With TestDisk, you can fix partition table, recover deleted partition, recover FAT32 boot sector from its backup, rebuild FAT12/FAT16/FAT32 boot sector, fix FAT tables, rebuild NTFS boot sector, recover NTFS boot sector from its backup, fix MFT using MFT mirror, locate ext2/ext3/ext4 Backup SuperBlock, undelete files from FAT, exFAT, NTFS and ext2 filesystem, and copy files from deleted FAT, exFAT, NTFS and ext2/ext3/ext4 partitions. Available for Microsoft Windows, Apple MAC and Linux, it can find lost partitions from many file systems and all media (hard disk, USB, smart card). This is a complete guide on how to use TestDisk for quick search and even deeper search to recover lost of deleted partitions from hard disks.
TestDisk by cgsecurity is the popular choice, to recover lost partitions and it has features for both novices and experts. You will have to run TestDisk on another computer and attach concerned hard drive with that system. You can also use a live rescue CD or USB to boot from, to recover lost partitions. Scan that hard disk and TestDisk will present you with the lost partitions. It also has a deep scan mode (deeper search) if it can not find the partitions in normal mode.
How to Use TestDisk – Normal Recovery
Normal search and recovery is for lost partition that was just lost and was not over written. If we have lost partition and we have some unallocated space in hard drive, in this case TestDisk quick search will be enough to find that partition. Later on you just recover it by marking it logical and selecting it for recovery.
* Above images were created on Microsoft Windows 7 that has a healthy hard disk.
- Attach the hard disk that has lost partitions to your computer.
- Run TestDisk.
- Hit Enter on Create.
- Select the drive that has lost partitions.
- Hit Enter on Proceed.
- Select the partition table type that you want to recover and hit Enter. In our case it is Intel/PC Partition because we want to recover NTFS partitions. TestDisk will select appropriate partition table type already.
- Hit Analyze (Analyze lost partitions).
- Hit Enter on Quick Search.
- It will find lost partitions and display.
- Hit Enter to continue.
- Next it will ask for deeper search. If it has already found the lost partitions then no need to do deeper search.
- Select Write and hit Enter.
- Confirm partition table to write by typing Y.
- Hit Enter on OK.
- Select Quit and hit Enter.
- Reboot system for changes to take effect.
After the reboot your lost partitions will be recovered. Following is the video tutorial of how TestDisk works.
Partition Recovery on Linux
Partition Recovery on Microsoft Windows
TestDisk – Deeper Search
Deeper Search is different. In case lost partition was over written by another partition, then we have to use deeper search. It will take time. For 500 GB hard disk, it will take approximately 2 and half hours to scan sector by sector for lost partitions. After that it will present lost partitions. You have to mark the partitions (by using arrow keys – mark them logical) that you want to recover. Those marked partitions will be selected and you will be able to write those to disk in next step. This step is tricky. You can encounter errors in this area as:
- Partition can not be recovered.
- The hard disk seems too small. Check the hard disk size, HD jumpers or BIOS detection.
- Invalid partition structure.
If you encounter error, you can not go back. You will have to analyze and scan/search again. This is the big issue. It does not store the results. Make proper choice and recover data or start over (2 and half hours scanning time for 500 GB hard disk).
* Above images were created on hard disk containing Ubuntu by running a live rescue USB drive (SystemRescueCD containing TestDisk). Mission was to run TestDisk from live rescue bootable USB to try and recover lost partitions (NTFS > Work, NTFS > Entertainment). Mission was not successful during quick search. Deeper search showed lost partitions but could not recover.
You have to mark the found partitions as primary bootable, primary and logical according to recommended partition recognition guide. The first primary partition usually starts at cylinder 0, head 1, sector 1. Additional primary partitions are starting at a non-nul cylinder, head 0, sector 1. A logical partition’s start is usually a non-null cylinder, head 1, sector 1. It will take care of extended partition itself.
