Lion Cipher Lab

Recover deleted files with PhotoRec (and TestDisk)

• Digital Forensics & IR (DFIR)
• Intermediate
• ~45 min
• Free · no account required

Why it matters

"I deleted the wrong folder" and "the card says it's empty but the photos were on it" are two of the most common real emergencies you will ever be asked to help with, and the reassuring truth is that a deleted file is usually not gone at all. Deleting normally just tells the filesystem the space is free to reuse, while the actual bytes sit on the disk untouched until something else happens to write over them. That single fact powers two whole disciplines: data recovery (getting a person's lost files back) and digital forensics (proving what was on a device, including what someone tried to…

What you'll learn

• understanding why deleted files are recoverable
• the ideas of sectors, unallocated space, and slack space
• file signatures and file carving
• installing PhotoRec and TestDisk (the testdisk package)
• safely building a small test disk image to practise on
• carving deleted files back with PhotoRec
• recovering to a separate disk to avoid overwriting evidence

Steps in this lab

1. First, the only two rules that matter here
2. Why "deleted" almost never means "gone"
3. What PhotoRec and TestDisk are, and installing them
4. Build a safe practice disk you own
5. Put real files on it, then delete them
6. Run PhotoRec and carve the files back
7. See what came back, and understand what carving can and cannot do
8. Why this small skill is a real DFIR foundation

Open the full interactive lab →