photorec.py

import os
import platform
import subprocess
import sys
import urllib.request
import tarfile
import zipfile
import ctypes
import threading

def is_admin():
    # Check if the script is running with administrative privileges
    try:
        return ctypes.windll.shell32.IsUserAnAdmin()
    except:
        return False

def run_as_admin():
    # Re-run the script with admin privileges using ShellExecute
    if platform.system() == 'Windows':
        script = os.path.abspath(sys.argv[0])
        ctypes.windll.shell32.ShellExecuteW(None, "runas", sys.executable, script, None, 1)
        sys.exit(0)

if not is_admin():
    run_as_admin()

def download_photorec():
    if platform.system() == 'Windows':
        download_url = 'https://www.cgsecurity.org/testdisk-7.2-WIP.win64.zip'
        zip_file = 'testdisk.zip'
        extract_dir = 'testdisk'
        executable_path = os.path.abspath(os.path.join(extract_dir, 'testdisk-7.2-WIP', 'photorec_win.exe'))
    else:
        download_url = 'https://www.cgsecurity.org/testdisk-7.3.linux.tar.gz'
        tar_file = 'testdisk.tar.gz'
        extract_dir = 'testdisk'
        executable_path = os.path.abspath(os.path.join(extract_dir, 'testdisk-7.3', 'photorec_static'))

    # Download the PhotoRec archive
    try:
        urllib.request.urlretrieve(download_url, zip_file)
    except Exception as e:
        print("Failed to download PhotoRec archive:", e)
        return None

    # Extract the archive
    try:
        with zipfile.ZipFile(zip_file, 'r') as zip_ref:
            zip_ref.extractall(extract_dir)
    except Exception as e:
        print("Failed to extract PhotoRec archive:", e)
        os.remove(zip_file)
        return None

    return executable_path

def run_photorec(forensic_image_path, destination_path):
    photorec_path = download_photorec()

    if photorec_path is None:
        return

    image_name = forensic_image_path

    if platform.system() == 'Windows':
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name,
                   'fileopt,everything,disable,jpg,enable,pdf,enable,png,enable,search']

    else:
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name, 'fileopt,everything,enable,search']

    print("Executing command:", command)

    def show_popup_message():
        # Function to show a pop-up message saying "Data carving completed"
        MB_OK = 0x0
        MessageBoxW = ctypes.windll.user32.MessageBoxW
        MessageBoxW(None, "Data carving completed", "PhotoRec", MB_OK)

    try:
        output = subprocess.run(command, capture_output=True, text=True)
        print(output.stdout)
        show_popup_message()  # Show pop-up message when the process completes
    except subprocess.CalledProcessError as e:
        print("Command execution failed with exit code:", e.returncode)
        print("Error output:")
        print(e.stderr)


def run_photorec_jpg(forensic_image_path, destination_path):
    photorec_path = download_photorec()

    if photorec_path is None:
        return

    image_name = forensic_image_path

    if platform.system() == 'Windows':
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name,
                   'fileopt,everything,disable,jpg,enable,search']
    else:
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name, 'fileopt,everything,disable,jpg,enable,search']


    print("Executing command:", command)

    def show_popup_message1():
        MB_OK = 0x0
        MessageBoxW = ctypes.windll.user32.MessageBoxW
        MessageBoxW(None, "JPG Carving completed", MB_OK)

    try:
        output = subprocess.run(command, capture_output=True, text=True)
        print(output.stdout)
        show_popup_message1()
    except subprocess.CalledProcessError as e:
        print("Command execution failed with exit code:", e.returncode)
        print("Error output:")
        print(e.stderr)

def run_photorec_png(forensic_image_path, destination_path):
    photorec_path = download_photorec()

    if photorec_path is None:
        return

    image_name = forensic_image_path

    if platform.system() == 'Windows':
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name,
                   'fileopt,everything,disable,png,enable,search']
    else:
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name, 'fileopt,everything,disable,png,enable,search']


    print("Executing command:", command)

