PhotoRec GUI Hands on Labs¶

Practise recovering and reviewing project files in your browser, or use QPhotoRec and a checked raw training image for the Full Lab.

Interactive Lab¶

Browser practice

PhotoRec GUI Interactive Lab

No installation

The Aster team is missing a review document and a picture. File records did not recover them. Search the checked image copy with QPhotoRec, inspect the results and give the next analyst the useful files and your notes.

Browser exercise · The window follows QPhotoRec's controls. Recovery uses a 4 MiB sample and an example partition map, not a real disk image or the PhotoRec engine. The PDF and JPG downloads are harmless training files.

Step 1 of 4Set up the recovery

Select Add a raw disk image... from the media list.

1Set up
2Recover
3Check files
4Hand over

Show hint

Start by adding the raw image.

SUSA-PR-043 · Aster projectFind: JPG and PDF contents

Full Lab¶

Self hosted / real file recovery

Windows VM + QPhotoRec

Case SUSA-PR-042 / missing project files

Recover the project files, then check what you found.

The Aster team reports a missing picture and review document on a USB drive. You have permission to examine a training image of that drive. Recover the contents with QPhotoRec, spot duplicate results and leave the next analyst checked files and a short note.

Tick each box after saving its files or notes. This page saves your ticks, but cannot check QPhotoRec or your workstation.

Case brief¶

Your taskRecover the missing JPG and PDF contents. Keep the generated names and explain what the files do and do not tell you.

What you will use

A small raw image, QPhotoRec and PowerShell checks. No disk mounting, formatting or malware analysis is needed.

In this case: the original is kept separately and examination is approved. This image is a self created training fixture, not an acquired USB drive. In real work, record the actual source and permission; try file record recovery first when usable records can preserve names and paths.

Before you start¶

You need: a disposable Windows analysis VM, Windows PowerShell 5.1 and QPhotoRec from the official TestDisk download. Follow Install and open first. Use a new case folder on NTFS analysis storage, shown here as E:\SUSA-PR-042, with at least 500 MiB free. Change the case path if your analysis storage uses another letter. Allow about 20 to 30 minutes after installation.

Download: Aster training image ZIP · ZIP checksum. Save the ZIP in your Windows Downloads folder. The small archive expands to a 17 MiB raw image with one 16 MiB FAT16 partition labelled ASTER-USB, plus source notes and known file hashes. The image was checked with PhotoRec 7.2's engine. The real GUI and counts can vary by build; record yours.

How to follow: open one step at a time and check its Look for result. The commands only check/copy files and write case records. Use QPhotoRec for recovery and an isolated viewer for the harmless JPG/PDF. You will save a recovery inventory, two unique file contents and a handover.

Why is the image FAT16, and where should output go?

FAT16 keeps this USB style fixture small and quick to scan. The browser exercise uses an example NTFS partition; both use QPhotoRec's FAT/NTFS/HFS+/ReiserFS/... option. Free searches space the file system marks as unused. Whole also searches current files.

Here, the searched USB file system is inside aster-usb.dd. The recovery folder is outside that image on your analysis storage. Do not mount the image and write into its volume. When recovering directly from original physical media, save output to a different physical device; use your evidence handling procedure and preserve the original first.

A SHA-256 hash is a fingerprint of file contents. Matching the source and copy checks that copy; it does not establish the quality of a real acquisition. The supplied file catalog is a training baseline for comparing recovered bytes, not file metadata restored by carving.

Activity 1: Prepare the image¶

First resultA checked working copy and a new case folder.

1. Check the download and make a working copy

Open Windows PowerShell 5.1. Set $prCase to a new folder on your analysis storage. If Windows saved the ZIP elsewhere or renamed it, change $prArchive too. Keep the ZIP and extracted original; use only the working copy in QPhotoRec.

