All the tools your team needs in one place. Slack: Where work happens.

Data Recovery With TestDisk

Version 1.0
Author: Falko Timme

TestDisk is a powerful free data recovery software which was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting your partition table). TestDisk is available for lots of operating systems, including Linux, Windows, and MacOS, and supports lots of filesystems.

This article is meant as a short introduction to TestDisk; if you want to learn more about TestDisk and what it can do for you, you should refer to the TestDisk documentation.

I do not issue any guarantee that this will work for you!

1 Getting TestDisk

TestDisk is available as a package for lots of Linux distributions, e.g. Debian/Ubuntu, Fedora, Mandriva, etc (a full list can be found on http://www.cgsecurity.org/wiki/TestDisk_Livecd). On Debian/Ubuntu you'd run

apt-get install testdisk

to install it.

If there's no package for your distribution, you can download TestDisk from http://www.cgsecurity.org/wiki/TestDisk_Download.

A better way to use TestDisk is to download a Linux Live-CD that contains TestDisk, such as GParted or Knoppix (a full list of Live-CDs can again be found on http://www.cgsecurity.org/wiki/TestDisk_Livecd), because it doesn't help if TestDisk is installed on a system that doesn't boot anymore due to partition errors...

2 Using TestDisk

TestDisk can be run from the command line.

testdisk /list

gives you a list of your partitions:

server1:~# testdisk /list
TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org
Please wait...
Disk /dev/sda - 32 GB / 29 GiB - CHS 3916 255 63, sector size=512

Disk /dev/sda - 32 GB / 29 GiB - CHS 3916 255 63
     Partition                  Start        End    Size in sectors
 1 * Linux                    0   1  1  3869 254 63   62171487
 2 E extended              3870   0  1  3915 254 63     738990
 5 L Linux Swap            3870   1  1  3915 254 63     738927

Now let's assume we have lost our partition table and want to restore it. To use TestDisk, just run

testdisk

It is a menu-driven tool, so this is what you'll see (I'll mark my selections in red):

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org


TestDisk is a data recovery designed to help recover lost partitions
and/or make non-booting disks bootable again when these symptoms
are caused by faulty software, certain types of viruses or human error.
It can also be used to repair some filesystem errors.

Information gathered during TestDisk use can be recorded for later
review. If you choose to create the text file, testdisk.log , it
will contain TestDisk options, technical information and various
outputs; including any folder/file names TestDisk was used to find and
list onscreen.

Use arrow keys to select, then press Enter key:
[ Create ]  Create a new log file
[ Append ]  Append information to log file
[ No Log ]  Don't record anything

<-- Create

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

  TestDisk is free software, and
comes with ABSOLUTELY NO WARRANTY.

Select a media (use Arrow keys, then press Enter):
Disk /dev/sda - 32 GB / 29 GiB









[Proceed ]  [  Quit  ]

Note: Disk capacity must be correctly detected for a successful recovery.
If a disk listed above has incorrect size, check HD jumper settings, BIOS
detection, and install the latest OS patches and disk drivers.

<-- Proceed

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org


Disk /dev/sda - 32 GB / 29 GiB

Please select the partition table type, press Enter when done.
[Intel  ]  Intel/PC partition
[Mac    ]  Apple partition map
[None   ]  Non partioned media
[Sun    ]  Sun Solaris partition
[XBox   ]  XBox partition
[Return ]  Return to disk selection






Note: Do NOT select 'None' for media with only a single partition. It's very
rare for a drive to be 'Non-partitioned'.

<-- Intel

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org


Disk /dev/sda - 32 GB / 29 GiB - CHS 3916 255 63

[ Analyse  ]  Analyse current partition structure and search for lost partitions
[ Advanced ]  Filesystem Utils
[ Geometry ]  Change disk geometry
[ Options  ]  Modify options
[ MBR Code ]  Write TestDisk MBR code to first sector
[ Delete   ]  Delete all data in the partition table
[ Quit     ]  Return to disk selection






Note: Correct disk geometry is required for a successful recovery. 'Analyse'
process may give some warnings if it thinks the logical geometry is mismatched.

<-- Analyse

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

Disk /dev/sda - 32 GB / 29 GiB - CHS 3916 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors
No partition is bootable













*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted

[Proceed ]
                            Try to locate partition

As you see, no bootable partitions have been found. Select

<-- Proceed

to continue. On the next screen TestDisk will show you the partitions it has found:

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

Disk /dev/sda - 32 GB / 29 GiB - CHS 3916 255 63
     Partition               Start        End    Size in sectors
* Linux                    0   1  1  3869 254 63   62171487
L Linux Swap            3870   1  1  3915 254 63     738927











Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
EXT3 Large file Sparse superblock Recover, 31 GB / 29 GiB

<-- ENTER

On the next screen we select Write to write our new partition table (computed by TestDisk from the partitions it has just found) to the hard drive:

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

Disk /dev/sda - 32 GB / 29 GiB - CHS 3916 255 63

     Partition                  Start        End    Size in sectors
 1 * Linux                    0   1  1  3869 254 63   62171487
 2 E extended LBA          3870   0  1  3915 254 63     738990
 5 L Linux Swap            3870   1  1  3915 254 63     738927













[  Quit  ]  [Search! ]  [ Write  ]
                       Write partition structure to disk

<-- Write

Confirm by typing in Y:

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

Write partition table, confirm ? (Y/N)

<-- Y

TestDisk tells you that you must reboot for the changes to take effect:

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org


You will have to reboot for the change to take effect.












[Ok]

<-- Ok

Select Quit on the next screen:

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org


Disk /dev/sda - 32 GB / 29 GiB - CHS 3916 255 63

[ Analyse  ]  Analyse current partition structure and search for lost partitions
[ Advanced ]  Filesystem Utils
[ Geometry ]  Change disk geometry
[ Options  ]  Modify options
[ MBR Code ]  Write TestDisk MBR code to first sector
[ Delete   ]  Delete all data in the partition table
[ Quit     ]  Return to disk selection






Note: Correct disk geometry is required for a successful recovery. 'Analyse'
process may give some warnings if it thinks the logical geometry is mismatched.

<-- Quit

Select Quit again to finally leave TestDisk:

TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

  TestDisk is free software, and
comes with ABSOLUTELY NO WARRANTY.

Select a media (use Arrow keys, then press Enter):
Disk /dev/sda - 32 GB / 29 GiB









[Proceed ]  [  Quit  ]

Note: Disk capacity must be correctly detected for a successful recovery.
If a disk listed above has incorrect size, check HD jumper settings, BIOS
detection, and install the latest OS patches and disk drivers.

                                  Quit program

<-- Quit

We have now left TestDisk and are back on the shell. All we have to do now is reboot the system (remove any CDs/DVDs from the CD/DVD drive), and if everything goes well, the original system should boot thanks to our new partition table.

3 Links

• TestDisk: http://www.cgsecurity.org/wiki/TestDisk

Suggested articles

11 Comment(s)

Comments