Free Data Recovery Software : TestDisk, Data Recovery

TestDisk is a powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). Partition table recovery using TestDisk is really easy.

TestDisk can

* Fix partition table, recover deleted partition
* Recover FAT32 boot sector from its backup
* Rebuild FAT12/FAT16/FAT32 boot sector
* Fix FAT tables
* Rebuild NTFS boot sector
* Recover NTFS boot sector from its backup
* Fix MFT using MFT mirror
* Locate ext2/ext3 Backup SuperBlock
* Undelete files from FAT, NTFS and ext2 filesystem
* Copy files from deleted FAT, NTFS and ext2/ext3 partitions.

TestDisk has features for both novices and experts. For those who know little or nothing about data recovery techniques, TestDisk can be used to collect detailed information about a non-booting drive which can then be sent to a tech for further analysis. Those more familiar with such procedures should find TestDisk a handy tool in performing onsite recovery.
Operating systems

TestDisk can run under

* DOS (either real or in a Windows 9x DOS-box),
* Windows (NT4, 2000, XP, 2003, Vista),
* Linux,
* FreeBSD, NetBSD, OpenBSD,
* SunOS and
* MacOS

Source files and precompiled binary executables are available for DOS, Win32, MacOSX and Linux from the download page
Filesystems

TestDisk can find lost partitions for all of these file systems:

* BeFS ( BeOS )
* BSD disklabel ( FreeBSD/OpenBSD/NetBSD )
* CramFS, Compressed File System
* DOS/Windows FAT12, FAT16 and FAT32
* Windows exFAT
* HFS, HFS+ and HFSX, Hierarchical File System
* JFS, IBM's Journaled File System
* Linux ext2 and ext3
* Linux LUKS encrypted partition
* Linux RAID md 0.9/1.0/1.1/1.2
o RAID 1: mirroring
o RAID 4: striped array with parity device
o RAID 5: striped array with distributed parity information
o RAID 6: striped array with distributed dual redundancy information
* Linux Swap (versions 1 and 2)
* LVM and LVM2, Linux Logical Volume Manager
* Mac partition map
* Novell Storage Services NSS
* NTFS ( Windows NT/2000/XP/2003/Vista/2008/7 )
* ReiserFS 3.5, 3.6 and 4
* Sun Solaris i386 disklabel
* Unix File System UFS and UFS2 (Sun/BSD/...)
* XFS, SGI's Journaled File System

License:

TestDisk is OpenSource software and is licensed under the terms of the GNU General Public License (GPL v2+).

Running TestDisk executable

If TestDisk is not yet installed, it can be downloaded from TestDisk Download. Extract the files from the archive including the sub-directories.

To recover a lost partition or repair the filesystem from a hard disk, USB key, Smart Card, etc., you need enough rights to access a physical device.

• Under DOS, run TestDisk.exe
• Under Windows, start TestDisk (ie testdisk-6.13/testdisk_win.exe) from an account in the Administrator group. Under Vista, right-click testdisk_win.exe and then "Run as administrator" to launch TestDisk.
• Under Unix/Linux/BSD, you need to be root to run TestDisk (ie. sudo testdisk-6.13/testdisk_static)
• Under MacOSX, if you are not root, TestDisk (ie testdisk-6.13/testdisk) will restart itself using sudo after confirmation on your part.
• Under OS/2, TestDisk doesn't handle a physical device, only a disk image. Sorry.

To recover partition from a media image or repair a filesystem image, run

• testdisk image.dd to create a raw disk image
• testdisk image.E01 to recover files from an Encase EWF image
• testdisk 'image.???' if the Encase image is split into several files.

To repair a filesystem not listed by TestDisk, run testdisk device, i.e.

• testdisk /dev/mapper/truecrypt0 or testdisk /dev/loop0 to repair the NTFS or FAT32 boot sector files from a TrueCrypt partition. The same method works with filesystem encrypted with cryptsetup/dm-crypt/LUKS.
• testdisk /dev/md0 to repair a filesystem on top of a Linux RAID device.

Log creation

• Choose Create to instruct Testdisk to create a log file containing technical information and messages, unless you have a reason to append data to the log or you execute TestDisk from read only media and must create the log elsewhere.
• Choose None if you do not want messages and details of the process to be written into a log file (useful if for example Testdisk was started from a read-only location).
• Press Enter to proceed.

