recovering-deleted-files-with-photorec

recovering-deleted-files-with-photorec is a skill for Claude Code, Codex from adriannoes/awesome-agentic-ai. It costs 35 tokens per session (2,517 once invoked), scanned B, original, MIT.

A file-recovery guide using PhotoRec, a tool that reconstructs files from raw disk data by recognizing file signatures. It can work even when a filesystem is damaged, formatted, or missing.

In plain words
What is it for?
Use it on forensic disk images, memory cards, USB drives, and hard disks, preferably through read-only access during an investigation.
Why use it?
It can recover documents, images, videos, and databases when normal filesystem records are unavailable, although overwritten data may not be recoverable.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Use it on forensic disk images, memory cards, USB drives, and hard disks, preferably through read-only access during an investigation.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/adriannoes/awesome-agentic-ai/recovering-deleted-files-with-photorec
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add adriannoes/awesome-agentic-ai --skill recovering-deleted-files-with-photorec
Clone the repo
git clone --depth 1 https://github.com/adriannoes/awesome-agentic-ai

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for recovering-deleted-files-with-photorec

README.md
[![agentmods](https://agentmods.dev/badge/skills/adriannoes/awesome-agentic-ai/recovering-deleted-files-with-photorec/github.svg)](https://agentmods.dev/skills/adriannoes/awesome-agentic-ai/recovering-deleted-files-with-photorec)
Your own site
<a href="https://agentmods.dev/skills/adriannoes/awesome-agentic-ai/recovering-deleted-files-with-photorec"><img src="https://agentmods.dev/badge/skills/adriannoes/awesome-agentic-ai/recovering-deleted-files-with-photorec/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for recovering-deleted-files-with-photorec

Your own site · 80×15
<a href="https://agentmods.dev/skills/adriannoes/awesome-agentic-ai/recovering-deleted-files-with-photorec"><img src="https://agentmods.dev/badge/skills/adriannoes/awesome-agentic-ai/recovering-deleted-files-with-photorec.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 35 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,517 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 4 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium Privilege Escalation · line 52
    Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
    Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
  • medium Privilege Escalation · line 64
    Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
    Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
  • medium Privilege Escalation · line 61
    Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
    Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
  • medium Privilege Escalation · line 96
    Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
    Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00035 $0.02517
Opus 5 $0.00017 $0.01259
Sonnet 5 $0.00007 $0.00503
Haiku 4.5 $0.00003 $0.00252

Measured 9d ago against content hash f2d5b9890617, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade B, and why

recovering-deleted-files-with-photorec scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/agent.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

- Root/sudo privileges for device access
cursor-claude-codex/skills/anthropic-cybersecurity-skills/skills/recovering-deleted-files-with-photorec/SKILL.md · 252 lines

How it starts

The opening of the file, as written. The whole thing — 252 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Recovering Deleted Files with PhotoRec

When to Use

  • When recovering deleted files from a forensic disk image or storage device
  • When the file system is corrupted, formatted, or overwritten
  • During investigations requiring recovery of documents, images, videos, or databases
  • When file system metadata is unavailable but raw data sectors remain intact
  • For recovering files from memory cards, USB drives, and hard drives

Prerequisites

  • PhotoRec installed (part of TestDisk suite)
  • Forensic disk image or direct device access (read-only)
  • Sufficient output storage space (potentially larger than source)
  • Write-blocker if working with original media
  • Root/sudo privileges for device access
  • Knowledge of target file types for focused recovery

Workflow

Step 1: Install PhotoRec and Prepare the Environment

# Install TestDisk (includes PhotoRec) on Debian/Ubuntu
sudo apt-get install testdisk

# On RHEL/CentOS
sudo yum install testdisk

# On macOS
brew install testdisk

# Verify installation
photorec --version

# Create output directory structure
mkdir -p /cases/case-2024-001/recovered/{all,documents,images,databases}

# Verify the forensic image
file /cases/case-2024-001/images/evidence.dd
ls -lh /cases/case-2024-001/images/evidence.dd

Step 2: Run PhotoRec in Interactive Mode

# Launch PhotoRec against a forensic image
photorec /cases/case-2024-001/images/evidence.dd

# Interactive menu steps:
# 1. Select the disk image: evidence.dd
# 2. Select partition table type: [Intel] for MBR, [EFI GPT] for GPT
# 3. Select partition to scan (or "No partition" for whole disk)
# 4. Select filesystem type: [ext2/ext3/ext4] or [Other] for NTFS/FAT
# 5. Choose scan scope: [Free] (unallocated only) or [Whole] (entire partition)
# 6. Select output directory: /cases/case-2024-001/recovered/all/
# 7. Press C to confirm and begin recovery

# For direct device scanning (with write-blocker)
sudo photorec /dev/sdb

Step 3: Run PhotoRec with Command-Line Options for Targeted Recovery

Read the full file on GitHub · 252 lines

Files

What ships with it

3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago First seen · 252 lines · 35 tokens per session scan B f2d5b9890617

Subscribe to this mod's changes

recovering-deleted-files-with-photorec is a skill published in the GitHub repository adriannoes/awesome-agentic-ai (57 stars, last pushed 14d ago), licensed MIT. It adds 35 tokens to every session and 2,517 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

importing-a-codebase

Use when the repo holds real source code but no specs: the existing-codebase branch of setting-up-a-project, normally reached via that dispatcher, directly only when the situation is unmistakable. Not for empty workspaces (starting-a-new-project) or feature work in a specced project (brainstorming).

JetBrains/thinkrail · 69 tokens

starting-a-new-project

Use when the workspace is empty — no code yet — and the user brings a raw idea: the brand-new branch of setting-up-a-project, normally reached via that dispatcher, directly only when the situation is unmistakable. Not for features in an existing project — use brainstorming instead.

JetBrains/thinkrail · 61 tokens

todos

This chat has a shared, live TODO plan — your tasks for the conversation, which the user also edits. Read this skill and reach for the todo tools whenever a request takes more than a couple of steps. It covers the plan model (group = task, items = its steps; loose items are the user's lane), how to work it: propose…

JetBrains/thinkrail · 127 tokens

writing-workflow-skills

Use when adding a new workflow skill to pi-thinkrail-workflow, changing an existing workflow skill's role, trigger, handoff, or structure, or checking a workflow skill against the workflow system's rules. Not for authoring general-purpose skills outside this package.

JetBrains/thinkrail · 60 tokens

brainstorming

Use this BEFORE any creative or feature work: building a new feature, adding functionality, changing behavior, or making a nontrivial design decision. Turns the user's request into a validated design — recorded as a spec-graph task-spec — before any implementation. Do not skip this because a change looks small.

JetBrains/thinkrail · 65 tokens

reviewing-changes

Use when a review package asks you to review a plan step's change set (todo.startReview): you are the REVIEWER, not the author. How to judge an agent-written diff, file findings with addreviewcomment, and settle with exactly one reviewverdict.

JetBrains/thinkrail · 59 tokens