This web-page is part of a larger website giving examples of how to install Windows+Ubuntu Linux operating systems 'dual boot' in a computer.  Illustrated Dual Boot HomePage.

This website is not an officially approved TestDisk website, it's just a representation of a home user's experiences with this great program, please refer to the official TestDisk site for the official documentation, it is very well documented there now.

Recommended External Links:

Ubuntu Rescue Remix  Ubuntu Rescue Remix is a GNU/Linux live system which runs from CD or USB flash device. It provides the data recovery specialist with a command-line interface environment equipped with the best free-libre, open source data recovery and forensics tools available. There is also a special Ubuntu Rescue Remix Web Forum where you may ask for expert help with your problems.

DataRecovery - Ubuntu Community Docs Please read the Ubuntu Documentation page on data recovery before you do anything.

TestDisk - CG Security the official homepage for TestDisk,  TestDisk has its own excellent illustrated documentation. PhotoRec - CG Security the official homepage for PhotoRec, TestDisk's companion application, so you can read the official documentation. An Introduction to Data Recovery, by Daniel B. Sedory (better know as The Starman).  recommended reading, it contains a lot of very good information. How to recover lost files after you accidentally wipe your hard drive by Shawn Hermans  -  Recommended if you're going to use PhotoRec Recovering Windows files with a Ubuntu CD III: deleted files - Ubuntucat by aysiu -  also recommended if you need to use PhotoRec Disk Recovery, a Ubuntu Web Forums thread, particularly see brennydoogles' prorganize.sh script  -  for use with PhotoRec

Once again, please refer to the above linked external websites before taking any actions based on information from the examples shown on this site.

• Above all, take your time and proceed calmly,  do a lot of reading first
• 'Lost' data  can remain on a hard disk for years, there is no need to hurry
• If you start feeling too nervous or excited, go away and do something else for a while and come back later

The main intention of this web page is to try to illustrate how TestDisk works in an example operation to try to help those without experience to see what they can expect to be asked by TestDisk and what will happen next. Below here are examples of what it's like to run TestDisk to recover lost partitions. TestDisk can do much more than just what is illustrated here.

Page Index

Recovering an accidentally deleted NTFS partition on a second hard disk with TestDisk in Ubuntu installed in the first hard disk (simple) Recovering a Lost Partition With TestDisk - searching deeper (advanced)

There are some important things to understand if you need to use TestDisk for restoring a lost partition or for reconstructing a damaged partition table. TestDisk can be used to scan your hard disk for sectors that resemble the beginning sectors of file systems. Those sectors may remain on the hard disk for virtually forever or until they get 'zeroed out' or overwritten with new data. When the information about the starting locations and the lengths of the file systems is found, TestDisk  will show you that information and you can choose which partitions you want written to a new partition table (in the MBR of the hard disk).  That information is often enough to restore the complete file system and all the data it contains. If you have a hard disk that has not been repartitioned a great number of times, using TestDisk should be fairly simple, as shown in the first example in this page. If you are running TestDisk on a hard disk that has had of repartitioning work done on it, then TestDisk might find file systems that might not be compatable to restore together. They may overlap other partitions or they might not all fit in the partition table. The partition table contains four slots of sixteen bytes each, so there can only be four primary partitions per hard disk. One of those slots can contain an 'extended' partition instead, which refers to a string of 'logical' partitions, but these 'logical' partitions need to be strung together in a series. (A primary partition can't be placed in between logical partitions or it will 'break the chain'). The second example in this page shows how ot use TestDisk to 'search deeper', and is more advanced. You'll see right at the bottom of this page (in the last illustration) where there is a range of possible partitions presented for possible restoration to the partition table and the user needs to be able to decide which ones are required or compatible (possible). The partitions to be included in the new partition table must be marked with an ' * ' or an 'L' or a 'P', or they won't be included in the new partition table. Partition numbering may be possibly changed, that can be a good thing in some circumstances, and if you become skilled with TestDisk you may be able to use that to your advantage. Having changed partition numbers for a data partition probably won't matter. Having  changed partition numbers for an operating system partition might mean a little extra work for some people because that may affect booting.   If you're using Ubuntu Linux you may need to edit /boot/grub/menu.lst to update it with new partition numbers, and possibly /etc/fstab if your file systems have been changed too. Editing /etc/fstab. You may find Super Grub Disk useful for helping you boot for the first time so you can edit those files easily. If you change the partition number for a Windows XP operating system, you will probably need to edit boot.ini to make Windows XP bootable again. If you can't boot Windows XP you might go to How to fix: NTLDR is missing, press any key to restart and look there for a boot CD file you can burn to disk and use for booting your Windows XP, there are floppy of USB files you can download there too.

