<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<meta name="keywords" content="TestDisk Step By Step,Data Recovery Examples,Partition recognition primary and logical,Running TestDisk,Schritt für Schritt Wiederherstellungsbeispiel,TestDisk,TestDisk Download,TestDisk Etape par Etape" />
<link rel="shortcut icon" href="favicon.ico" />
<link rel="search" type="application/opensearchdescription+xml" href="opensearch_desc.php" title="CGSecurity (English)" />
<link rel="copyright" href="http://www.gnu.org/copyleft/fdl.html" />
<title>TestDisk Step By Step - CGSecurity</title>
<style type="text/css" media="screen, projection">/*<![CDATA[*/
@import "shared.css_97.css";
@import "main.css_97.css";
/*]]>*/</style>
<link rel="stylesheet" type="text/css" media="print" href="commonprint.css_97.css" />
<!--[if lt IE 5.5000]><style type="text/css">@import "ie50fixes.css_97.css";</style><![endif]-->
<!--[if IE 5.5000]><style type="text/css">@import "ie55fixes.css_97.css";</style><![endif]-->
<!--[if IE 6]><style type="text/css">@import "ie60fixes.css_97.css";</style><![endif]-->
<!--[if IE 7]><style type="text/css">@import "ie70fixes.css_97.css";</style><![endif]-->
<!--[if lt IE 7]><script type="text/javascript" src="iefixes.js_97"></script>
<meta http-equiv="imagetoolbar" content="no" /><![endif]-->
<script type= "text/javascript">/*<![CDATA[*/
var skin = "monobook";
var stylepath = "/mw/skins";
var wgArticlePath = "/wiki/$1";
var wgScriptPath = "/mw";
var wgScript = "/mw/index.php";
var wgServer = "http://www.cgsecurity.org";
var wgCanonicalNamespace = "";
var wgCanonicalSpecialPageName = false;
var wgNamespaceNumber = 0;
var wgPageName = "TestDisk_Step_By_Step";
var wgTitle = "TestDisk Step By Step";
var wgAction = "view";
var wgRestrictionEdit = [];
var wgRestrictionMove = [];
var wgArticleId = "1927";
var wgIsArticle = true;
var wgUserName = null;
var wgUserGroups = null;
var wgUserLanguage = "en";
var wgContentLanguage = "en";
var wgBreakFrames = false;
var wgCurRevisionId = "4140";
/*]]>*/</script>
<script type="text/javascript" src="wikibits.js_97"><!-- wikibits js --></script>
<script type="text/javascript" src="http://www.cgsecurity.org/mw/index.php?title=-&action=raw&gen=js&useskin=monobook"><!-- site js --></script>
<style type="text/css">/*<![CDATA[*/
@import "Common.css";
@import "Monobook.css";
@import "dyn.css";
/*]]>*/</style>
<!-- Head Scripts -->
<script type="text/javascript" src="ajax.js_97"></script>
</head>
<body class="mediawiki ns-0 ltr page-TestDisk_Step_By_Step">
<div id="globalWrapper">
<div id="column-content">
<div id="content">
<a name="top" id="top"></a>
<h1 class="firstHeading">TestDisk Step By Step</h1>
<div id="bodyContent">
<h3 id="siteSub">From CGSecurity</h3>
<div id="contentSub"></div>
<div id="jump-to-nav">Jump to: <a href="#column-one">navigation</a>, <a href="#searchInput">search</a></div> <!-- start content -->
<p><img src="en.png" alt="en.png" /> <strong class="selflink">TestDisk Step By Step</strong><br />
<img src="fr.png" alt="fr.png" /> <a href="testdisk_etape_par_etape.html" title="TestDisk Etape par Etape">TestDisk Etape par Etape</a><br />
<img src="de.png" alt="de.png" /> <a href="schritt_fer_schritt_wiederherstellungsbeispiel.html" title="Schritt für Schritt Wiederherstellungsbeispiel">Schritt für Schritt Wiederherstellungsbeispiel</a><br />
</p><p>This <b><i>Recovery example</i></b> guides you through TestDisk step by step to recover a missing partition and repair a corrupted one.
