TestDisk is a powerful free data recovery software which was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting your partition table). TestDisk is available for lots of operating systems, including Linux, Windows, and MacOS, and supports lots of filesystems.
This article is meant as a short introduction to TestDisk; if you want to learn more about TestDisk and what it can do for you, you should refer to the TestDisk documentation.
I do not issue any guarantee that this will work for you!
1 Getting TestDisk
TestDisk is available as a package for lots of Linux distributions, e.g. Debian/Ubuntu, Fedora, Mandriva, etc (a full list can be found on http://www.cgsecurity.org/wiki/TestDisk_Livecd). On Debian/Ubuntu you’d run
apt-get install testdisk
to install it.
If there’s no package for your distribution, you can download TestDisk from http://www.cgsecurity.org/wiki/TestDisk_Download.
A better way to use TestDisk is to download a Linux Live-CD that contains TestDisk, such as GParted or Knoppix (a full list of Live-CDs can again be found on http://www.cgsecurity.org/wiki/TestDisk_Livecd), because it doesn’t help if TestDisk is installed on a system that doesn’t boot anymore due to partition errors…
2 Using TestDisk
TestDisk can be run from the command line.
testdisk /list
gives you a list of your partitions:
server1:~# testdisk /list
TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org
Please wait…
Disk /dev/sda – 32 GB / 29 GiB – CHS 3916 255 63, sector size=512
Disk /dev/sda – 32 GB / 29 GiB – CHS 3916 255 63
Partition Start End Size in sectors
1 * Linux 0 1 1 3869 254 63 62171487
2 E extended 3870 0 1 3915 254 63 738990
5 L Linux Swap 3870 1 1 3915 254 63 738927
Now let’s assume we have lost our partition table and want to restore it. To use TestDisk, just run
testdisk
It is a menu-driven tool, so this is what you’ll see (I’ll mark my selections in red):
TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org
TestDisk is a data recovery designed to help recover lost partitions
and/or make non-booting disks bootable again when these symptoms
are caused by faulty software, certain types of viruses or human error.
It can also be used to repair some filesystem errors.
Information gathered during TestDisk use can be recorded for later
review. If you choose to create the text file, testdisk.log , it
will contain TestDisk options, technical information and various
outputs; including any folder/file names TestDisk was used to find and
list onscreen.
Use arrow keys to select, then press Enter key:
[ Create ] Create a new log file
[ Append ] Append information to log file
[ No Log ] Don’t record anything
<– Create
TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org
TestDisk is free software, and
comes with ABSOLUTELY NO WARRANTY.
Select a media (use Arrow keys, then press Enter):
Disk /dev/sda – 32 GB / 29 GiB
[Proceed ] [ Quit ]
Note: Disk capacity must be correctly detected for a successful recovery.
If a disk listed above has incorrect size, check HD jumper settings, BIOS
detection, and install the latest OS patches and disk drivers.
<– Proceed
TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org
Disk /dev/sda – 32 GB / 29 GiB
Please select the partition table type, press Enter when done.
[Intel ] Intel/PC partition
[Mac ] Apple partition map
[None ] Non partioned media
[Sun ] Sun Solaris partition
[XBox ] XBox partition
[Return ] Return to disk selection
Note: Do NOT select ‘None’ for media with only a single partition. It’s very
rare for a drive to be ‘Non-partitioned’.
<– Intel
TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org
Disk /dev/sda – 32 GB / 29 GiB – CHS 3916 255 63
[ Analyse ] Analyse current partition structure and search for lost partitions
[ Advanced ] Filesystem Utils
[ Geometry ] Change disk geometry
[ Options ] Modify options
[ MBR Code ] Write TestDisk MBR code to first sector
[ Delete ] Delete all data in the partition table
[ Quit ] Return to disk selection
Note: Correct disk geometry is required for a successful recovery. ‘Analyse’
process may give some warnings if it thinks the logical geometry is mismatched.
<– Analyse
TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org
Disk /dev/sda – 32 GB / 29 GiB – CHS 3916 255 63
Current partition structure:
Partition Start End Size in sectors
No partition is bootable
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
[Proceed ]
Try to locate partition
As you see, no bootable partitions have been found. Select
<– Proceed
to continue. On the next screen TestDisk will show you the partitions it has found:
TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org
Disk /dev/sda – 32 GB / 29 GiB – CHS 3916 255 63
Partition Start End Size in sectors
* Linux 0 1 1 3869 254 63 62171487
L Linux Swap 3870 1 1 3915 254 63 738927
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
EXT3 Large file Sparse superblock Recover, 31 GB / 29 GiB
<– ENTER
On the next screen we select Write to write our new partition table (computed by TestDisk from the partitions it has just found) to the hard drive:
TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org
Disk /dev/sda – 32 GB / 29 GiB – CHS 3916 255 63
Partition Start End Size in sectors
1 * Linux 0 1 1 3869 254 63 62171487
2 E extended LBA 3870 0 1 3915 254 63 738990
5 L Linux Swap 3870 1 1 3915 254 63 738927
[ Quit ] [Search! ] [ Write ]
Write partition structure to disk
<– Write
Confirm by typing in Y:
TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org
Write partition table, confirm ? (Y/N)
<– Y
TestDisk tells you that you must reboot for the changes to take effect:
TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org
You will have to reboot for the change to take effect.
[Ok]
<– Ok
Select Quit on the next screen:
TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org
Disk /dev/sda – 32 GB / 29 GiB – CHS 3916 255 63
[ Analyse ] Analyse current partition structure and search for lost partitions
[ Advanced ] Filesystem Utils
[ Geometry ] Change disk geometry
[ Options ] Modify options
[ MBR Code ] Write TestDisk MBR code to first sector
[ Delete ] Delete all data in the partition table
[ Quit ] Return to disk selection
Note: Correct disk geometry is required for a successful recovery. ‘Analyse’
process may give some warnings if it thinks the logical geometry is mismatched.
<– Quit
Select Quit again to finally leave TestDisk:
TestDisk 6.5, Data Recovery Utility, October 2006
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org
TestDisk is free software, and
comes with ABSOLUTELY NO WARRANTY.
Select a media (use Arrow keys, then press Enter):
Disk /dev/sda – 32 GB / 29 GiB
[Proceed ] [ Quit ]
Note: Disk capacity must be correctly detected for a successful recovery.
If a disk listed above has incorrect size, check HD jumper settings, BIOS
detection, and install the latest OS patches and disk drivers.
Quit program
<– Quit
We have now left TestDisk and are back on the shell. All we have to do now is reboot the system (remove any CDs/DVDs from the CD/DVD drive), and if everything goes well, the original system should boot thanks to our new partition table.
Via: http://www.howtoforge.com/data_recovery_with_testdisk