Recovering an accidentally deleted NTFS partition on a second hard disk with TestDisk in Ubuntu installed in the first hard disk.

It is a good idea to run 'sudo fdisk -l' in a terminal before starting TestDisk, to see the size of your partitions in blocks.
Print it out if you can , or copy it somehow.  TestDisk will give you lists of your partitions using block numbers for start points for start and end points for partitions to be rescued.
If you know what your disks and partitions look like in blocks and cylinders you will be better prepared to make decisions when TestDisk is running.
sudo fdisk -l
In this example there are no partitions in /dev/hdb, which is the second hard drive in this machine because it had one big NTFS partition filling the entire disk that has been 'accidentally' deleted.
That's what we are going to try to recover shortly.


If TestDisk is installed in your Ubuntu operating system you can give the command 'sudo testdisk' to start TestDisk.
It is important to use 'sudo' to run TestDisk because you need to be root to run TestDisk, you won't get far otherwise.

TestDisk and many other useful recovery programs come standard in Ubuntu Rescue Remix.
When Ubuntu Rescue Remix is installed in a hard drive or an external USB hard disk drive, it's easier to use PhotoRec. That way PhotoRec can just dump all the recovered files in the /home/ubuntu folder and you can sort them out with Linux commands or a script later. It's best if the hard disk or USB external hard disk you install Ubuntu Rescue Remix in is larger than the hard disk you need to recover files from. (At least I think so, but maybe with more practice my skills with Photorec will improve and I'll learn better ways of doing things).

If you are using a standard Ubuntu Live CD or hard disk installed OS, or USB, and TestDisk has not yet been installed, you can install it in Ubuntu through apt-get or synaptic package manager.
You can also run TestDisk from a Live CD that already has TestDisk in it. GParted -- LiveCD is one such CD, and so is System Rescue CD and also Knoppix, packages-dvd.txt

TestDisk 6.5, Data Recovery Utility, October 2006 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org   TestDisk is a data recovery designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certian types of viruses or human error. It can also be used to repair some filesystem errors Information gathered during TestDisk use can be recorded for later review. If you choose to create a text file, testdisk.log  , it will contain TestDisk options, technical information and various outputs, including any folders/file names TestDisk was used to find and list on screen. Use Arrow keys to select, then press Enter key:  [ Create ]   Create a new log file  [ Append ]   Append information to the log file  [ No Log ]   Don't record anything

A testdisk log will be created in your /home/username directory. This can be handy to refer to later on, it is wise to make one, and I don't see how it could do any harm.

TestDisk 6.5, Data Recovery Utility, October 2006 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org   TestDisk as free software, and comes with ABSOLUTELY NO WARRANTY. Select a media (use Arrow keys, then press Enter): Disk /dev/hda - 160 GB / 149 GiB   Disk /dev/hdb - 160 GB / 149 GiB Disk /dev/hdc -  20 MB /  19 GiB   [Proceed]       [  Quit   ] Note: Disk capacity must be correctly detected for a successful recovery. If a disk listed above has incorrect size, check HD jumper settings, BIOS detection, and install the latest OS patches and disk drivers.

TestDisk 6.5, Data Recovery Utility, October 2006 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org Disk /dev/hdb - 160 GB / 149 GiB Please select the partition table type, press Enter when done. [ Intel ]  Intel/PC partition [Mac    ]   Apple partition map [None   ]   Non partitioned media [Sun    ]   Sun Solaris partition [XBox   ]   XBox partition [Return ]  Return to disk selection Note: Do NOT select  'None' for media with only a single partition. It's very rare for a drive to be 'Non-partitioned'.

TestDisk 6.5, Data Recovery Utility, October 2006 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org Disk /dev/hdb - 160 GB / 149 GiB - CHS 19457 255 63 [ Analyse ]  Analyse current  partition structure and search for lost partitions [Advanced ]   Filesystem Utils [Geometry ]   Change disk geometry [Options  ]   Modify options [MBR Code ]   Write TestDisk MBR code to the first sector [Delete   ]   Delete all data in the partition table [Quit     ]   Return to disk selection Note: Correct disk geometry is required for a successful recovery. 'Analyse' process may give some warnings if it thinks the logical geometry is mismatched.