$prCase = 'E:\SUSA-PR-042'
$prArchive = Join-Path ([Environment]::GetFolderPath('UserProfile')) 'Downloads\aster-photorec-training.zip'
$prExpectedZip = '2C034DBDD574D046FAC6EF8A307228953DBC03C32CA299A618AB798F84C70B4C'
if ($PSVersionTable.PSVersion.ToString() -notlike '5.1.*') { throw 'Open Windows PowerShell 5.1.' }
if (Test-Path -LiteralPath $prCase) { throw 'Case folder already exists. Keep it and choose a new folder.' }
$prZipHash = Get-FileHash -Algorithm SHA256 -LiteralPath $prArchive -ErrorAction Stop
if ($prZipHash.Hash -ne $prExpectedZip) { throw 'Download hash differs. Keep the check and download the intended training ZIP again.' }
New-Item -ItemType Directory -Path "$prCase\original", "$prCase\working", "$prCase\recovered\attempt-1", "$prCase\review", "$prCase\notes" -ErrorAction Stop | Out-Null
Expand-Archive -LiteralPath $prArchive -DestinationPath "$prCase\original" -ErrorAction Stop
$prFixture = Get-Content -LiteralPath "$prCase\original\fixture.json" -Raw -ErrorAction Stop | ConvertFrom-Json
$prOriginal = "$prCase\original\aster-usb.dd"
$prWorking = "$prCase\working\aster-usb.dd"
$prOriginalHash = Get-FileHash -Algorithm SHA256 -LiteralPath $prOriginal -ErrorAction Stop
if ($prOriginalHash.Hash -ne $prFixture.imageSHA256) { throw 'Original differs from the fixture hash. Keep it and stop.' }
Copy-Item -LiteralPath $prOriginal -Destination $prWorking -ErrorAction Stop
$prCopyHash = Get-FileHash -Algorithm SHA256 -LiteralPath $prWorking -ErrorAction Stop
@($prOriginalHash, $prCopyHash) | Export-Csv -LiteralPath "$prCase\notes\before-sha256.csv" -NoTypeInformation
if ($prOriginalHash.Hash -ne $prCopyHash.Hash) { throw 'Working-copy hash differs. Keep the failed check and stop.' }
$prZipHash | Export-Csv -LiteralPath "$prCase\notes\download-sha256.csv" -NoTypeInformation
@(
    'Case: SUSA-PR-042; permission: this training image only'
    'Source: SUSA self-created Aster USB fixture v1; not an acquisition'
    "Examiner: $env:USERNAME; analysis computer: $env:COMPUTERNAME"
    "UTC: $((Get-Date).ToUniversalTime().ToString('o')); workstation time zone: $((Get-TimeZone).Id)"
    "Original: $prOriginal; bytes: $((Get-Item -LiteralPath $prOriginal).Length)"
    "Working copy: $prWorking; format: raw dd; FAT16 partition: ASTER-USB"
    "Recovery: $prCase\recovered\attempt-1; review: $prCase\review\attempt-1"
) | Set-Content -LiteralPath "$prCase\notes\case-context.txt"
@($prOriginalHash, $prCopyHash) | Format-Table Path, Hash -AutoSize

Look for: two matching image hashes, the original source files and a separate working image. README.txt explains the fixture and known-files.csv holds the baseline hashes. Do not mount or repair either image.

2. Open QPhotoRec and finish the starting notes

Open qphotorec_win.exe from your extracted TestDisk package. Use About to check the tool and record the actual version, executable path, download source and package name in notes\case-context.txt. The main window should show the media list, partition table, file system choices, destination and bottom buttons together.

Check that recovered\attempt-1 is empty. It is a new output folder outside the image. Add the case question to your notes: Can I recover the missing project picture and review document, and what original context is still unknown?

Look for: a recorded version and clear working/output paths. A drive in QPhotoRec's media list is not automatically the case source; add the checked raw file in the next activity.

Ready to recover I saved the download/source checks and confirmed the working copy matches the original. I recorded the version, source, permission, time zone and empty recovery folder.Pause point: keep the case folder. Continue with its working image; do not rerun the new case block over an existing case.

Next: select the image, partition and recovery settings.

Continue to recovery

Activity 2: Recover the files¶

Next resultA completed recovery, with saved settings and an inventory of the output.

1. Set up and run the Free space recovery

In the media dropdown, choose Add a raw disk image... and open E:\SUSA-PR-042\working\aster-usb.dd using your actual case path. Confirm the image is about 17 MiB. Do not select the analyst's physical disk.
Select the FAT16 partition labelled ASTER-USB, about 16 MiB. The whole disk/No partition row is not this partition.
Choose FAT/NTFS/HFS+/ReiserFS/... and Free. This intact file system marks the deleted files' space as unused.
Open File Formats. Select Reset, tick jpg and pdf, then select OK. Confirm the choices before closing the dialog.
Select Browse and choose your empty recovered\attempt-1 folder. Save a screenshot of the settings and note the source path, partition, family, area, formats, destination and UTC start time.
Select Search. Wait for completion, then record the UTC finish time, actual counts by type, final message and any errors. Save a screenshot. Keep report.xml or session/log files if your build produces them; record their locations. A stopped run is not a completed scan.

Look for: generated recup_dir.* folders with candidate JPG/PDF files. A checked PhotoRec 7.2 run recovered one JPG and two identical PDFs from this fixture. Counts and names can vary; judge the result by the saved files and hashes, not a fixed browser lab count.

Search is unavailable, or no expected files appear

Check that you added the working .dd, selected the FAT16 partition and chose an accessible destination. If Free is disabled, check the selected row and your build; do not silently switch to Whole and call it the same run. Keep any failed run and messages. Fix the settings, create a fresh folder such as attempt-2 and record the retry. Do not format, mount writable or repair the image to force a result.