</p>
<table id="toc" class="toc" summary="Contents"><tr><td><div id="toctitle"><h2>Contents</h2></div>
<ul>
<li class="toclevel-1"><a href="#Example_problem"><span class="tocnumber">1</span> <span class="toctext">Example problem</span></a></li>
<li class="toclevel-1"><a href="#Symptoms"><span class="tocnumber">2</span> <span class="toctext">Symptoms</span></a></li>
<li class="toclevel-1"><a href="#Running_TestDisk_executable"><span class="tocnumber">3</span> <span class="toctext">Running TestDisk executable</span></a></li>
<li class="toclevel-1"><a href="#Log_creation"><span class="tocnumber">4</span> <span class="toctext">Log creation</span></a></li>
<li class="toclevel-1"><a href="#Disk_selection"><span class="tocnumber">5</span> <span class="toctext">Disk selection</span></a></li>
<li class="toclevel-1"><a href="#Partition_table_type_selection"><span class="tocnumber">6</span> <span class="toctext">Partition table type selection</span></a></li>
<li class="toclevel-1"><a href="#Current_partition_table_status"><span class="tocnumber">7</span> <span class="toctext">Current partition table status</span></a></li>
<li class="toclevel-1"><a href="#Quick_Search_for_partitions"><span class="tocnumber">8</span> <span class="toctext">Quick Search for partitions</span></a></li>
<li class="toclevel-1"><a href="#Save_the_partition_table_or_search_for_more_partitions_.3F"><span class="tocnumber">9</span> <span class="toctext">Save the partition table or search for more partitions ?</span></a></li>
<li class="toclevel-1"><a href="#A_partition_is_still_missing:_Deeper_Search"><span class="tocnumber">10</span> <span class="toctext">A partition is still missing: Deeper Search</span></a></li>
<li class="toclevel-1"><a href="#Partition_table_recovery"><span class="tocnumber">11</span> <span class="toctext">Partition table recovery</span></a></li>
<li class="toclevel-1"><a href="#NTFS_Boot_sector_recovery"><span class="tocnumber">12</span> <span class="toctext">NTFS Boot sector recovery</span></a></li>
</ul>
</td></tr></table><script type="text/javascript"> if (window.showTocToggle) { var tocShowText = "show"; var tocHideText = "hide"; showTocToggle(); } </script>
<a name="Example_problem"></a><h2> <span class="mw-headline"> Example problem </span></h2>
<p>We have a 36GB hard disk containing 3 partitions. Unfortunately:
</p>
<ul><li> the boot sector of the primary NTFS partition has been damaged, and
</li><li> a logical NTFS partition has been accidentally deleted.
</li></ul>
<p>This <b><i>recovery example</i></b> guides you through TestDisk, step by step, to recover these 'lost' partitions by:
</p>
<ul><li> rewriting the corrupted NTFS boot sector, and
</li><li> recovering the accidentally deleted logical NTFS partition.
</li></ul>
<p>Recovery of a FAT32 partition (instead of an NTFS partition) can be accomplished by following exactly the same steps. Other <a href="data_recovery_examples.html" title="Data Recovery Examples">recovery examples</a> are also availiable. For Information about FAT12, FAT16, ext2/ext3, HFS+, ReiserFS and other partition types, read <a href="running_testdisk.html" title="Running TestDisk">Running the TestDisk Program</a>.
</p>
<blockquote style="background: white; border: 1px solid rgb(153, 153, 153); padding: 1em;">
One condition:
<ul><li> TestDisk must be executed with "Administrator privileges."
</li></ul>
<br />
Important points for using TestDisk:
<ul><li> To navigate in TestDisk, use the <code>Arrow</code> and <code>PageUp/PageDown</code> keys.
</li><li> To proceed, confirm your choice(s) with the <code>Enter</code> key.
</li><li> To return to a previous display or quit TestDisk, use the <b><i>q</i></b> (Quit) key.
</li><li> To save modifications under TestDisk, you must confirm them with the <code><b>y</b></code> (Yes) and/or <code>Enter</code> keys, and
</li><li> To actually write partition data to the MBR, you must choose the "Write" selection and press the <code>Enter</code> key.
