Now before you ask, no, they didn’t have a backup, and if I admonished them it would do nothing. And no, this isn’t some random stranger thank God.
Yes I know of scalpel and other things like it but it seems to bring back ALL the old stuff including windows crap.
Is it possible to filter out specific stuff (specifically pictures and videos)? Sorry, having to find the headers and tails of each file doesn’t sound like a good use of time.
Testdisk and Photorec may be appropriate…
The testdisk package includes the photorec tool.
Turn off the computer right away (the less it stays on, the better) and take it to a data recovery expert to examine it if it is possible to recover any data from it.
If you have to ask on the forum about it, you are not qualified to do data recovery, and the only thing you are likely to do is make the data even more unrecoverable.
Also, if I may add, it was your responsibility to ask the user whether they have all important data backed up before attempting to install an OS to their computer and whether they are willing to accept the risk of losing it by not having it backed up. The very least you can do now is cover the costs of professional data recovery (if that is at all possible), and not destroy the data by attempting it yourself.
This is not how we get people to use Linux.
Well when I tried (using scalpel, live env didn’t help, it showed everything but never saved) it DID bring back many photos, meaning it was only the partition table and the first few GB of data destroyed.
It seems they are lucky and the photos were at the end of the disk.
I wasn’t forcing them to use Linux (lol), I just convinced them to use it since I know they were sick of auto updates that take ages and that it’s faster.
And yes, I did have MANY disclaimers.
by “didn’t admonish” i mean that i didn’t give them a full backup lecture.
local storage wasn’t an option, I had no space.
hell the cloud wasn’t an option due to crappy internet at the time.
the live env did “recover” photos on to the client’s flash drive (which i borrowed) but it never saved any writes for some reason.
Oh and keep in mind that right now im in Jordan I don’t know of any professional data recovery services at all. If there are they are probably going to just wipe the OS. Linux usage is probably 0 (on the desktop) Shipping the computer isn’t an option.
AFAIK the right thing to do is NOT to turn off the PC because deleted data might still be cached, but I am no expert so take this with a grain of salt.
This is the only really good answer.
Brimg it to someone to fix.
the thing is I could recover photos. So it IS possible.
Not in most cases. Since the partitions were changed and formatted, the most important thing is to stop additional writes to the that disk. Otherwise, more of the data would be overwritten.
Tools like scalpel can read the data even if the partition table is wiped.
But they can’t read the old data on blocks that have been overwritten with new data… which can happen pretty easily.
Yes I get that. Since PhotoRec could see the photos AND windows crap they are likely at the end of the disk.
My question was how to get PhotoRec to only recover photos.
I understand that. The point was, the sooner you shutdown the system and boot off another device, the greater chance that recovery tools can recover data before it is overwritten.
I get that as well. Unfortunately, I already installed an OS to the laptop. Now when I go back and deal with the issue since only part of the disc was overwritten it should recover like it did last time.
TL;DR I can recover stuff but it keeps trying to recover random windoze exe’s and dll’s too.
Can you not specify filetypes in Photorec?.. although I’m confused as your OP says you were using scalpel but you mention Photorec in a later post?
I’ve used scalpel but then I just then used PhotoRec. Sorry scalpel, I am NOT getting headers and tails for you.
Keep playing with it and you won’t be able to recover anything. You need to know how to use the recovery tools intended for that purpose. The more you keep accessing the data and trying to recover files when you are not familiar or don’t know how to use it then you won’t be able to.
Also weirdly no one mentioned to create a disk image…
indeed… the first thing to do is to not us the drive itself to rescue and use a copy instead… but as already mentioned… someone never done such recovery will not get the files back in most cases.
It is a job for professionals.
Right now I don’t even have the computer in question.
So I can’t possibly be able to “play with it”.
Oh and I’m not trying to recover files on the drive using the same drive, that’s stupid.
I’ve done file recovery before but not as drastic as the issue im facing.
If you want to lecture someone about backing up lecture my client (my uncle).
No one is lecturing. It’s just advice like all the rest. 
Recovering a few files and recovering many files on a whole disc that has been mistakenly overwritten are two totally different things having done file recovery or not.