TestDiskStepByStep

FromCGSecurity
englishversion chineseversion deutscheVersion versinespaol
versionfranaise versioneitaliana wersjapolska versiunea
romn

Share

ThisrecoveryexampleguidesyouthroughTestDiskstepbysteptorecoveramissingpartitionand
repairacorruptedone.Afterreadingthistutorial,youshouldbereadytorecoveryourowndata.
TranslationsofthisTestDiskmanualtootherlanguagesarewelcome.

Contents
1Exampleproblem
2Symptoms
3RunningTestDiskexecutable
4Logcreation
5Diskselection
6Partitiontabletypeselection
7Currentpartitiontablestatus
8QuickSearchforpartitions
9Savethepartitiontableorsearchformorepartitions?
10Apartitionisstillmissing:DeeperSearch
11Partitiontablerecovery
12NTFSBootsectorrecovery
13Recoverdeletedfiles

Exampleproblem
Wehavea36GBharddiskcontaining3partitions.Unfortunately
thebootsectoroftheprimaryNTFSpartitionhasbeendamaged,and
alogicalNTFSpartitionhasbeenaccidentallydeleted.
ThisrecoveryexampleguidesyouthroughTestDisk,stepbystep,torecoverthese'lost'partitionsby:
rewritingthecorruptedNTFSbootsector,and
recoveringtheaccidentallydeletedlogicalNTFSpartition.
RecoveryofaFAT32partition(insteadofanNTFSpartition)canbeaccomplishedbyfollowingexactly
thesamesteps.Otherrecoveryexamplesarealsoavailable.ForInformationaboutFAT12,FAT16,
ext2/ext3,HFS+,ReiserFSandotherpartitiontypes,readRunningtheTestDiskProgram.
Pleasesupporttheproject
withyourdonations.
Onecondition:

TestDiskmustbeexecutedwithAdministratorprivileges.
ImportantpointsforusingTestDisk:
TonavigateinTestDisk,usetheArrowandPageUp/PageDownkeys.
Toproceed,confirmyourchoice(s)withtheEnterkey.
ToreturntoapreviousdisplayorquitTestDisk,usetheq(Quit)key.
TosavemodificationsunderTestDisk,youmustconfirmthemwiththey(Yes)
and/orEnterkeys,and
ToactuallywritepartitiondatatotheMBR,youmustchoosethe"Write"
selectionandpresstheEnterkey.

Symptoms
Ifthisharddisk'sprimarypartitioncontainedanoperatingsystem,itwouldmostlikelynolongerbootup
duetoitscorruptedbootsector.Iftheharddiskwasasecondary(data)driveoryoucanconnectthe
drivetoanothercomputerinitssecondarychannel(usuallywhereaCD/DVDdriveisconnected),the
followingsymptomswouldbeobserved:
1. WindowsExplorerorDiskManagerdisplaysthefirstprimarypartitionasraw(unformatted)and
Windowsprompts:Thedriveisnotformatted,doyouwanttoformatitnow?
[Youshouldneverdosowithoutknowingwhy!]
2. Alogicalpartitionismissing.InWindowsExplorer,thatlogicaldriveisnolongeravailable.The
WindowsDiskManagementConsolenowdisplaysonly"unallocatedspace"wherethislogical
partitionhadbeenlocated.

RunningTestDiskexecutable
IfTestDiskisnotyetinstalled,itcanbedownloadedfromTestDiskDownload.Extractthefilesfromthe
archiveincludingthesubdirectories.
Torecoveralostpartitionorrepairthefilesystemfromaharddisk,USBkey,SmartCard,etc.,youneed
enoughrightstoaccessaphysicaldevice.
UnderDOS,runTestDisk.exe
UnderWindows,startTestDisk(ietestdisk6.13/testdisk_win.exe)fromanaccountinthe
Administratorgroup.UnderVista,rightclicktestdisk_win.exeandthen"Runasadministrator"to
launchTestDisk.
UnderUnix/Linux/BSD,youneedtoberoottorunTestDisk(ie.sudotestdisk
6.13/testdisk_static)
UnderMacOSX,ifyouarenotroot,TestDisk(ietestdisk6.13/testdisk)willrestartitself
usingsudoafterconfirmationonyourpart.
UnderOS/2,TestDiskdoesn'thandleaphysicaldevice,onlyadiskimage.Sorry.
Torecoverpartitionfromamediaimageorrepairafilesystemimage,run
testdiskimage.ddtoworkfromarawdiskimage
testdiskimage.E01torecoverfilesfromanEncaseEWFimage
testdisk'image.???'iftheEncaseimageissplitintoseveralfiles.