Disk selection

All hard drives should be detected and listed with the correct size by TestDisk:

• Use up/down arrow keys to select your hard drive with the lost partition/s.
• Press Enter to Proceed.

If available, use raw device /dev/rdisk* instead of /dev/disk* for faster data transfer.

Partition table type selection

TestDisk displays the partition table types.

• Select the partition table type - usually the default value is the correct one as TestDisk auto-detects the partition table type.
• Press Enter to Proceed.

Current partition table status

TestDisk displays the menus (also see TestDisk Menu Items).

• Use the default menu "Analyse" to check your current partition structure and search for lost partitions.
• Confirm at Analyse with Enter to proceed.

Now, your current partition structure is listed. Examine your current partition structure for missing partitions and errors.

The first partition is listed twice which points to a corrupted partition or an invalid partition table entry.
Invalid NTFS boot points to a faulty NTFS boot sector, so it's a corrupted filesystem.
Only one logical partition (label Partition 2) is available in the extended partition. One logical partition is missing.

• Confirm at Quick Search to proceed.

Quick Search for partitions

• Confirm according to your OS and created partitions to proceed.

TestDisk displays the first results in real time.

(click on thumb to display the image).

During the Quick Search, TestDisk has found two partitions including the missing logical partition labeled Partition 3.

• Highlight this partition and press p to list your files (to go back to the previous display, press q to Quit).

All directories and data are correctly listed.

• Press Enter to proceed.

Save the partition table or search for more partitions?

• When all partitions are available and data correctly listed, you should go to the menu Write to save the partition structure. The menu Extd Part gives you the opportunity to decide if the extended partition will use all available disk space or only the required (minimal) space.
• Since a partition, the first one, is still missing, highlight the menu Deeper Search (if not done automatically already) and press Enter to proceed.

A partition is still missing: Deeper Search

Deeper Search will also search for FAT32 backup boot sector, NTFS backup boot superblock, ext2/ext3 backup superblock to detect more partitions,

it will scan each cylinder

(click on thumb).

After the Deeper Search, the results are displayed as follows:
The first partition "Partition 1" was found by using backup boot sector. In the last line of your display, you can read the message "NTFS found using backup sector!" and the size of your partition. The "partition 2" is displayed twice with different size.
Both partitions are listed with status D for deleted, because they overlap each other.

• Highlight the first partition Partition 2 and press p to list its data.

The file system of the upper logical partition (label Partition 2) is damaged

(click on thumb).

• Press q for Quit to go back to the previous display.
• Let this partition Partition 2 with a damaged file system marked as D(deleted).
• Highlight the second partition Partition 2 below
• Press p to list its files.

It works, you have found the correct partition!

• Use the left/right arrow to navigate into your folders and watch your files for more verification

Note: FAT directory listing is limited to 10 clusters - some files may not appear but it doesn't affect recovery.

• Press q for Quit to go back to the previous display.

• The available status are Primary, * bootable, Logical and Deleted.

Using the left/right arrow keys, change the status of the selected partition to L(ogical)

Hint: read How to recognize primary and logical partitions?
Note: If a partition is listed *(bootable) but if you don't boot from this partition, you can change it to Primary partition.

• Press Enter to proceed.

Partition table recovery

It's now possible to write the new partition structure.
Note: The extended partition is automatically set. TestDisk recognizes this using the different partition structure.

• If all partitions are listed and only in this case, confirm at Write with Enter, y and OK.

Now, the partitions are registered in the partition table.

NTFS Boot sector recovery

The boot sector of the first partition named Partition 1 is still damaged. It's time to fix it. The status of the NTFS boot sector is bad and the backup boot sector is valid. Boot sectors are not identical.

• To copy the backup of the boot sector over the boot sector, select Backup BS, validate with Enter, use y to confirm and next OK.

More information about repairing your boot sector under TestDisk Menu Items. The following message is displayed:

The boot sector and its backup are now both OK and identical: the NTFS boot sector has been successfully recovered.

• Press Enter to quit.

• TestDisk displays You have to restart your Computer to access your data so press Enter a last time and reboot your computer.