Data Recovery With TestDisk

Version 1.0
Author: Falko Timme

TestDisk is a powerful free data recovery software which was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting your partition table). TestDisk is available for lots of operating systems, including Linux, Windows, and MacOS, and supports lots of filesystems.

This article is meant as a short introduction to TestDisk; if you want to learn more about TestDisk and what it can do for you, you should refer to the TestDisk documentation.

I do not issue any guarantee that this will work for you!

1 Getting TestDisk

TestDisk is available as a package for lots of Linux distributions, e.g. Debian/Ubuntu, Fedora, Mandriva, etc (a full list can be found on http://www.cgsecurity.org/wiki/TestDisk_Livecd). On Debian/Ubuntu you'd run

apt-get install testdisk

to install it.

If there's no package for your distribution, you can download TestDisk from http://www.cgsecurity.org/wiki/TestDisk_Download.

A better way to use TestDisk is to download a Linux Live-CD that contains TestDisk, such as GParted or Knoppix (a full list of Live-CDs can again be found on http://www.cgsecurity.org/wiki/TestDisk_Livecd), because it doesn't help if TestDisk is installed on a system that doesn't boot anymore due to partition errors...

2 Using TestDisk

TestDisk can be run from the command line.

testdisk /list

gives you a list of your partitions:

server1:~# testdisk /list
TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org
Please wait...
Disk /dev/sda - 32 GB / 29 GiB - CHS 3916 255 63, sector size=512

Disk /dev/sda - 32 GB / 29 GiB - CHS 3916 255 63
     Partition                  Start        End    Size in sectors
1 * Linux                    0   1  1  3869 254 63   62171487
2 E extended              3870   0  1  3915 254 63     738990
5 L Linux Swap            3870   1  1  3915 254 63     738927

Now let's assume we have lost our partition table and want to restore it. To use TestDisk, just run

testdisk

It is a menu-driven tool, so this is what you'll see (I'll mark my selections in red):

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

TestDisk is a data recovery designed to help recover lost partitions
and/or make non-booting disks bootable again when these symptoms
are caused by faulty software, certain types of viruses or human error.
It can also be used to repair some filesystem errors.

Information gathered during TestDisk use can be recorded for later
review. If you choose to create the text file, testdisk.log , it
will contain TestDisk options, technical information and various
outputs; including any folder/file names TestDisk was used to find and
list onscreen.

Use arrow keys to select, then press Enter key:
[ Create ]  Create a new log file
[ Append ]  Append information to log file
[ No Log ]  Don't record anything

<-- Create

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

TestDisk is free software, and
comes with ABSOLUTELY NO WARRANTY.

Select a media (use Arrow keys, then press Enter):
Disk /dev/sda - 32 GB / 29 GiB

[Proceed ] [ Quit ]

Note: Disk capacity must be correctly detected for a successful recovery.
If a disk listed above has incorrect size, check HD jumper settings, BIOS
detection, and install the latest OS patches and disk drivers.

<-- Proceed

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

Disk /dev/sda - 32 GB / 29 GiB

Please select the partition table type, press Enter when done.
[Intel  ]  Intel/PC partition
[Mac    ]  Apple partition map
[None   ]  Non partioned media
[Sun    ]  Sun Solaris partition
[XBox   ]  XBox partition
[Return ]  Return to disk selection

Note: Do NOT select 'None' for media with only a single partition. It's very
rare for a drive to be 'Non-partitioned'.

<-- Intel

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

Disk /dev/sda - 32 GB / 29 GiB - CHS 3916 255 63

[ Analyse  ]  Analyse current partition structure and search for lost partitions
[ Advanced ]  Filesystem Utils
[ Geometry ]  Change disk geometry
[ Options  ]  Modify options
[ MBR Code ]  Write TestDisk MBR code to first sector
[ Delete   ]  Delete all data in the partition table
[ Quit     ]  Return to disk selection

Note: Correct disk geometry is required for a successful recovery. 'Analyse'
process may give some warnings if it thinks the logical geometry is mismatched.

<-- Analyse

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

Disk /dev/sda - 32 GB / 29 GiB - CHS 3916 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors
No partition is bootable

*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted

[Proceed ]
                            Try to locate partition

As you see, no bootable partitions have been found. Select

<-- Proceed

to continue. On the next screen TestDisk will show you the partitions it has found:

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

Disk /dev/sda - 32 GB / 29 GiB - CHS 3916 255 63
     Partition               Start        End    Size in sectors
* Linux                    0   1  1  3869 254 63   62171487
L Linux Swap            3870   1  1  3915 254 63     738927

Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
EXT3 Large file Sparse superblock Recover, 31 GB / 29 GiB

<-- ENTER

On the next screen we select Write to write our new partition table (computed by TestDisk from the partitions it has just found) to the hard drive:

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

Disk /dev/sda - 32 GB / 29 GiB - CHS 3916 255 63

     Partition                  Start        End    Size in sectors
1 * Linux                    0   1  1  3869 254 63   62171487
2 E extended LBA          3870   0  1  3915 254 63     738990
5 L Linux Swap            3870   1  1  3915 254 63     738927

[  Quit  ]  [Search! ]  [ Write  ]
                       Write partition structure to disk

<-- Write

Confirm by typing in Y:

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

Write partition table, confirm ? (Y/N)

<-- Y

TestDisk tells you that you must reboot for the changes to take effect:

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

You will have to reboot for the change to take effect.