TorepairafilesystemnotlistedbyTestDisk,runtestdiskdevice,i.e.

testdisk/dev/mapper/truecrypt0ortestdisk/dev/loop0torepairtheNTFSorFAT32boot

sectorfilesfromaTrueCryptpartition.Thesamemethodworkswithfilesystemencryptedwith
cryptsetup/dmcrypt/LUKS.
testdisk/dev/md0torepairafilesystemontopofaLinuxRAIDdevice.

Logcreation

ChooseCreatetoinstructTestdisktocreatealogfilecontainingtechnicalinformationand
messages,unlessyouhaveareasontoappenddatatothelogoryouexecuteTestDiskfromread
onlymediaandmustcreatethelogelsewhere.
ChooseNoneifyoudonotwantmessagesanddetailsoftheprocesstobewrittenintoalogfile
(usefulifforexampleTestdiskwasstartedfromareadonlylocation).
PressEntertoproceed.

Diskselection
AllharddrivesshouldbedetectedandlistedwiththecorrectsizebyTestDisk:

Useup/downarrowkeystoselectyourharddrivewiththelostpartition/s.
PressEntertoProceed.
Ifavailable,userawdevice/dev/rdisk*insteadof/dev/disk*forfasterdatatransfer.

Partitiontabletypeselection
TestDiskdisplaysthepartitiontabletypes.

SelectthepartitiontabletypeusuallythedefaultvalueisthecorrectoneasTestDiskautodetects
thepartitiontabletype.
PressEntertoProceed.

Currentpartitiontablestatus
TestDiskdisplaysthemenus(alsoseeTestDiskMenuItems).

Usethedefaultmenu"Analyse"tocheckyourcurrentpartitionstructureandsearchforlost
partitions.
ConfirmatAnalysewithEntertoproceed.
Now,yourcurrentpartitionstructureislisted.Examineyourcurrentpartitionstructureformissing
partitionsanderrors.

Thefirstpartitionislistedtwicewhichpointstoacorruptedpartitionoraninvalidpartitiontableentry.
InvalidNTFSbootpointstoafaultyNTFSbootsector,soit'sacorruptedfilesystem.
Onlyonelogicalpartition(labelPartition2)isavailableintheextendedpartition.Onelogicalpartitionis

missing.
ConfirmatQuickSearchtoproceed.

QuickSearchforpartitions
TestDiskdisplaysthefirstresultsinrealtime.

(clickonthumbtodisplaytheimage).

DuringtheQuickSearch,TestDiskhasfoundtwopartitionsincludingthemissinglogicalpartition
labeledPartition3.

Highlightthispartitionandpressptolistyourfiles(togobacktothepreviousdisplay,pressqto
Quit,Fileslistedinredaredeletedentries).
Alldirectoriesanddataarecorrectlylisted.
PressEntertoproceed.

Savethepartitiontableorsearchformorepartitions?

Whenallpartitionsareavailableanddatacorrectlylisted,youshouldgotothemenuWriteto
savethepartitionstructure.ThemenuExtdPartgivesyoutheopportunitytodecideifthe
extendedpartitionwilluseallavailablediskspaceoronlytherequired(minimal)space.
Sinceapartition,thefirstone,isstillmissing,highlightthemenuDeeperSearch(ifnotdone
automaticallyalready)andpressEntertoproceed.