</li></ul>
</blockquote>
<a name="Symptoms"></a><h2> <span class="mw-headline"> Symptoms </span></h2>
<p>If this hard disk's primary partition contained an operating system, it would most likely no longer boot up; due to its corrupted boot sector. If the hard disk was a secondary (data) drive or you can connect the drive to another computer in its secondary channel (usually where a CD/DVD drive is connected), the following symptoms would be observed:
</p><p>1. Windows Explorer or Disk Manager displays the first primary partition as <i>raw</i> (unformatted) and Windows prompts: <code>The drive is not formatted, do you want to format it now?</code><br />[You should <i>never</i> do so without knowing why!]<br />
2. A logical partition is missing. In Windows Explorer, that logical drive is no longer available. The Windows Disk Management Console now displays only "unallocated space" where this logical partition had been located.
</p>
<a name="Running_TestDisk_executable"></a><h2> <span class="mw-headline"> Running TestDisk executable </span></h2>
<p>If TestDisk is not yet installed, it can be downloaded from <a href="testdisk_download.html" title="TestDisk Download">TestDisk Download</a>. Extract the files from the archive including the sub-directories.
</p><p>To recover lost partition or repair filesystem from hard disk, USB key, Smart Card..., you need enough rights to access physical device.
</p>
<ul><li> <img src="dos.png" alt="dos.png" /> Under Dos, run TestDisk.exe
</li><li> <img src="win.png" alt="win.png" /> Under Windows, start TestDisk (ie testdisk-6.9/win/testdisk_win.exe) from an account in the Administrator Group. Under Vista, use right-click "run as administrator" to launch TestDisk.
</li><li> <img src="linux.png" alt="linux.png" /> Under Unix/Linux/BSD, you need to be root to run TestDisk (ie. <code>sudo testdisk-6.9/linux/testdisk_static</code>)
</li><li> <img src="macosx.png" alt="macosx.png" /> Under MacOSX, if you are not root, TestDisk (ie testdisk-6.9/darwin/TestDisk) will restart itself using sudo after confirmation of your part.
</li><li> <img src="os2.png" alt="os2.png" /> Under OS/2, TestDisk doesn't handle physical device, only disk image, sorry.
</li></ul>
<p>To recover partition from a media image or repair a filesystem image, run
</p>
<ul><li> <code>testdisk image.dd</code> to carve a raw disk image
</li><li> <code>testdisk image.E01</code> to recover files from an Encase EWF image
</li><li> <code>testdisk 'image.E*'</code> if the Encase image is splitted in several files.
</li></ul>
<p><img src="linux.png" alt="linux.png" /> <img src="macosx.png" alt="macosx.png" /> To repair a filesystem not listed by TestDisk, run <code>testdisk device</code>, i.e.
</p>
<ul><li> <code>testdisk /dev/mapper/truecrypt0</code> to repair the NTFS or FAT32 boot sector files from a TrueCrypt partition. The same method works with filesystem encrypted with cryptsetup/dm-crypt/LUKS.
</li><li> <code>testdisk /dev/md0</code> to repair a filesystem on top of a Linux Raid device.
</li></ul>
<a name="Log_creation"></a><h2> <span class="mw-headline"> Log creation </span></h2>
<table align="center">
<tr>
<td> <a href="image_create_log.gif.html" class="image" title="menu create"><img alt="menu create" src="create_log.gif" width="669" height="338" border="0" /></a>
</td></tr></table>
<ul><li> Choose Create unless you have a reason to append data to the log or if you execute TestDisk from a read only media and nowhere else to create it.
</li><li> Press Enter to proceed.
</li></ul>
<a name="Disk_selection"></a><h2> <span class="mw-headline"> Disk selection </span></h2>
<p>All harddrives should be detected and listed with the correct size by TestDisk:
</p>
<table align="center">
<tr>
<td> <a href="image_select_disk.gif.html" class="image" title="disk selection"><img alt="disk selection" src="select_disk.gif" width="669" height="338" border="0" /></a>
</td></tr></table>
<ul><li> Use up/down arrow keys to select your harddrive with the lost partition/s.
</li><li> Press Enter to Proceed.
