PhotoRec: Limits of File and Folder Recovery

Content, very often yes. Filenames, folders, and dates, quite possibly never. Understanding why that split exists is the difference between a recovery that ends well and a client who feels blindsided at handover.

A typical NTFS drive engagement starts the same way: an external disk that Windows suddenly reports as RAW, years of office documents on it, no backup. The client's question is always "can you get my files back?" The honest answer has two halves, and both need saying up front.

Image the drive before attempting repair

Carving retrieves files from their content signatures after filesystem recovery fails. Stop using the source drive. Create a sector image and run experiments on a working copy you can recreate. Commands such as ntfsfix write changes; do not use them on the only data source. For signs of physical damage or critical data, assess specialist recovery first because even reading can worsen the drive’s condition.

An NTFS volume that will not mount may still have its Master File Table (MFT), which records file names and locations. Inspection or repair on a copy sometimes restores access with names and folders. ntfsfix is not a full NTFS checker and does not guarantee recovery. If the structure cannot be recovered, run PhotoRec on the image and save results to separate media. PhotoRec’s documentation explains its filesystem-independent recovery approach.

How signature carving works

Picture a book with its title page torn out. You can still recognize the content from the writing style and each chapter's opening lines. That's close to what PhotoRec does with files.

When the filesystem is truly gone, PhotoRec ignores it entirely, scanning the raw sectors for signatures — the magic bytes that begin known file formats. A ZIP container (which is what a .docx or .xlsx really is) starts with PK; a JPEG starts with FF D8; a PDF with %PDF. When a signature appears, PhotoRec reads forward until the format's end marker or until the data stops making sense. Then it writes the result out as a recovered file.

This is why carving works at all when nothing else does: file content lives in data clusters. Those clusters are usually untouched even when the structures that named and organized them are destroyed.

Metadata carving does not restore

Original filesystem names, directory structure, and timestamps are recorded in NTFS metadata such as the MFT. Some formats also contain internal names or dates, a separate source. If the original metadata and other usable copies are no longer available, content carving cannot recreate the original directory tree. Embedded document metadata may still help identify files.

What you get instead is PhotoRec's output naming scheme: f0030136.docx, f0030194.xlsx, thousands of them, in flat numbered directories.

On the engagement this framing comes from, roughly 1,600 office documents came back intact and readable. Every one of them nameless. That is a successful carve. It is also, to a client expecting their folder tree, a shock — which is why the conversation about it happens before the work, not after.

Triaging thousands of nameless files

A pile of f*.docx files is not a deliverable; the triage is where the service earns its fee.

1. Sort by type and size first. PhotoRec assigns extensions from recognized signatures; validate that each recovered file opens and contains usable data. Tiny files are usually templates and fragments; the client's real work concentrates in the middle of the size distribution.
2. Mine the internal metadata. Office formats carry author, title, and creation date inside the ZIP container, and those survive carving. A script can read docProps/core.xml from each document. Renaming the file from its embedded title and date rescues a surprising share of the collection.
3. Full-text index the rest. For files with no useful metadata, indexing the extracted text lets the client search by what they remember — a project name, a client, an address. That beats scrolling thumbnails.

Where carving struggles: fragmentation

Signature carving works best when a file's clusters are contiguous; PhotoRec can recover some fragmented files, but this is format-dependent. A fragmented file has its beginning in one place and its continuation somewhere else. This is common for large, long-lived documents and mailbox files on a drive that ran near capacity. PhotoRec reads straight across the gap into unrelated data.

The result is a file that opens but turns to garbage partway through, or does not open at all. Small files fragment rarely, which is why office documents carve well and multi-gigabyte PST archives and videos carve badly.

Setting expectations

Before starting any carving engagement, the client hears the same summary. Content may be recoverable; original names and folders may be unavailable, and fragmented files may be partial, and the deliverable includes triage, not just a dump.

Agreeing on that up front turns "you lost my filenames" into "you told me this would happen, and the search index covers it." In recovery work, the technical outcome is fixed by physics — the client experience is fixed by the briefing.

The takeaway

Preserve a source image, then attempt filesystem recovery on a working copy; carve only when the structures are truly gone. Carving trades metadata for content: what a file was called is lost, what it contained may survive if the data has not been overwritten and can be assembled correctly. Plan the triage as part of the job, and brief the client before the first sector is read. Do that, and a nameless pile of 1,600 documents becomes a searchable archive instead of a disappointment.