<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<meta name="keywords" content="OS Notes,TestDisk,TestDisk Download" />
<link rel="shortcut icon" href="favicon.ico" />
<link rel="search" type="application/opensearchdescription+xml" href="opensearch_desc.php" title="CGSecurity (English)" />
<link rel="copyright" href="http://www.gnu.org/copyleft/fdl.html" />
<title>OS Notes - CGSecurity</title>
<style type="text/css" media="screen, projection">/*<![CDATA[*/
@import "shared.css_97.css";
@import "main.css_97.css";
/*]]>*/</style>
<link rel="stylesheet" type="text/css" media="print" href="commonprint.css_97.css" />
<!--[if lt IE 5.5000]><style type="text/css">@import "ie50fixes.css_97.css";</style><![endif]-->
<!--[if IE 5.5000]><style type="text/css">@import "ie55fixes.css_97.css";</style><![endif]-->
<!--[if IE 6]><style type="text/css">@import "ie60fixes.css_97.css";</style><![endif]-->
<!--[if IE 7]><style type="text/css">@import "ie70fixes.css_97.css";</style><![endif]-->
<!--[if lt IE 7]><script type="text/javascript" src="iefixes.js_97"></script>
<meta http-equiv="imagetoolbar" content="no" /><![endif]-->
<script type= "text/javascript">/*<![CDATA[*/
var skin = "monobook";
var stylepath = "/mw/skins";
var wgArticlePath = "/wiki/$1";
var wgScriptPath = "/mw";
var wgScript = "/mw/index.php";
var wgServer = "http://www.cgsecurity.org";
var wgCanonicalNamespace = "";
var wgCanonicalSpecialPageName = false;
var wgNamespaceNumber = 0;
var wgPageName = "OS_Notes";
var wgTitle = "OS Notes";
var wgAction = "view";
var wgRestrictionEdit = [];
var wgRestrictionMove = [];
var wgArticleId = "1315";
var wgIsArticle = true;
var wgUserName = null;
var wgUserGroups = null;
var wgUserLanguage = "en";
var wgContentLanguage = "en";
var wgBreakFrames = false;
var wgCurRevisionId = "3941";
/*]]>*/</script>
<script type="text/javascript" src="wikibits.js_97"><!-- wikibits js --></script>
<script type="text/javascript" src="http://www.cgsecurity.org/mw/index.php?title=-&action=raw&gen=js&useskin=monobook"><!-- site js --></script>
<style type="text/css">/*<![CDATA[*/
@import "Common.css";
@import "Monobook.css";
@import "dyn.css";
/*]]>*/</style>
<!-- Head Scripts -->
<script type="text/javascript" src="ajax.js_97"></script>
</head>
<body class="mediawiki ns-0 ltr page-OS_Notes">
<div id="globalWrapper">
<div id="column-content">
<div id="content">
<a name="top" id="top"></a>
<h1 class="firstHeading">OS Notes</h1>
<div id="bodyContent">
<h3 id="siteSub">From CGSecurity</h3>
<div id="contentSub"></div>
<div id="jump-to-nav">Jump to: <a href="#column-one">navigation</a>, <a href="#searchInput">search</a></div> <!-- start content -->
<p>Precompiled binary executables are available for DOS, Win32, Linux and MacOS X from the <a href="testdisk_download.html" title="TestDisk Download">download</a> page.