</li></ul>
<a name="Partition_table_type_selection"></a><h2> <span class="mw-headline"> Partition table type selection </span></h2>
<p>TestDisk displays the partition table types.
</p>
<table align="center">
<tr>
<td> <a href="image_partition_table_type.gif.html" class="image" title="menu partition table type"><img alt="menu partition table type" src="partition_table_type.gif" width="669" height="338" border="0" /></a>
</td></tr></table>
<ul><li> Select the partition table type, usually the default value is the correct one as TestDisk auto-detects the partition table type.
</li><li> Press Enter to Proceed.
</li></ul>
<a name="Current_partition_table_status"></a><h2> <span class="mw-headline"> Current partition table status </span></h2>
<p>TestDisk displays the menus (also see <a href="running_testdisk.html" title="Running TestDisk">TestDisk Menu Items </a>).
</p>
<table align="center">
<tr>
<td> <a href="image_menus.gif.html" class="image" title="menus"><img alt="menus" src="menus.gif" width="669" height="338" border="0" /></a>
</td></tr></table>
<ul><li> Use the default menu "Analyse" to check your current partition structure and search for lost partitions.
</li><li> Confirm at Analyse with Enter to proceed.
</li></ul>
<p>Now, your current partition structure is listed.
Examine your current partition structure for missing partitions and errors.
</p>
<table align="center">
<tr>
<td> <a href="image_analyse.gif.html" class="image" title="Analyse"><img alt="Analyse" src="analyse.gif" width="669" height="338" border="0" /></a>
</td></tr></table>
<p>The first partition is listed twice which points to a corrupted partition or an invalid partition table entry,<br />
Invalid NTFS boot points to a faulty NTFS boot sector, so it's a corrupted filesystem.<br />
Only one logical partition (label Partition 2) is available in the extended partition.
One logical partition is missing.
</p>
<ul><li> Confirm at <i><b>Quick Search</b></i> to proceed.
</li></ul>
<a name="Quick_Search_for_partitions"></a><h2> <span class="mw-headline"> Quick Search for partitions </span></h2>
<table align="center">
<tr>
<td> <a href="image_vista_check.gif.html" class="image" title="vista check"><img alt="vista check" src="vista_check.gif" width="669" height="338" border="0" /></a>
</td></tr></table>
<ul><li> Confirm according to your OS and created partitions to proceed.
</li></ul>
<table>
<tr>
<td> TestDisk displays the first results in real time.
</td><td> <div class="floatnone"><span><a href="image_quick_search.gif.html" class="image" title="quick search"><img alt="quick search" src="70px_quick_search.gif" width="70" height="35" border="0" /></a></span></div>
</td><td> (click on thumb to display the image).
</td></tr></table>
<p>During the <i><b>Quick Search</b></i>, TestDisk has found two partitions including the missing logical partition labeled <i><b><code>Partition 3</code></b></i>.
</p>
<table align="center">
<tr>
<td> <a href="image_first_results.gif.html" class="image" title="first results"><img alt="first results" src="first_results.gif" width="669" height="338" border="0" /></a>
</td></tr></table>
<ul><li> Highlight this partition and press <i><b>p</b></i> to list your files (to go back to the previous display, press q to Quit).<br />
</li></ul>
<p>All directories and data are correctly listed.
</p>
<ul><li> Press Enter to proceed.
</li></ul>
<a name="Save_the_partition_table_or_search_for_more_partitions_.3F"></a><h2> <span class="mw-headline"> Save the partition table or search for more partitions ? </span></h2>
<table align="center">
<tr>
<td> <a href="image_search_menu.gif.html" class="image" title="menu search!"><img alt="menu search!" src="search_menu.gif" width="669" height="338" border="0" /></a>
</td></tr></table>
<ul><li> <i><b>When all partitions are available</b></i> and data correctly listed, you should go to the menu <b>Write</b> to save the partition structure. The menu <code>Extd Part</code> gives you the opportunity to decide if the extended partition will use all available disk space or only the required (minimal) space.
</li><li> <b><i> Since a partition, the first one, is still missing</i></b>, highlight the menu <b><i>Deeper Search</i></b> (if already not done automatically) and press Enter to proceed.
