How to Recover Your Deleted Files

When recovering files, it can be important to target only the deleted ones rather than restoring all files from a filesystem. PhotoRec, a recovery tool, offers specific capabilities depending on the type of filesystem you’re dealing with. Here’s a quick guide that worked for me:

Recovering from FAT32, NTFS, exFAT, ext2/3/4

PhotoRec can recover files directly from the free space of these filesystems. Since it specifically targets free space, it primarily recovers deleted files without mixing in non-deleted ones.

Recovering from HFS+ or APFS (macOS Filesystems)

For HFS+ or APFS filesystems, PhotoRec doesn’t differentiate between deleted and non-deleted files. It will recover all files, which might not be ideal if you’re focused on deleted ones.

However, there’s a workaround for HFS+ that allows you to recover only from the free space:

  1. Use blkls from The Sleuth Kit The blkls tool extracts the free space from a filesystem. Install The Sleuth Kit from sleuthkit.org if you haven’t already.

  2. Extract the Free Space Run the following command to create a file (hfsplus_free.dd) containing only the free space:
    blkls /dev/rdisk2s2 > hfsplus_free.dd
    

    Replace /dev/rdisk2s2 with the appropriate device path for your HFS+ partition.

  3. Run PhotoRec With the free space extracted, use PhotoRec to recover files:
    photorec hfsplus_free.dd
    

    This ensures that only the deleted files from the free space are recovered.

By combining these tools, you can target deleted files without cluttering your recovery results with existing ones.

Good luck!