</p>
<table id="toc" class="toc" summary="Contents"><tr><td><div id="toctitle"><h2>Contents</h2></div>
<ul>
<li class="toclevel-1"><a href="#DOS"><span class="tocnumber">1</span> <span class="toctext">DOS</span></a>
<ul>
<li class="toclevel-2"><a href="#Windows_95"><span class="tocnumber">1.1</span> <span class="toctext">Windows 95</span></a></li>
<li class="toclevel-2"><a href="#Windows_98"><span class="tocnumber">1.2</span> <span class="toctext">Windows 98</span></a></li>
</ul>
</li>
<li class="toclevel-1"><a href="#Windows"><span class="tocnumber">2</span> <span class="toctext">Windows</span></a>
<ul>
<li class="toclevel-2"><a href="#Disk_naming"><span class="tocnumber">2.1</span> <span class="toctext">Disk naming</span></a></li>
<li class="toclevel-2"><a href="#Missing_disk"><span class="tocnumber">2.2</span> <span class="toctext">Missing disk</span></a></li>
<li class="toclevel-2"><a href="#Windows_2000_and_48-bit_LBA"><span class="tocnumber">2.3</span> <span class="toctext">Windows 2000 and 48-bit LBA</span></a></li>
<li class="toclevel-2"><a href="#Windows_XP_and_48-bit_LBA"><span class="tocnumber">2.4</span> <span class="toctext">Windows XP and 48-bit LBA</span></a></li>
</ul>
</li>
<li class="toclevel-1"><a href="#Linux"><span class="tocnumber">3</span> <span class="toctext">Linux</span></a>
<ul>
<li class="toclevel-2"><a href="#Linux_and_48-bit_LBA"><span class="tocnumber">3.1</span> <span class="toctext">Linux and 48-bit LBA</span></a></li>
<li class="toclevel-2"><a href="#Precompiled_binaries"><span class="tocnumber">3.2</span> <span class="toctext">Precompiled binaries</span></a></li>
<li class="toclevel-2"><a href="#Disk_Geometry"><span class="tocnumber">3.3</span> <span class="toctext">Disk Geometry</span></a></li>
</ul>
</li>
<li class="toclevel-1"><a href="#FreeBSD"><span class="tocnumber">4</span> <span class="toctext">FreeBSD</span></a></li>
<li class="toclevel-1"><a href="#MacOS_.28PowerPC.29"><span class="tocnumber">5</span> <span class="toctext">MacOS (PowerPC)</span></a>
<ul>
<li class="toclevel-2"><a href="#Starting_TestDisk_or_PhotoRec"><span class="tocnumber">5.1</span> <span class="toctext">Starting TestDisk or PhotoRec</span></a></li>
<li class="toclevel-2"><a href="#Using_TestDisk"><span class="tocnumber">5.2</span> <span class="toctext">Using TestDisk</span></a></li>
<li class="toclevel-2"><a href="#Repairing.2FRewriting_Your_Drive.27s_Partition_Map"><span class="tocnumber">5.3</span> <span class="toctext">Repairing/Rewriting Your Drive's Partition Map</span></a></li>
<li class="toclevel-2"><a href="#PhotoRec:_Changing_files_ownership"><span class="tocnumber">5.4</span> <span class="toctext">PhotoRec: Changing files ownership</span></a></li>
</ul>
</li>
</ul>
</td></tr></table><script type="text/javascript"> if (window.showTocToggle) { var tocShowText = "show"; var tocHideText = "hide"; showTocToggle(); } </script>
<a name="DOS"></a><h2> <span class="mw-headline"> DOS </span></h2>
<p>DOS version of TestDisk can used under
</p>
<ul><li> MSDOS/<a href="http://www.freedos.org/" class="external text" title="http://www.freedos.org/" rel="nofollow">FreeDOS</a>
</li><li> Windows 95
</li><li> Windows 98
</li></ul>
<p>Hard disk must be detected by the computer's BIOS.
</p><p><b>Note:</b> In some rare cases, you may need to connect your hard drive directly to one of the motherboard's IDE connectors, as some IDE 'add-on cards' are broken; they do not follow the same standard <i>specs</i> used by TestDisk to find your drive.
</p>
<a name="Windows_95"></a><h3> <span class="mw-headline"> Windows 95</span></h3>
<p>You need to use the DOS version.
Hard disks and other media that are larger than 32 Gigabytes (GB) in size are not supported under any version of Windows 95. <a href="http://support.microsoft.com/?id=246818" class="external free" title="http://support.microsoft.com/?id=246818" rel="nofollow">http://support.microsoft.com/?id=246818</a>
</p><p><br />
</p>
<a name="Windows_98"></a><h3> <span class="mw-headline"> Windows 98</span></h3>
<p>You need to use the DOS version.
Windows 98 (with the correct patches) can handle hard disks larger than 32 GB; see: <a href="http://support.microsoft.com/?id=243450" class="external free" title="http://support.microsoft.com/?id=243450" rel="nofollow">http://support.microsoft.com/?id=243450</a> for any info that might pertain to your version of Windows 98.
</p><p>To handle hard disks larger than 137 GB, support for 48-bit Logical Block Addressing (LBA) must be available.
</p>
<a name="Windows"></a><h2> <span class="mw-headline"> Windows </span></h2>
<p>The 'Windows' version of TestDisk refers to NT 4/2000/XP/2003 only; for Win 9x see DOS version of TestDisk.