Apartitionisstillmissing:DeeperSearch
DeeperSearchwillalsosearchforFAT32backupbootsector,NTFSbackupbootsuperblock,ext2/ext3
backupsuperblocktodetectmorepartitions,
itwillscaneachcylinder

(clickonthumb).

AftertheDeeperSearch,theresultsaredisplayedasfollows:
Thefirstpartition"Partition1"wasfoundbyusingbackupbootsector.Inthelastlineofyourdisplay,
youcanreadthemessage"NTFSfoundusingbackupsector!"andthesizeofyourpartition.The
"partition2"isdisplayedtwicewithdifferentsize.
PartitionslistedasD(eleted)willnotberecoveredifyouletthemlistedasdeleted.Bothpartitionsare
listedwithstatusDfordeleted,becausetheyoverlapeachother.Youneedtoidentifywhichpartitionto
recover.

HighlightthefirstpartitionPartition2andpressptolistitsdata.
Thefilesystemoftheupperlogicalpartition(labelPartition2)isdamaged

(clickonthumb).

PressqforQuittogobacktothepreviousdisplay.
LetthispartitionPartition2withadamagedfilesystemmarkedasD(deleted).
HighlightthesecondpartitionPartition2below
Pressptolistitsfiles.

Itworks,yourfilesarelisted,youhavefoundthecorrectpartition!
Usetheleft/rightarrowtonavigateintoyourfoldersandwatchyourfilesformoreverification

Note:FATdirectorylistingislimitedto10clusterssomefilesmaynotappearbutitdoesn'taffect
recovery.
PressqforQuittogobacktothepreviousdisplay.
TheavailablestatusarePrimary,*bootable,LogicalandDeleted.
Usingtheleft/rightarrowkeys,changethestatusoftheselectedpartitionfromD(eleted)toL(ogical).
Thiswayyouwillbeabletorecoverthispartition.

Hint:readHowtorecognizeprimaryandlogicalpartitions?
Note:Ifapartitionislisted*(bootable)butifyoudon'tbootfromthispartition,youcanchangeitto
Primarypartition.
PressEntertoproceed.

Partitiontablerecovery
It'snowpossibletowritethenewpartitionstructure.
Note:Theextendedpartitionisautomaticallyset.TestDiskrecognizesthisusingthedifferentpartition
structure.

Ifallpartitionsarelistedandonlyinthiscase,confirmatWritewithEnter,yandOK.
Now,thepartitionsareregisteredinthepartitiontable.

NTFSBootsectorrecovery
ThebootsectorofthefirstpartitionnamedPartition1isstilldamaged.It'stimetofixit.Thestatusof
theNTFSbootsectorisbadandthebackupbootsectorisvalid.Bootsectorsarenotidentical.

Tocopythebackupofthebootsectoroverthebootsector,selectBackupBS,validatewithEnter,
useytoconfirmandnextOK.
MoreinformationaboutrepairingyourbootsectorunderTestDiskMenuItems.Thefollowingmessage
isdisplayed:

ThebootsectoranditsbackuparenowbothOKandidentical:theNTFSbootsectorhasbeen
successfullyrecovered.
PressEntertoquit.

TestDiskdisplaysYouhavetorestartyourComputertoaccessyourdatasopressEnteralast
timeandrebootyourcomputer.

Recoverdeletedfiles
TestDiskcanundelete
filesanddirectoryfromFAT12,FAT16andFAT32filesystem,
filesfromext2filesystem,

filesfromNTFSpartitionsinceversion6.11.
Ifitdoesn'tworkorforotherfilesystem,tryPhotoRec,asignaturebasedfilerecoveryutility.
ReturntoTestDiskmainpage
Retrievedfrom"http://www.cgsecurity.org/mw/index.php?title=TestDisk_Step_By_Step&oldid=7657"
Category: DataRecovery
Thispagewaslastmodifiedon6April2014,at17:46.
ContentisavailableunderGNUFreeDocumentationLicense1.2unlessotherwisenoted.