[Ok]

<-- Ok

Select Quit on the next screen:

<-- Quit

Select Quit again to finally leave TestDisk:

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

  TestDisk is free software, and
comes with ABSOLUTELY NO WARRANTY.

Select a media (use Arrow keys, then press Enter):
Disk /dev/sda - 32 GB / 29 GiB

[Proceed ]  [  Quit  ]

Note: Disk capacity must be correctly detected for a successful recovery.
If a disk listed above has incorrect size, check HD jumper settings, BIOS
detection, and install the latest OS patches and disk drivers.

                                  Quit program

<-- Quit

We have now left TestDisk and are back on the shell. All we have to do now is reboot the system (remove any CDs/DVDs from the CD/DVD drive), and if everything goes well, the original system should boot thanks to our new partition table.

3 Links

TestDisk: http://www.cgsecurity.org/wiki/TestDisk

view as pdf | print

Share this page:

11 Comment(s)

Add comment

Comments

By: Raz

I can't possibly thank you enough for this!

By: Anonymous

I was exrtremely frustrated when my drive decided to go from an 60 gig NTFS HD to FAT12 10 mb HD just because I used the "fixboot" and "fixmbr" command after running "chkdsk /p /r" when my HD failed to boot in any mode due to an "agp440.sys" error.

I have spent 10 days - after my drive failed - looking for information on how to restore it to no avail! I have used over 10 data recovery softwares; GetBackData, EASEUS, PC File recovery, Acronis, to name a few, and they all failed to restore 1 kb!

I even resorted to deep-freezing my HD in the freezer for up to 24 hours and no software was able to recover any data off it. EASEUS spent 13 hours and recovered nothing! I was livid and came close to taken a hammer to the failed HD today and destroy it out of frustration, after I almost gave up and surrender to the fact I lost valuable data forever.

Then I found your page; I tried "testdesk" before but I could not find any detailed instructions on how to use it - in the way you have explained it on this page!

I re-freezed the HD for 2 hours, followed your instructions for "testdesk", and I was able to fix the corrupt table partition and reverse the damage (FAT12 back to NTFS) in 10 minutes and I'm now copying my data off it to another HD.

Thank you, thank you, thank you. I'm grateful!

Testdisk rules.

By: Tim Stallaert

Testdisk rocks !!!! I was faced with a ATA disk, previously fully formatted in NTFS. It has been repartitioned several times and formatted in ext4, more ext4 and linux swap some time ago.

Testdisk allowed me to recover data from the original windows installation *magnificent*

By: Anonymous

I don't think there's enough words to thank you for this tutorial!
I'll never forget the Test Disk software

Thank You a lot! A LOT!

Ps.: I'm Brazilian, so I'm sorry if I wrote something wrong.. THANK YOU!!!

By: Gar

Author, I don't even know you but I just want to tell you, that I love you. 6 months of lost data restored after following the above steps, thank you!

By: laizer

thank you very much

By: Anonymous

With all these wonderful comments, people might think Testdisk is a miraculous software - it is not.

I followed all the steps and at the end, instead of finding my lost partition, it broke all the three partitions I had on the HDD. This all due to lack of information that anyone can understand, in order to make the best decision. Ok, I should have accepted that I had one partition gone forever and that was it, instead of opting for the 'write' function.

On the other hand, this all happened after my attempt to install a second version of Windows 7 on a different partition (I only use Windows when I have no choice).

This article might also help beginners: http://subinsebastien.tumblr.com/post/51162480785/how-to-recover-files-from-a-deleted-or-even-overwritten

By: Bhakhin

Thank you so much for saving many of us.

By: data recovery

I think this is important article for learn about data recovery. Now Data loss is common matter. But if we know how to recover Data, we can easily recover our Data loss. Thanks a lot for this amazing article. When data loss occurs, you need a company with the technology and skills required to successfully get your data back as quickly as possible.

By: sudarshan

I have problem , i have 4 partation in my 1tb hdd.

I formated c drive , and in 3 partiton there was some data when i installed I have problem , i have 4 partation in my 1tb hdd.

I formated c drive , and in 3 partiton there was data when i installed Ubuntu 16.04.3 LTS then I have problem , i have 4 partation in my 1tb hdd.

I formated c drive , and in 3 partiton there was some data when i installed I have problem , i have 4 partation in my 1tb hdd.

I formated c drive , and in 3 partiton there was data when i installed Ubuntu 16.04.3 LTS then i checked whole drive become 1 partition of 1TB.

so will i recover my data. is there any chance to recovered it back my data

my English was bad so understandi checked whole drive become 1 partition of 1TB.

so will i recover my data. is there any chance to recovered it back my data

By: khamza

A huge thanks , no kidding. Picures vidoes audio ect.. wow really nice. Let me buy you caffe payday. really. God Bless.....

Log in or Sign up

On this page