</p>
<a name="Disk_naming"></a><h3> <span class="mw-headline"> Disk naming </span></h3>
<p>Windows versions of TestDisk use <code>/dev/sdX</code> as the disk name (where 'X' would be <code>a, b, c...</code> etc. for your first, second, etc. drive location) rather than '<code>hdX</code>' (the usual IDE designation). '<code>sdX</code>' is the linux device name for SCSI hard disks, but TestDisk doesn't know if it's an IDE, SCSI or USB disk, because this name comes from the <b>cygwin</b> compiler used to make the Windows version of TestDisk. That compiler has internal mappings to Windows drives that use only the names <code>sdX</code>.
</p>
<a name="Missing_disk"></a><h3> <span class="mw-headline"> Missing disk </span></h3>
<p>If a digital camera or smart card isn't detected by TestDisk or PhotoRec, plug the memory card in a USB card reader.
</p>
<a name="Windows_2000_and_48-bit_LBA"></a><h3> <span class="mw-headline"> Windows 2000 and 48-bit LBA</span></h3>
<p>Windows 2000 SP3 added support for 48-bit Logical Block Addressing (LBA), which allows the OS to access hard disks larger than 137 GB. But, 48-bit LBA support must be 'enabled' in Windows 2000 SP3 or above! To do so, the <code>EnableBigLba</code> value must be defined and set properly in the Windows Registry by performing the following steps:
</p>
<ol><li> Start a Registry editor (e.g., regedit.exe). In Windows, click on Start -> Run, and enter <code>regedit</code>.
</li><li> Navigate to the <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi\Parameters</code> Registry subkey.
</li><li> From the Edit menu, select New, DWORD Value.
</li><li> Type the name EnableBigLba, then press ENTER.
</li><li> Double-click on the new value, set it to 1, then click OK.
</li><li> Close the Registry editor.
</li><li> You must restart the machine for the change to take effect.
</li></ol>
<p>If you are not familiar with Regedit, you may wish to try this tool instead: <a href="http://www.48bitlba.com/enablebiglbatool.htm" class="external free" title="http://www.48bitlba.com/enablebiglbatool.htm" rel="nofollow">http://www.48bitlba.com/enablebiglbatool.htm</a>
</p>
<a name="Windows_XP_and_48-bit_LBA"></a><h3> <span class="mw-headline"> Windows XP and 48-bit LBA</span></h3>
<p>Windows XP Service Pack 1 (SP1) adds support for 48-bit Logical Block Addressing (LBA), which allows you to access hard disks larger than 137 GB. <a href="http://support.microsoft.com/?id=303013" class="external free" title="http://support.microsoft.com/?id=303013" rel="nofollow">http://support.microsoft.com/?id=303013</a>
</p>
<a name="Linux"></a><h2> <span class="mw-headline"> Linux </span></h2>
<a name="Linux_and_48-bit_LBA"></a><h4> <span class="mw-headline"> Linux and 48-bit LBA </span></h4>
<p>Linux kernels since at least 2.4.19 have been able to access Large disks (drives over 137 GB using 48-bit LBA); and some earlier kernels, such as Red Hat 7.3's 2.4.18-x, were patched, so check the specific features of your install to know for sure. Linux kernels 2.2.x and older are limited to only 65,535 cylinders.
</p>
<a name="Precompiled_binaries"></a><h3> <span class="mw-headline"> Precompiled binaries </span></h3>
<p>The following instructions download the archive and run TestDisk or PhotoRec.
</p>
<pre>
wget http://www.cgsecurity.org/testdisk-6.7.linuxstatic.tar.bz2
tar xjf testdisk-6.7.linuxstatic.tar.bz2
cd testdisk-6.7/linux
</pre>
<p>TestDisk and PhotoRec must be run as root:
</p>
<ul><li> Using sudo: <code>sudo ./testdisk_static</code>, <code>sudo ./photorec_static</code>
</li><li> Using su: <code>su -c ./testdisk_static</code>, <code>su -c ./photorec_static</code>
</li></ul>
<p>The TestDisk and PhotoRec programs are compressed with <b>UPX</b>, which will decompress and run in the <code>/tmp</code> directory. Free space must be available and execution of binaries on the mounted file system must be allowed (if necessary, enter: <code>mount -o remount,exec /tmp</code> ).
</p>
<a name="Disk_Geometry"></a><h3> <span class="mw-headline"> Disk Geometry </span></h3>
<p>You may have to use the Geometry menu to enter the correct disk geometry.