2. Save an inventory before opening the files

Exit QPhotoRec after completion. In PowerShell, set the case path again if you resumed later. Use the actual attempt folder if you retried. This records every output file, including reports, without executing it.

$prCase = 'E:\SUSA-PR-042' # Use your actual case path.
$prRecovered = "$prCase\recovered\attempt-1"
$prFiles = @(Get-ChildItem -LiteralPath $prRecovered -File -Recurse -ErrorAction Stop)
if ($prFiles.Count -eq 0) { throw 'No recovery files found. Keep the run record and check the settings.' }
$prInventory = @($prFiles | ForEach-Object {
    [pscustomobject]@{
        RelativePath = $_.FullName.Substring($prRecovered.Length + 1)
        Extension = $_.Extension
        Bytes = $_.Length
        SHA256 = (Get-FileHash -Algorithm SHA256 -LiteralPath $_.FullName -ErrorAction Stop).Hash
    }
})
$prInventory | Export-Csv -LiteralPath "$prCase\notes\recovered-inventory.csv" -NoTypeInformation
$prInventory | Group-Object Extension | Select-Object Name, Count | Format-Table -AutoSize

Look for: notes\recovered-inventory.csv with generated paths, sizes and hashes. Compare the JPG/PDF counts with the recorded recovery result; reports are separate output types. Preserve the original recovered folders before reviewing copies. A .jpg or .pdf extension alone does not prove a complete file.

Recovery saved I saved the source/partition settings, start and finish times, completion status and actual errors/counts. I kept the recovered output and saved its paths, sizes and SHA-256 inventory.Pause point: keep the attempt folders and notes. A retry uses a new output folder and a new inventory; retain the earlier record too.

Next: check a review copy and read the useful contents.

Continue to file checks

Activity 3: Check and hand over¶

Final resultReadable project contents, a duplicate check and a handover the next analyst can follow.

1. Make a checked review copy and compare the files

This block copies the attempt folder into review, checks each copy against the saved inventory and compares recovered hashes with the fixture's baseline. Keep the original generated names. It refuses to overwrite an earlier review copy.

$prCase = 'E:\SUSA-PR-042'
$prRecovered = "$prCase\recovered\attempt-1"
$prReview = "$prCase\review\attempt-1"
if (Test-Path -LiteralPath $prReview) { throw 'Review folder already exists. Keep it and choose a new review folder.' }
$prInventory = @(Import-Csv -LiteralPath "$prCase\notes\recovered-inventory.csv" -ErrorAction Stop)
if ($prInventory.Count -eq 0) { throw 'Recovery inventory is empty. Keep the records and check the run.' }
Copy-Item -LiteralPath $prRecovered -Destination $prReview -Recurse -ErrorAction Stop
$prCopyChecks = @($prInventory | ForEach-Object {
    $prCopyHash = (Get-FileHash -Algorithm SHA256 -LiteralPath (Join-Path $prReview $_.RelativePath) -ErrorAction Stop).Hash
    [pscustomobject]@{ RelativePath = $_.RelativePath; SHA256 = $prCopyHash; MatchesRecovery = $prCopyHash -eq $_.SHA256 }
})
$prCopyChecks | Export-Csv -LiteralPath "$prCase\notes\review-copy-checks.csv" -NoTypeInformation
if (@($prCopyChecks | Where-Object MatchesRecovery -EQ $false).Count) { throw 'A review copy differs. Keep the failed checks and investigate.' }
$prKnown = @(Import-Csv -LiteralPath "$prCase\original\known-files.csv" -ErrorAction Stop | Where-Object Deleted -EQ 'true')
$prComparison = @($prInventory | Where-Object { $_.Extension -in '.jpg', '.pdf' } | ForEach-Object {
    $prCandidate = $_
    $prMatches = @($prKnown | Where-Object SHA256 -EQ $prCandidate.SHA256)
    [pscustomobject]@{ RelativePath = $prCandidate.RelativePath; SHA256 = $prCandidate.SHA256; MatchesKnownContent = $prMatches.Count -gt 0; KnownRoles = ($prMatches.Role -join '; ') }
})
$prComparison | Export-Csv -LiteralPath "$prCase\notes\known-content-comparison.csv" -NoTypeInformation
$prComparison | Format-Table RelativePath, MatchesKnownContent, KnownRoles -AutoSize
$prInventory | Where-Object { $_.Extension -in '.jpg', '.pdf' } |
    Group-Object SHA256 | Where-Object Count -GT 1 | ForEach-Object { $_.Group | Select-Object RelativePath, Bytes, SHA256 }

Look for: matching recovery/review hashes and known content matches for the project picture and document. The two PDF candidates in the checked fixture have the same bytes. Keep both recovered candidates and their paths in the original output, but list one unique document in the handover. Matching content does not prove two candidates belonged to different original files.