TestDisk 6.5, Data Recovery Utility, October 2006 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org Disk /dev/hdb - 160 GB / 149 GiB - CHS 19457 255 63 Current partition structure:     Partition                    Start        End             Size in sectors No partition is bootable   *=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted [Proceed  ]                               Try to locate partition

TestDisk 6.5, Data Recovery Utility, October 2006 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org Disk /dev/hdb - 160 GB / 149 GiB - CHS 19457 255 63 Current partition structure:     Partition                    Start              End         Size in sectors * HPFS - NTFS                  0   1   1     19456  254  63        312576642  Structure: Ok.  Use Up/Down Arrow keys to select partition. Use Left/Right Arrow keys to CHANGE partition characteristics: *=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted                        Keys A: add partition, L: load backup, T: change type, P: list files,             Enter: to continue NTFS, 160 GB /149 GiB

TestDisk 6.5, Data Recovery Utility, October 2006 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org Disk /dev/hdb - 160 GB / 149 GiB - CHS 19457 255 63 Current partition structure:     Partition                    Start           End        Size in sectors 1 * HPFS - NTFS               0   1   1   19456  254   63    312576642 [  Quit   ]     [ Search!  ]   [  Write  ]                                Write partition structure to disk

TestDisk 6.5, Data Recovery Utility, October 2006 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org Write partition table, confirm ? (Y/N)

I typed a 'y' in this square to confirm.

TestDisk 6.5, Data Recovery Utility, October 2006 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org You will have to reboot for the change to take effect. [Ok]

Okay, that's it, my NTFS partition should be written to the partition table again now.

TestDisk 6.5, Data Recovery Utility, October 2006 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org Disk /dev/hdb - 160 GB / 149 GiB - CHS 19457 255 63 [ Analyse ]  Analyse current  partition structure and search for lost partitions [Advanced ]   Filesystem Utils [Geometry ]   Change disk geometry [Options  ]   Modify options [MBR Code ]   Write TestDisk MBR code to the first sector [Delete   ]   Delete all data in the partition table [Quit     ]  Return to disk selection Note: Correct disk geometry is required for a successful recovery. 'Analyse' process may give some warnings if it thinks the logical geometry is mismatched.

TestDisk 6.5, Data Recovery Utility, October 2006 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org   TestDisk as free software, and comes with ABSOLUTELY NO WARRANTY. Select a media (use Arrow keys, then press Enter): Disk /dev/hda - 160 GB / 149 GiB   Disk /dev/hdb - 160 GB / 149 GiB Disk /dev/hdc -  20 MB /  19 GiB   [Proceed]       [  Quit   ] Note: Disk capacity must be correctly detected for a successful recovery. If a disk listed above has incorrect size, check HD jumper settings, BIOS detection, and install the latest OS patches and disk drivers.

...and after rebooting the missing NTFS data partition was automatically mounted and the partition and all the files it contianed within had been fully restored and in perfect condition.























Recovering a Lost Partition With TestDisk -searching deeper

I use GParted LiveCD for just about everything. There is no icon on your rescue disk desktop for TestDisk, you just have to know TestDisk is one of the programs.
The hard disk you want to work on should be unmounted, so unless you have more than one disk in your computer, it is probably easier to run TestDisk from a Live CD. 

gparted ~ # testdisk

To start TestDisk, the testdisk command is entered into a terminal.
If you are using Ubuntu you need to type 'sudo testdisk' instead, and then you will be prompted for your password.

TestDisk 6.6, Data Recovery Utility, February 2007 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org   TestDisk is a data recovery designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certian types of viruses or human errors. Information gathered during TestDisk use can be recorded for later review. If you choose to create a text file, testdisk.log  , it will contain TestDisk options, technical information and various outputs, including any folders/file names TestDisk was used to find and list on screen. Use Arrow keys to select, then press Enter key:  [ Create ]   Create a new log file  [ Append ]   Append information to the log file  [ No Log ]   Don't record anything

This is the first TestDisk menu I saw. I chose to let it create a log file. TestDisk will work anyway even if you don't want a log file. I don't think it really matters, but a log file might be nice.