</p>
<a name="FreeBSD"></a><h2> <span class="mw-headline"> FreeBSD </span></h2>
<p>Under FreeBSD 5.2-RC1 and possibly other versions, you may have to use the Geometry menu to enter the correct disk geometry.
</p>
<a name="MacOS_.28PowerPC.29"></a><h2> <span class="mw-headline"> MacOS (PowerPC) </span></h2>
<a name="Starting_TestDisk_or_PhotoRec"></a><h3> <span class="mw-headline"> Starting TestDisk or PhotoRec </span></h3>
<ol><li> Open the Terminal program, found in the <code>/Applications/Utilities</code> folder.
</li><li> Using terminal commands such as <code>cd</code> (change directory), navigate to the folder where you downloaded or installed TestDisk.
<ul><li> The only sure-fire way of doing this is typing <code>cd</code>(space) and then dragging the folder containing TestDisk into the Terminal window. This will copy the location of the TestDisk directory after the current command on the terminal command line.
</li><li> If you have the TestDisk folder on your desktop, the command would look something like: <code>cd ~/Desktop/testdisk-6.4</code>
</li></ul>
</li><li> Move into the folder inside the TestDisk folder, where the binary executables are stored (in <code>darwin/</code> on MacOS ports). The command for this would look something like: <code>cd darwin</code>.
</li><li> Now it's time to run TestDisk (or PhotoRec). To do this, type <code>sudo ./testdisk</code> (or <code>sudo ./photorec</code>). The <code>sudo</code> command tells your system to run testdisk as root ("administrator", or superuser). You will be required to enter your password (no echo of the characters will be apparent on the screen), press the enter key to validate .
</li></ol>
<a name="Using_TestDisk"></a><h3> <span class="mw-headline"> Using TestDisk </span></h3>
<ul><li> Upon startup, the following will appear. Highlight the disk of interest and hit return/enter to select it.<br />
</li></ul>
<pre>
Select a media (use Arrow keys, then press Enter):
Disk /dev/disk0 - 80 GB / 74 GiB - CHS 156301488 1 1 (RO), sector size=512
Disk /dev/disk1 - 250 GB / 232 GiB - CHS 488397168 1 1, sector size=512
Disk /dev/rdisk0 - 80 GB / 74 GiB - CHS 156301488 1 1 (RO), sector size=512
Disk /dev/rdisk1 - 250 GB / 232 GiB - CHS 488397168 1 1, sector size=512
</pre><br />
<ul><li> Once the disk of interest is selected, you must tell TestDisk what type of partition table to expect. For MacOS users, this is probably the <code>[Mac ]</code> option.<br />
</li></ul>
<pre>
Disk /dev/rdisk1 - 250 GB / 232 GiB - CHS 488397168 1 1
Please select the partition table type, press Enter when done.
[Intel ] Intel/PC partition
[Mac ] Apple partition map
[None ] Non partioned media
[Sun ] Sun Solaris partition
[XBox ] XBox partition
[Return ] Return to disk selection
</pre><br />
<ul><li> At this point, you should analyze the disk to see if TestDisk can determine the partion map to replace the possibly-corrupted version on the drive. Select <code>[ Analyse ]</code> from the menu and hit return/enter.<br />
</li></ul>
<pre>
Disk /dev/rdisk1 - 250 GB / 232 GiB - CHS 488397168 1 1
[ Analyse ] Analyse current partition structure and search for lost partition
[ Advanced ] Filesystem Utils
[ Geometry ] Change disk geometry
[ Options ] Modify options
[ Quit ] Return to disk selection
</pre><br />
<ul><li> The following screen will appear, allowing you to tell TestDisk if the partitions are "Primary" or "Deleted" partitions. I'm not sure if it's critical to mark any as "D" -- I believe they default to "P". Select proceed, and hit return/enter.<br />
</li></ul>
<pre>
Current partition structure:
1 P partition_map 1 63 63
2 P Free 64 262207 262144
3 P HFS 262208 162267199 162004992
4 P Free 162267200 162529343 262144
5 P HFS 162529344 324534335 162004992
6 P Free 324534336 324796479 262144
7 P HFS 324796480 488397151 163600672
P=Primary D=Deleted
[Proceed ] [ Save ]
</pre><br />
<ul><li> After analyzing, a screen will appear, informing you of the partitions that were found (the partitions will be colored green). Hit return/enter to return to the display of all the partions found, which looks something like the screen below. You will need to copy/print this information for later, as it will be required for rewriting the partion table using <code>pdisk</code>. <b>Copying to a text file is recommended, as partitioning your drive incorrectly could cause further problems.</b> Once copied, select <code>[ Quit ]</code> and exit TestDisk.<br />
</li></ul>
<pre>
Current partition structure:
Partition Start End Size in sectors
1 P partition_map 1 63 63
2 P Free 64 262207 262144
3 P HFS 262208 162267199 162004992
4 P Free 162267200 162529343 262144
5 P HFS 162529344 324534335 162004992
6 P Free 324534336 324796479 262144
7 P HFS 324796480 488397151 163600672
[ Quit ] [ Write ]
</pre>
<p>Now you can use this information with pdisk to rewrite your drive partition map.