Open the review copies with isolated JPG/PDF viewers. The picture mentions a pending access review. The document mentions a USB copy and a missing approval reference. Save the generated file paths and what you actually read in notes\file-review.txt. Do not treat these statements as proof of data theft or the person involved.

If a comparison fails or a viewer cannot read a file, keep that result. Check the format, size, source settings and recovery messages. A readable preview and a matching known hash are different checks. Do not edit or convert the protected recovered original to make it match.

2. Write the handover and check the image stayed unchanged

Save notes\handover.txt using your actual results:

Case SUSA-PR-042
Source: [training fixture; original/working paths; size; starting hashes]
Recovery: [QPhotoRec version; partition; family; area; formats; destination; times]
Results: [actual counts; errors, failed runs or retries; inventory location]
Useful contents: [generated JPG/PDF paths; what they say; known-hash comparison]
Duplicates or damaged files: [paths, hashes and checks; keep the original output]
Still unknown: [original name/folder, deletion time, actor and intent]
Next check: [a specific record and why it would help]
Final checks: [image hashes after recovery; checked review-copy location]

The contents give the team a lead about access approval and a USB copy. In a real incident, the next analyst could check the approval log and workstation USB connection records. Generated file names and output modification times do not establish the original folder or deletion time. Embedded document/photo times may survive; label their source and check them before relying on them.

With QPhotoRec closed, compare the original and working image with their saved starting hashes:

$prCase = 'E:\SUSA-PR-042'
$prBefore = @(Import-Csv -LiteralPath "$prCase\notes\before-sha256.csv" -ErrorAction Stop)
if ($prBefore.Count -ne 2) { throw 'Expected the saved original and working-image records.' }
$prAfter = @($prBefore | ForEach-Object {
    $prHash = Get-FileHash -Algorithm SHA256 -LiteralPath $_.Path -ErrorAction Stop
    [pscustomobject]@{ Path = $_.Path; SHA256 = $prHash.Hash; MatchesBefore = $prHash.Hash -eq $_.Hash }
})
$prAfter | Export-Csv -LiteralPath "$prCase\notes\after-sha256.csv" -NoTypeInformation
if (@($prAfter | Where-Object MatchesBefore -EQ $false).Count) { throw 'An image changed. Keep all checks and investigate before handover.' }
$prAfter | Format-Table Path, MatchesBefore -AutoSize

Look for: both image checks say True, plus a short handover that names the saved files, separates findings from assumptions and gives a useful next check. Missing or damaged output is a valid result to report; do not invent files or tick a successful recovery checkpoint after a failed check.

Ready to hand over I checked the review copies, read the useful contents, compared their known hashes and recorded any duplicates or failures. I saved the handover and confirmed the original/working image hashes stayed unchanged.Keep the full attempt folders, review copy, inventories and notes before restoring the VM.

Next: review the saved case files before closing the lab.

Review the case files

Check your case files¶

Files to keep0 of 6 evidence checkpoints marked.

Starting recordTraining source, permission, tool version, paths and download/original/copy hashes.
Recovery outputAttempt folders, settings/screenshots, run notes, errors and recovered file inventory.
Checks and handoverReview copies, copy/known-content checks, duplicate notes, final image hashes and handover.

Before restoring the VM: keep the complete case on storage that survives the restore, and check that its files still open.

Optional: compare Free with Whole

Keep your Free space run. Create an empty recovered\whole-attempt-1 folder, select the same image, FAT16 partition and formats, and change only Free to Whole. Record that new scope and output location before scanning.

To inventory this attempt, reuse Activity 2's inventory block with $prRecovered ending in whole-attempt-1 and change the CSV filename to whole-inventory.csv. Keep the core inventory. Compare hashes with all rows in known-files.csv, including allocated-control; omit the Deleted filter if you adapt the comparison block. A checked 7.2 run recovered an extra current PDF with Whole. Read its contents and explain why a Whole result is not proof that a file was deleted. Keep both run records and repeat the image hash checks after the extra scan.

Finish: keep the case before restoring Windows

Check the saved case

Open the retained inventory, handover and harmless review copies from storage outside the VM's rollback disk before restoring the clean snapshot.

Keep the ZIP, original image, working copy, complete recovered attempt folders, review copies and notes. Retain failed attempts with an explanation. Reset progress clears this page's ticks; it does not delete your files.

This exercise uses small contiguous files in an intact FAT16 fixture. It does not guarantee recovery of overwritten or fragmented data. Continue with Recover and review, or Autopsy to compare file content with file system records and original context.