpful.

This document describes the command line syntax.

Contents

TestDisk

Syntax: testdisk [/debug] [/log] [/logname file.log] /cmd device cmd

Device selection

Use the device name, ie /dev/hda, /dev/hdb, /dev/sda.
For DOS version, use /dev/sda128 for first disk, /dev/sda129 for the second and so on...

Partition type selection

  • partition_i386
  • partition_mac
  • partition_none
  • partition_sun
  • partition_xbox
  • ask_type: the user will be asked for the partition type (new in 6.9)

Main menu

  • advanced
  • analyze
  • delete
  • geometry
  • mbr_code
  • options
  • list

Analyse menu

  • backup: save to backup.log file the current partition structure
  • mode_vista: search for partitions created by Windows Vista Disk Manager
  • number: select a partition found during Quick Search or Deeper Search
  • list: list of the content of the selected partition (first one by default, new in 6.10)
  • search: Deeper Search for more partitions
  • noconfirm,write
  • write

Advanced menu

  • type
  • boot: for FAT and NTFS partition, go to the specific menu
  • copy: backup the partition to the file image.dd (new in 6.9)
  • list: list the content of the partition (new in 6.10)
  • list,recursive: list the content of the whole partition (new in 6.10)
  • list,recursive,fullpathname: list the content of the whole partition with the whole pathname (new in 6.11)
  • superblock: search ext2/ext3 superblocks or go to HFS+ menu depending of the partition
  • number: the partition number to select

FAT1x menu

  • rebuildbs
  • dump
  • list (new in 6.9)
  • list,recursive: list the content of the whole partition (new in 6.10)
  • list,recursive,fullpathname: list the content of the whole partition with the whole pathname (new in 6.11)
  • repairfat
  • initroot
  • undelete (new in 6.11)

FAT32 menu

  • rebuildbs
  • dump
  • list (new in 6.9)
  • list,recursive: list the content of the whole partition (new in 6.10)
  • list,recursive,fullpathname: list the content of the whole partition with the whole pathname (new in 6.11)
  • repairfat
  • originalfat
  • backupfat
  • undelete (new in 6.11)

FAT rebuild menu

  • list
  • list,recursive: list the content of the whole partition (new in 6.10)
  • dump
  • noconfirm,write
  • write

NTFS menu

  • rebuildbs
  • dump
  • list
  • list,recursive: list the content of the whole partition (new in 6.10)
  • list,recursive,fullpathname: list the content of the whole partition with the whole pathname (new in 6.11)
  • originalntfs
  • backupntfs
  • repairmft
  • undelete (new in 6.11)

NTFS rebuild menu

  • list
  • list,recursive: list the content of the whole partition (new in 6.10)
  • list,recursive,fullpathname: list the content of the whole partition with the whole pathname (new in 6.11)
  • dump
  • noconfirm,write
  • write

HFS+ menu

  • dump
  • originalhfsp
  • backuphfsp

Geometry menu

  • C,number of cylinders
  • H,number of heads
  • S,number of sectors
  • N,sector size

Some examples

testdisk /debug /log /cmd /dev/hda analyze,search

testdisk /debug /log /cmd partition.dd options,partition_none,geometry,H,32,analyze,list,advanced,boot,rebuildbs,
list partition.dd

PhotoRec

General syntax: photorec [/debug] [/log] [/logname file.log][/d reco_dir] [/cmd <device> <command>]

  • /debug: switch on debug mode
  • /log: switch on logging (a log file named photorec.log will be created/appended to in the current working directory
  • /logname file.log: log will be written to file.log instead of photorec.log
  • /d reco_dir: specify directory to store the recovered files into. This should be on a device different from the one you are recovering from. PhotoRec will add a numeric extension to the path specified, starting with ".1" - and increase this number as long as a directory with this name already exists.
  • /cmd: introduces the command section for scripted run
  • <device>: the device (or image file) to recover from
  • <command>: the command list (see below)

Command list

Below you find a list of available command options, grouped into categories. It is best to use them in the order they are mentioned here. These options have to been separated by comma. Partition type selection and options from the main menu can be used directly - see also the examples below.

Partition type selection

  • partition_i386
  • partition_mac
  • partition_none
  • partition_sun
  • partition_xbox
  • ask_type: the user will be asked for the partition type

If no partition type is specified, it is auto-detected.

Main menu

  • fileopt: Let's change files type to recover
  • inter: PhotoRec usage becomes interactif
  • options
  • number: the partition number to select
  • blocksize: force the blocksize, it's followed by the blocksize in bytes.
  • wholespace / freespace : files will be recovered from the whole partition or only from the free space (new in 6.10)
  • ext2_group: carve the group whose number is following (new in 6.10)
  • ext2_inode: carve the group whose following inode belongs to (new in 6.10)
  • search: start the recovery

fileopt menu

  • everything,enable: use the values by default (may be different than the saved values, new in 6.9)
  • everything,disable: empty the list of file formats to locate (new in 6.9)
  • jpg,enable: will search for jpg
  • jpg,disable: will not search for jpg

You can use the same syntax for all file formats.

Options menu

To use anything from the options menu, you must specify the keyword "options" first.

  • expert
  • keep_corrupted_file_no (new in 6.10)
  • keep_corrupted_file
  • paranoid_no / paranoid / paranoid_bf (new in 6.10)
  • lowmem
  • mode_ext2

Some examples

# Recover from the second IDE drives i386 partition the user selects:
photorec /debug /log /cmd /dev/hdb partition_i386,select,search

# Recover from the first IDE drives i386 partition #5, which is Ext2/Ext3
photorec /debug /log /cmd /dev/hda partition_i386,options,mode_ext2,5,search

# Recover from a given disk image file named "disk.dmp" which only
# has one partition (or a part of it) in Ext2/Ext3 format. Restore
# all file types known to photorec to /mnt/recover/disk
# (keep in mind that the keyword "everything" is not available before photoRec 6.9)
photorec /debug /log /d /mnt/recover/disk /cmd disk.dmp partition_none,options,mode_ext2,fileopt,everything,enable,search

# The same w/o debug and log - but recover only *.gif and *.jpg
photorec /d /mnt/recover/disk /cmd disk.dmp partition_none,options,mode_ext2,fileopt,everything,disable,jpg,enable,gif,enable,search

# Recover jpg from the freespace of the first partition
photorec /cmd /dev/hda fileopt,everything,disable,jpg,enable,freespace,search
Data Recovery
Security