</p>
<a name="Repairing.2FRewriting_Your_Drive.27s_Partition_Map"></a><h3> <span class="mw-headline"> Repairing/Rewriting Your Drive's Partition Map </span></h3>
<p>To rewrite the partition map given by TestDisk, use the command pdisk. If pdisk reports, "No partition map exists," it may be necessary to initialize the disk. Once the disk is initialized, the numeric entries defining the partition may completed and a name may be assigned to the partition ("rec_part" in the example below). Given the following information from TestDisk,<br />
</p>
<pre>
Disk /dev/rdisk1 - 160 GB / 149 GiB - CHS 312581808 1 1
Partition Start End Size in sectors
P HFS 262208 312581791 312319584
</pre><br />the required pdisk commands are:<br />
<pre>
pdisk: No valid block 1 on '/dev/rdisk1'
Edit /dev/rdisk1 -
Command (? for help): c
No partition map exists
Command (? for help): i
Command (? for help): c
First block: 262208
Length in blocks: 312319584
Name of partition: rec_part
Command (? for help): w
Command (? for help): q
</pre><br />
<p><b>Note</b>: pdisk is for Mac PowerPC partition table, not for Mac Intel partition table.
</p>
<a name="PhotoRec:_Changing_files_ownership"></a><h3> <span class="mw-headline"> PhotoRec: Changing files ownership </span></h3>
<p>As PhotoRec is run as root, files recovered by PhotoRec are also owned by the root user.
Use the <code>id</code> command to get your username and groupname.
To change the files and directories ownership, use
<code>sudo chown -R username:groupname recup_dir.*</code>
</p><p>Return to <a href="testdisk.html" title="TestDisk">TestDisk</a>
</p>
<!-- Saved in parser cache with key cg_mw-mw_:pcache:idhash:1315-0!1!0!!en!2!edit=0 and timestamp 20071123142913 -->
<div id="catlinks"><p class='catlinks'><a href="http://www.cgsecurity.org/wiki/Special:Categories" title="Special:Categories">Category</a>: <span dir='ltr'><a href="http://www.cgsecurity.org/wiki/Category:Data_Recovery" title="Category:Data Recovery">Data Recovery</a></span></p></div> <!-- end content -->
<div class="visualClear"></div>
</div>
</div>
</div>
<div id="column-one">
<div class="portlet" id="p-logo">
<a style="background-image: url(logo.png);" href="http://www.cgsecurity.org/" title="Visit the Main Page [z]" accesskey="z"></a>
</div>
<script type="text/javascript"> if (window.isMSIE55) fixalpha(); </script>
<div class='portlet' id='p-Data_Recovery'>
<h5>Data Recovery</h5>
<div class='pBody'>
<ul>
<li id="n-TestDisk"><a href="testdisk.html">TestDisk</a></li>
<li id="n-PhotoRec"><a href="photorec.html">PhotoRec</a></li>
<li id="n-Download"><a href="testdisk_download.html">download</a></li>
</ul>
</div>
</div>
</div><!-- end of the left (by default at least) column -->
<div class="visualClear"></div>
<div id="footer">
<div id="f-copyrightico"><a href="http://www.gnu.org/copyleft/fdl.html"><img src="gnu_fdl.png" alt='GNU Free Documentation License 1.2' /></a></div>
<ul id="f-list">
<li id="lastmod"> This page was last modified 20:57, 31 October 2007.</li>
<li id="copyright">Content is available under <a href="http://www.gnu.org/copyleft/fdl.html" class="external " title="http://www.gnu.org/copyleft/fdl.html" rel="nofollow">GNU Free Documentation License 1.2</a>.</li>
</ul>
</div>
<script type="text/javascript">if (window.runOnloadHook) runOnloadHook();</script>
</div>
</body><!-- Cached 20071123142913 -->
</html>
