How to Use PhotoRec to Recover Files: A Step-by-Step Guide

PhotoRec is one of the most capable free recovery tools available, and also one of the least friendly to look at. It’s a free, open-source program from CGSecurity that recovers photos, videos, documents, archives, and hundreds of other file types from hard drives, SSDs, USB drives, and memory cards. This guide explains what PhotoRec actually does, walks through using it step by step, and covers the limits you should know before you start.

What is PhotoRec?

PhotoRec is a file carver. Instead of reading the drive’s file system (the index that records file names, folders, and locations), it ignores the file system entirely and scans the raw data for the signatures that mark the start of known file types, such as a JPEG header or a PDF header. When it finds one, it extracts the file from that point.

That design has clear trade-offs:

• It works when the file system is damaged or gone. Formatted drives, RAW partitions, and corrupted memory cards are where PhotoRec shines.
• It loses file names and folders. Because it doesn’t use the file system, recovered files get generic names like f1234567.jpg and land in numbered folders. Expect a sorting job afterward.
• It’s read-only on the source. PhotoRec opens the source drive read-only and writes recovered files only to the destination you choose.

PhotoRec is free, open source, and distributed together with its sister tool TestDisk, which recovers lost partitions. It runs on Windows, macOS, and Linux.

Before you start: three safety checks

1. Stop using the affected drive. Anything new written to it can overwrite the files you want back.
2. Make sure the drive is physically healthy. If it’s clicking, grinding, disconnecting, or freezing the computer, don’t scan it. Read what to do when a hard drive is clicking first.
3. Have a separate destination drive ready with at least as much free space as the data you expect to recover. Never recover files to the same drive you’re scanning.

How to download and install PhotoRec

Download PhotoRec only from the official CGSecurity website (cgsecurity.org). The download is the combined “TestDisk & PhotoRec” package.

Windows

Download the Windows archive, extract it to a folder on a drive other than the one you’re recovering (a USB stick works well), and you’ll find two programs:

• photorec_win.exe, the text-based version
• qphotorec_win.exe, a simpler graphical version (QPhotoRec)

No installation is required. Right-click and run as administrator so PhotoRec can access the disk.

macOS and Linux

You can use the official download, or install from a package manager. On Debian or Ubuntu, PhotoRec is included in the testdisk package. On macOS, it’s available through Homebrew:

# Debian / Ubuntu
sudo apt install testdisk

# macOS with Homebrew
brew install testdisk

# Run PhotoRec with admin rights so it can read the disk
sudo photorec

How to use PhotoRec, step by step

These steps follow the text-based version, which works the same way on every platform. Use the arrow keys to move and Enter to select.

1. Launch PhotoRec with administrator or root rights.
2. Select the disk. PhotoRec lists every drive it can see, with its size and model. Pick the drive that lost data, making sure the size matches, then choose Proceed.
3. Confirm the partition table type if asked. PhotoRec usually detects it correctly (typically Intel for MBR disks or EFI GPT for GPT disks). If you’re unsure, accept the default.
4. Select the partition to scan. If the partition is missing or the drive shows as RAW, choose the entry for the whole disk.
5. Optionally limit file types. Before starting, choose File Opt at the bottom of the screen to select only the types you need (for example, just JPG and CR2 for photos). Fewer types means fewer junk files to sort through. Then choose Search.
6. Choose the file system type. Pick ext2/ext3/ext4 for Linux file systems, or Other for everything else, including NTFS, FAT32, exFAT, and HFS+.
7. Choose Free or Whole.
   • Free scans only unallocated space. Use it for deleted files on a partition that still works. It’s faster and avoids recovering files you still have.
   • Whole scans the entire partition. Use it for formatted, RAW, or corrupted partitions.
8. Choose the destination folder. Navigate to a folder on a different drive and press C to confirm. PhotoRec will warn you if you pick the same drive, and you should take that warning seriously.
9. Wait. PhotoRec shows a running count of recovered files by type. A large drive can take many hours.

Using QPhotoRec (the graphical version)

QPhotoRec follows the same logic in a single window: select the disk from the drop-down, highlight the partition, choose the file system type, choose Free or Whole, click Browse to pick a destination on another drive, optionally click File Formats to narrow the types, and then click Search.

How to sort PhotoRec results

PhotoRec saves files into folders named recup_dir.1, recup_dir.2, and so on, inside your destination folder. Every file has a generic name. A few ways to make sense of them:

• Sort by type first. Search the destination for one extension at a time (*.jpg, *.docx, *.mp4) and move matches into their own folders.
• Use photo metadata. Most photo management apps can sort images by the date taken stored inside the file, which brings back a rough timeline.
• Sort by size to cut junk. Very small images are often thumbnails, icons, or browser cache. Very large files are worth checking first.
• Open a sample of each type to confirm files are intact before you spend time organizing them.

Expect plenty of files you didn’t know were there, such as system files, cached web images, and older deleted copies. That’s normal for file carving.

For more on photo-specific recovery, including camera cards and phone backups, see how to recover deleted photos.

PhotoRec limitations

Fragmented files

PhotoRec works best when a file is stored in one continuous block. Large files that were split across the disk, which is common for videos and big documents on a well-used drive, may come back partly corrupted: a photo with a gray band, a video that plays for a few seconds, a document that won’t open.

SSDs and TRIM

On most modern SSDs, deleted data is cleared by the drive itself soon after the operating system sends a TRIM command. If the blocks have been cleared, there’s nothing for PhotoRec to find. Recovery from SSDs is much less reliable than from hard drives or memory cards.

Failing drives: image first

A full PhotoRec scan reads every sector, which is hard on a drive that’s already weak. If a drive is showing read errors or slowdowns but still works, the safer approach is to image it first with a tool like GNU ddrescue, then run PhotoRec on the image file instead of the drive.

# Example only: replace /dev/sdX with the correct source disk.
# Check the device name carefully. Swapping source and destination will destroy data.
sudo ddrescue -n /dev/sdX /mnt/backup/disk.img /mnt/backup/disk.map

# Then point PhotoRec at the image instead of the drive
sudo photorec /mnt/backup/disk.img

If the drive is clicking, not detected, or dropping offline, don’t image it yourself. Every read attempt on a mechanically failing drive risks further damage.

When to use something else

• A lost or deleted partition where you’d like to keep file names and folders: try TestDisk first.
• A quick format on a healthy drive: a file-system-aware tool may restore names and folders. See accidentally formatted drive recovery.
• Not sure which tool fits: see our guide to the best data recovery software.

The bottom line

PhotoRec is a powerful, free, open-source recovery tool that finds files by their signatures even when the file system is damaged or gone. Download it from cgsecurity.org, run it from a different drive, choose Free or Whole based on what happened, and always save recovered files to a separate drive. Expect to lose file names, expect some damaged files on fragmented or SSD-based data, and image a weak drive before you scan it.

If the drive is failing or PhotoRec can’t find what you need, our hard drive recovery service can help. It’s one flat $1,200 rate for a single device, with free prepaid shipping, and you pay only if we recover your data.