</li></ul>
<a name="A_partition_is_still_missing:_Deeper_Search"></a><h2> <span class="mw-headline"> A partition is still missing: Deeper Search </span></h2>
<p><b><i>Deeper Search</i></b> will also search for FAT32 backup boot sector, NTFS backup boot superblock, EXT2/EXT3 backup superblock
to detect more partitions,
</p>
<table>
<tr>
<td> it will scan each cylinder
</td><td> <div class="floatnone"><span><a href="image_quick_search.gif.html" class="image" title="quick search"><img alt="quick search" src="70px_quick_search.gif" width="70" height="35" border="0" /></a></span></div>
</td><td> (click on thumb).
</td></tr></table>
<p>After the Deeper Search, the results are displayed as follows:<br />
The first partition <b><i>"Partition 1"</i></b> was found by using backup boot sector.
In the last line of your display, you can read the message <b><i>"NTFS found using backup sector!"</i></b> and the size of your partition.
The "partition 2" is displayed twice with different size.<br />
Both partitions are listed with status <b><i>D</i></b> for deleted, because they overlap each other.
</p>
<table align="center">
<tr>
<td> <a href="image_results_deeper_search.gif.html" class="image" title="results deeper search!"><img alt="results deeper search!" src="results_deeper_search.gif" width="669" height="338" border="0" /></a>
</td></tr></table>
<ul><li> Highlight the first partition <code>Partition 2</code> and press <b><i>p</i></b> to list its data.
</li></ul>
<table>
<tr>
<td>The file system of the upper logical partition (label Partition 2) is damaged
</td><td> <div class="floatnone"><span><a href="image_damaged_file_system.gif.html" class="image" title="damaged file system"><img alt="damaged file system" src="30px_damaged_file_system.gif" width="30" height="15" border="0" /></a></span></div>
</td><td>(click on thumb).
</td></tr></table>
<ul><li> Press q for Quit to go back to the previous display.
</li><li> Let this partition <code>Partition 2</code> with a damaged file system marked as <code>D(deleted)</code>.
</li><li> Highlight the second partition <code>Partition 2</code> below
</li><li> Press p to list its files.
</li></ul>
<table align="center">
<tr>
<td> <a href="image_list_files.gif.html" class="image" title="list files"><img alt="list files" src="list_files.gif" width="669" height="338" border="0" /></a>
</td></tr></table>
<p>It works, you have found the correct partition!
</p>
<ul><li> Use the left/right arrow to navigate into your folders and watch your files for more verification<br />
</li></ul>
<p><b><i>Note:</i></b> FAT directory listing is limited to 10 clusters, some files may not appears but it doesn't affect recovery.<br />
</p>
<ul><li> Press q for Quit to go back to the previous display.
</li></ul>
<ul><li> The available status are Primary, * bootable, Logical and Deleted.
</li></ul>
<p>Using the left/right arrow keys, change the status of the selected partition to <b><i><code>L(ogical)</code></i></b>
</p>
<table align="center">
<tr>
<td> <a href="image_set_partition_to_recover.gif.html" class="image" title="set partition to recover"><img alt="set partition to recover" src="set_partition_to_recover.gif" width="669" height="338" border="0" /></a>
</td></tr></table>
<p>Hint: read <a href="partition_recognition_primary_and_logical.html" title="Partition recognition primary and logical"> <b><i>How to recognize primary and logical partitions?</i></b> </a><br />
Note: If a partition is listed *(bootable) but if you don't boot from this partition, you can change it to <b><i>P</i></b>rimary partition.
</p>
<ul><li> Press Enter to proceed.
</li></ul>
<a name="Partition_table_recovery"></a><h2> <span class="mw-headline"> Partition table recovery </span></h2>
<p>It's now possible to write the new partition structure.<br />
<b><i>Note:</i></b> The extended partition is automatically set.
TestDisk recognizes this using the different Partition structure.
</p>
<table align="center">
<tr>
<td> <a href="image_menu_write.gif.html" class="image" title="menu write"><img alt="menu write" src="menu_write.gif" width="669" height="338" border="0" /></a>
</td></tr></table>
<ul><li> Confirm at <b><i>Write</i></b> with Enter, y and and Ok.