I believe that you should have proper unallocated space in hard disk to recover lost partitions. This and marking partitions as primary and logical makes the process complicated.
If it is just a matter of partition lost, then probably ‘quick search’ will solve the problem but if you have to do a ‘deeper search’, you will see the lost partitions but recovery is a challenging task.
This tutorial is not just for Ubuntu or any other Linux. You can also use TestDisk to recover partitions from Microsoft Windows. Use step by step guide to run TestDisk on different operating systems.
We can’t change the partition table of a hard drive in use. All partitions of a drive need to be unmounted before we can rescue partition tables on that drive. In case of laptop, if you do not want to detach hard disk from it, you can recover partition from that by booting a live system. TestDisk is also available on live rescue CDs. Live rescue CDs will enable you to run TestDisk from a live CD to recover lost partition on same PC. Universal USB Installer is helpful to create live CD or bootable USB from ISO file downloaded to create Linux based live CD.
In case of live rescue disk, our recommendation is Ubuntu Rescue Remix or System Rescue CD. Ubuntu Rescue Remix will create an image of drive and transfer it to another location. Then it will recover data bit by bit. I used ‘system rescue cd’ that comes with TestDisk. After burning live rescue OS to USB, when you boot from it, you will have to use ‘StartX‘ command for its GUI and then run TestDisk from Start -> System -> TestDisk.
UPDATE: TestDisk can recover lost partitions after deep search also. I was successful in second try. In first try, I was marking ‘work’ and ‘entertainment’ as logical partitions (above screenshots) but originally these both were primary before these were lost. So I had to mark them primary to recover them.
Second time I used deep search by Testdisk and it showed me some partitions not recoverable due to low disk space.
After that screen it showed all the partitions to recover from.
After that I marked partitions of ‘work’ and ‘entertainment’ to be recovered. I marked them as primary partitions and testdisk showed me green background that means these were primary partitions. I have told above that you have to select partition and use left or right arrow keys to mark these partitions. I selected a C partition as primary and bootable which I will tell in the end that why I did so.
Here are the partitions ready to be recovered.
After I selected ‘write’, system had to reboot for Testdisk to recover partitions and that did not took any more time. Just reboot and there your lost partitions are. Gparted confirmed that. Gparted is a partition tool that was in ‘live rescue disk’ (System Rescue CD – mentioned above) that I was using.
So my partitions were recovered. Then I used live Ubuntu disk to browse partitions ‘work’ and ‘entertainment’ and copied data from those partitions to an external hard disk. I created ‘bootable live Ubuntu USB disk’ to do that.
Second time I deleted Ubuntu partition from laptop and created few partitions again by using Gparted from live rescue disk. I was about to install OS again but thought to try Testdisk for one more time. In the quick search it gave me same partitions that I just had created but in the deep search it first showed me partitions that were not recoverable. But at next screen it offered all partitions it could find.
I had to mark partitions from the results to recover. Marking is an important step. At that point I remembered that ‘work’ and ‘entertainment’ partitions were primary. So I marked them both as primary by selecting and using left and right arrow keys. When my guess was correct, Testdisk also confirmed it by displaying green background. I marked C partition as primary and bootable. C partition had no file and no OS in it. I just had created it. I used C as a precaution. The important thing is this, collectively ‘C’, ‘work’ and ‘entertainment’ partitions size was not more than total hard disk size.
When you will understand the above step, you will be successfully able to recover partitions. Testdisk will ask to write these partitions to disk. Proceed with that and after reboot, you will get back your partitions containing all your lost data. Believe me, recovering partitions containing data is less time consuming as compared to recovering data from lost partitions. If you can, first try to recover partitions in case of partitions loss. Go for data recovery if you have deleted data but if you have lost partition, then go for whole partition recovery. Testdisk is fast in recovering whole partition. It takes time only in searching. After it shows results, its just the matter of selecting partitions to recover and rebooting system.
If you have confusion about Testdisk, ask me in comments and I will be glad to explain it for you.