This copies the recovered file to their file type folder in the destination directory. If no date from the past can be detected, these jpgs are put into one folder to be sorted manually. Then, files are distinguished by the year and, in case the recovered file is an image, by month as well when they have been taken and by the event. This program copy the files to own folders for each file type.

In order to perform this tedious task, my suggestion is to use a python script originally developed by Chris Magnuson and enhanced by Lukas Hahmann, sort-PhotorecRecoveredFiles. So, the best way to organize this files is order them by date and extension. However, after the recovering process terminates, the output is a big list of files, named with the prefix “f” plus an identifying number (just some also have the original name after the number). The usage is really simple: you can follow the useful guide on CGProject website, or this video: For lost/deleted partitions or deleted files from a FAT or NTFS file system, try TestDisk first - it’s usually faster and TestDisk can retrieved the original file names. PhotoRec is a companion program to TestDisk, an application for recovering lost partitions on a wide variety of file systems and making non-bootable disks bootable again. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media’s file system has been severely damaged or reformatted. PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory.

The tool that I prefer to perform this kind of tasks is PhotoRec, developed by CGSecurity.

During a forensic analysis, but also during other simple tasks (like helping a friend to recover deleted files), is useful to have a trusted tool to perform file-carving and data recovery.

Testdisk photorec