    def show_popup_message2():
        MB_OK = 0x0
        MessageBoxW = ctypes.windll.user32.MessageBoxW
        MessageBoxW(None, "PNG Carving completed", MB_OK)

    try:
        output = subprocess.run(command, capture_output=True, text=True)
        print(output.stdout)
        show_popup_message2()
    except subprocess.CalledProcessError as e:
        print("Command execution failed with exit code:", e.returncode)
        print("Error output:")
        print(e.stderr)


def run_photorec_gif(forensic_image_path, destination_path):
    photorec_path = download_photorec()

    if photorec_path is None:
        return

    image_name = forensic_image_path

    if platform.system() == 'Windows':
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name,
                   'fileopt,everything,disable,gif,enable,search']
    else:
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name, 'fileopt,everything,disable,gif,enable,search']


    print("Executing command:", command)

    def show_popup_message3():
        MB_OK = 0x0
        MessageBoxW = ctypes.windll.user32.MessageBoxW
        MessageBoxW(None, "GIF Carving completed", MB_OK)

    try:
        output = subprocess.run(command, capture_output=True, text=True)
        print(output.stdout)
        show_popup_message3()
    except subprocess.CalledProcessError as e:
        print("Command execution failed with exit code:", e.returncode)
        print("Error output:")
        print(e.stderr)

def run_photorec_office(forensic_image_path, destination_path):
    photorec_path = download_photorec()

    if photorec_path is None:
        return

    image_name = forensic_image_path

    if platform.system() == 'Windows':
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name,
                   'fileopt,everything,disable,docx,enable,doc,enable,search']
    else:
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name, 'fileopt,everything,disable,docx,enable,doc,enable,search']


    print("Executing command:", command)

    def show_popup_message4():
        MB_OK = 0x0
        MessageBoxW = ctypes.windll.user32.MessageBoxW
        MessageBoxW(None, "GIF Carving completed", MB_OK)

    try:
        output = subprocess.run(command, capture_output=True, text=True)
        print(output.stdout)
        show_popup_message4()
    except subprocess.CalledProcessError as e:
        print("Command execution failed with exit code:", e.returncode)
        print("Error output:")
        print(e.stderr)

def run_photorec_ppt(forensic_image_path, destination_path):
    photorec_path = download_photorec()

    if photorec_path is None:
        return

    image_name = forensic_image_path

    if platform.system() == 'Windows':
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name,
                   'fileopt,everything,disable,pptx,enable,ppt,enable,search']
    else:
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name, 'fileopt,everything,disable,pptx,enable,ppt,enable,search']


    print("Executing command:", command)

    def show_popup_message5():
        MB_OK = 0x0
        MessageBoxW = ctypes.windll.user32.MessageBoxW
        MessageBoxW(None, "PPT Carving completed", MB_OK)

    try:
        output = subprocess.run(command, capture_output=True, text=True)
        print(output.stdout)
        show_popup_message5()
    except subprocess.CalledProcessError as e:
        print("Command execution failed with exit code:", e.returncode)
        print("Error output:")
        print(e.stderr)

def run_photorec_pdf(forensic_image_path, destination_path):
    photorec_path = download_photorec()

    if photorec_path is None:
        return

    image_name = forensic_image_path

    if platform.system() == 'Windows':
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name,
                   'fileopt,everything,disable,pdf,enable,search']
    else:
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name, 'fileopt,everything,disable,pdf,search']


    print("Executing command:", command)

    def show_popup_message6():
        MB_OK = 0x0
        MessageBoxW = ctypes.windll.user32.MessageBoxW
        MessageBoxW(None, "PDF Carving completed", MB_OK)

    try:
        output = subprocess.run(command, capture_output=True, text=True)
        print(output.stdout)
        show_popup_message6()
    except subprocess.CalledProcessError as e:
        print("Command execution failed with exit code:", e.returncode)
        print("Error output:")
        print(e.stderr)