</li></ul>
<p>Now, all partitions are registered in the partition table.<br />
</p>
<a name="NTFS_Boot_sector_recovery"></a><h2> <span class="mw-headline"> NTFS Boot sector recovery </span></h2>
<p>The boot sector of the first partition named <code>Partition 1</code> is still damaged. It's time to fix it.
The status of the NTFS boot sector is bad and the backup boot sector is valid.
Boot sectors are not identical.
</p>
<table align="center">
<tr>
<td> <a href="image_backup_bs.gif.html" class="image" title="backup bs"><img alt="backup bs" src="backup_bs.gif" width="669" height="338" border="0" /></a>
</td></tr></table>
<ul><li> To copy the backup of the boot sector over the boot sector, select <b><i>Backup BS</i></b>, validate with Enter, use <code>y</code> to confirm and next Ok.
</li></ul>
<p>More Information about repairing your boot sector under <a href="running_testdisk.html" title="Running TestDisk">TestDisk Menu Items </a>.
The following message is displayed:
</p>
<table align="center">
<tr>
<td> <a href="image_after_backup_bs.gif.html" class="image" title="after backup bs"><img alt="after backup bs" src="after_backup_bs.gif" width="669" height="338" border="0" /></a>
</td></tr></table>
<p>The boot sector and its backup are now both ok and identical: the NTFS boot sector has been successfully recovered.
</p>
<ul><li> Press Enter to quit.
</li></ul>
<table align="center">
<tr>
<td> <a href="image_reboot.gif.html" class="image" title="reboot"><img alt="reboot" src="reboot.gif" width="669" height="338" border="0" /></a>
</td></tr></table>
<ul><li> TestDisk displays <b><i>You have to restart your Computer to access your data</i></b> so press <code>Enter</code> a last time and reboot your computer.
</li></ul>
<p>Return to <a href="testdisk.html" title="TestDisk"> TestDisk </a> main page
</p>
<!-- Saved in parser cache with key cg_mw-mw_:pcache:idhash:1927-0!1!0!!en!2!edit=0 and timestamp 20080208184821 -->
<div id="catlinks"><p class='catlinks'><a href="http://www.cgsecurity.org/wiki/Special:Categories" title="Special:Categories">Category</a>: <span dir='ltr'><a href="http://www.cgsecurity.org/wiki/Category:Data_Recovery" title="Category:Data Recovery">Data Recovery</a></span></p></div> <!-- end content -->
<div class="visualClear"></div>
</div>
</div>
</div>
<div id="column-one">
<div class="portlet" id="p-logo">
<a style="background-image: url(logo.png);" href="http://www.cgsecurity.org/" title="Visit the Main Page [z]" accesskey="z"></a>
</div>
<script type="text/javascript"> if (window.isMSIE55) fixalpha(); </script>
<div class='portlet' id='p-Data_Recovery'>
<h5>Data Recovery</h5>
<div class='pBody'>
<ul>
<li id="n-TestDisk"><a href="testdisk.html">TestDisk</a></li>
<li id="n-PhotoRec"><a href="photorec.html">PhotoRec</a></li>
<li id="n-Download"><a href="testdisk_download.html">download</a></li>
</ul>
</div>
</div>
</div><!-- end of the left (by default at least) column -->
<div class="visualClear"></div>
<div id="footer">
<div id="f-copyrightico"><a href="http://www.gnu.org/copyleft/fdl.html"><img src="gnu_fdl.png" alt='GNU Free Documentation License 1.2' /></a></div>
<ul id="f-list">
<li id="lastmod"> This page was last modified 18:48, 8 February 2008.</li>
<li id="copyright">Content is available under <a href="http://www.gnu.org/copyleft/fdl.html" class="external " title="http://www.gnu.org/copyleft/fdl.html" rel="nofollow">GNU Free Documentation License 1.2</a>.</li>
</ul>
</div>
<script type="text/javascript">if (window.runOnloadHook) runOnloadHook();</script>
</div>
</body><!-- Cached 20080208184821 -->
</html>