def run_photorec_xlsx(forensic_image_path, destination_path):
    photorec_path = download_photorec()

    if photorec_path is None:
        return

    image_name = forensic_image_path

    if platform.system() == 'Windows':
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name,
                   'fileopt,everything,disable,xlsx,enable,xls,enable,search']
    else:
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name, 'fileopt,everything,disable,xlsx,enable,xls,enable,search']


    print("Executing command:", command)

    def show_popup_message7():
        MB_OK = 0x0
        MessageBoxW = ctypes.windll.user32.MessageBoxW
        MessageBoxW(None, "xlsx Carving completed", MB_OK)

    try:
        output = subprocess.run(command, capture_output=True, text=True)
        print(output.stdout)
        show_popup_message7()
    except subprocess.CalledProcessError as e:
        print("Command execution failed with exit code:", e.returncode)
        print("Error output:")
        print(e.stderr)

def run_photorec_deb(forensic_image_path, destination_path):
    photorec_path = download_photorec()

    if photorec_path is None:
        return

    image_name = forensic_image_path

    if platform.system() == 'Windows':
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name,
                   'fileopt,everything,disable,exe,enable,search']
    else:
        command = [photorec_path, '/debug', '/log', '/d', destination_path, '/cmd', image_name, 'fileopt,everything,disable,exe,enable,search']


    print("Executing command:", command)

    def show_popup_message8():
        MB_OK = 0x0
        MessageBoxW = ctypes.windll.user32.MessageBoxW
        MessageBoxW(None, "exe Carving completed", MB_OK)

    try:
        output = subprocess.run(command, capture_output=True, text=True)
        print(output.stdout)
        show_popup_message8()
    except subprocess.CalledProcessError as e:
        print("Command execution failed with exit code:", e.returncode)
        print("Error output:")
        print(e.stderr)


def run_photorec_background(forensic_image_path, destination_path):
    def data_carving_task():
        run_photorec(forensic_image_path, destination_path)
    data_carving_thread = threading.Thread(target=data_carving_task)
    data_carving_thread.start()

def run_photorec_background1(forensic_image_path, destination_path):
    def data_carving_task():
        run_photorec_jpg(forensic_image_path, destination_path)
    data_carving_thread = threading.Thread(target=data_carving_task)
    data_carving_thread.start()

def run_photorec_background2(forensic_image_path, destination_path):
    def data_carving_task():
        run_photorec_png(forensic_image_path, destination_path)
    data_carving_thread = threading.Thread(target=data_carving_task)
    data_carving_thread.start()

def run_photorec_background3(forensic_image_path, destination_path):
    def data_carving_task():
        run_photorec_gif(forensic_image_path, destination_path)
    data_carving_thread = threading.Thread(target=data_carving_task)
    data_carving_thread.start()

def run_photorec_background4(forensic_image_path, destination_path):
    def data_carving_task():
        run_photorec_office(forensic_image_path, destination_path)
    data_carving_thread = threading.Thread(target=data_carving_task)
    data_carving_thread.start()

def run_photorec_background5(forensic_image_path, destination_path):
    def data_carving_task():
        run_photorec_ppt(forensic_image_path, destination_path)
    data_carving_thread = threading.Thread(target=data_carving_task)
    data_carving_thread.start()

def run_photorec_background6(forensic_image_path, destination_path):
    def data_carving_task():
        run_photorec_pdf(forensic_image_path, destination_path)
    data_carving_thread = threading.Thread(target=data_carving_task)
    data_carving_thread.start()

def run_photorec_background7(forensic_image_path, destination_path):
    def data_carving_task():
        run_photorec_xlsx(forensic_image_path, destination_path)
    data_carving_thread = threading.Thread(target=data_carving_task)
    data_carving_thread.start()

def run_photorec_background8(forensic_image_path, destination_path):
    def data_carving_task():
        run_photorec_deb(forensic_image_path, destination_path)
    data_carving_thread = threading.Thread(target=data_carving_task)
    data_carving_thread.start()