TestDisk Data Recovery Utility
![]() |
TestDisk Documentation |
![]() |
Documentation by Christophe Grenier, |
TestDisk, http://www.cgsecurity.org, is OpenSource software and is licensed under the GNU Public License, http://www.gnu.org/licenses/gpl.html.
TestDisk was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally erasing your Partition Table). You can also use TestDisk to help analyze the sectors copied from a hard drive with physical problems onto a good drive.
TestDisk can run under DOS (either real or in a Win9x DOS-box), Linux or FreeBSD (see the section below on Compiling ). But TestDisk will find lost partitions for all of these types:
TestDisk is a true 32-bit program (compiled under DJGPP), so a DPMI server program (cwsdpmi.exe) is included in the download which allows TestDisk to run under 16-bit DOS.
TestDisk queries the BIOS ( DOS/Win9x) or the OS ( Linux, FreeBSD) in order to find the Hard Disks and their characteristics ( LBA size and CHS geometry). TestDisk does a quick check of your disk's structure and compares it with your Partition Table for entry errors. If the Partition Table has entry errors, TestDisk can repair them. If you have missing partitions or a completely empty Partition Table, TestDisk can search for partitions and create a new Table or even a new MBR if necessary.
However, it's up to the user to look over the list of possible partitions found by TestDisk and to select the one(s) which were being used just before the drive failed to boot or the partition(s) were lost. In some cases, especially after initiating a detailed search for lost partitions, TestDisk may show partition data which is simply from the remnants of a partition that had been deleted and overwritten long ago. Because of this possibility, one should always 1) Give each new partition a unique label name, and 2) Whenever you decide to delete all existing partitions on a drive in order to 'start all over again' to 'zero-out' every byte on the disk first. This procedure will remove all remnants of previously existing partitions (manufacturers often include routines to 'zero-out' a drive in a utility program downloads section on their web sites). If one isn't available, or if you're not removing all of the partitions from a drive, you could at least use a 'wipe free space' utility after installing a new OS or resizing a drive's partitions.
TestDisk has features for both novices and experts. For those who know little or nothing about data recovery techniques, the command line parameters /log and /debug can be used to collect detailed information about a non-booting drive which can then be sent to a tech for further analysis. Those more familiar with such procedures should find TestDisk a handy tool in performing onsite recovery.
Warning: If you use TestDisk to recover lost partitions on a target hard drive by connecting the drive to a computer other than the one it was originally partitioned and formatted on, you risk the chance of having incorrect data about the drive passed along to TestDisk from the BIOS of this other computer. BIOS chips have at least two different ways of translating disk geometry, and using the wrong data may make it impossble for TestDisk to correctly recover a drive's lost partitions; or worse, you may write the wrong data to the drive's MBR, boot up the disk and then incorrectly write data to the disk leading to further corruption and loss of data. ( This may not apply to all file systems.)
- run "testdisk /log /debug" (make sure to hit the space bar once before each slash),
- select the faulty hard disk using arrow keys then press the ENTER key,
- after TestDisk is finished (Note: you may need to press the ENTER key a couple more times during its processing), do NOT choose "WRITE",
- just send the file which TestDisk creates, testdisk.log, to grenier@cgsecurity.org
( Note: TestDisk appends new information to testdisk.log; it does not overwrite an existing file.)
When TestDisk is executed, you may see the phrase "Please wait..." on your screen until it has gathered enough data from the BIOS or OS to list the disk drives on the system.
Analyzes a drive's current partition structure making it possible to recover lost partitions.
TestDisk assumes the existence of partitions and scans all relevant drive cylinders for them. A primary partition starts at the beginning of a cylinder (head=0, sector=1), while a logical partition starts a little further along (head=1, sector=1).
For each possible partition starting location, TestDisk can search for the presence of a partition header, which confirms the presence of a known partition type. Thus, the size of a partition is
determined directly from its structure on the disk. Each partition that TestDisk discovers is added to a list of found partitions.
Once the analysis is complete, TestDisk generates a report of found partitions, and gives the user a choice of writing that data to the drive's Partition Table, or of running a more detailed analysis; one in which the option "Paranoid" (see Options below) will be set to search for a partition at every possible location.
Deletes all partition data from the Partition Table only (by filling it with zero bytes). Both the MBR Code and the signature bytes (if any) remain the same.
TestDisk overwrites the code and MBR signature (the hex Word 0xAA55) with a copy of the Standard Master Boot Record (similar to MS-DOS's FDISK with the 'undocumented' /MBR switch).
This might be useful if your system doesn't boot at all, and you've tried everything else!
[ For a fully-commented copy of the Standard (or 'classic') MBR code, see:
An Examination of the Standard MBR (edited copy at CGSecurity.org; France) or: An
Examination of the Standard MBR (original USA site). ]
Change hard disk geometry parameters (Cylinders, Heads, Sectors). For Experts only.
Skip this unless you're familiar with changing disk geometry. These numbers change the way that TestDisk looks for partitions and calculates their sizes, etc. It does not affect the hard drive itself, unless you actually write data about lost partitions to the drive. Choosing the wrong geometry settings and then saving any lost partitions based on those faulty settings might make it impossible to recover your data.
Can be changed by first 'highlighting' the Option and then toggling the ENTER key, or by just toggling the underlined letter in the Option name on the keyboard; whether highlighted or not.
Only for expert use in trying to recover and repair OS Boot sectors!
Source code is included in the TestDisk download (along with a DOS executable and DPMI server program) from
the CGSecurity Website's TestDisk Home page:
http://www.cgsecurity.org/testdisk.html.
You can compile TestDisk under DOS (or Win 9x) with DJGPP (all GNU Public License software). You need to get:
The e2fs library is avaible in a binary format for DJGPP at http://www.cgsecurity.org/e2fs-bin.zip. To have more information about e2fs (e2fsprogs) library support, see this document.
If you want to work under real (16-bit) DOS, you'll need to have a DPMI server running; to do that, get: csdpmi*b.zip and simply place the executable (cwsdpmi.exe) in your bin directory (which must be in the PATH). It's a good idea to get gdb, the GNU Debugger, too. To use .tgz archives, you need to get gzip and tar (from: djgpp/v2gnu/gzip*.zip and tar*.zip). To extract a .tgz archive, run "tar xvzf archive.tgz".
You need to install the ncurses library and development file. Under a Linux RedHat, you need to install ncurses, ncurses-devel and e2fs-devel (rpm -Uvh ncurses-*.rpm ncurses-devel-*.rpm e2fs-devel-*.rpm). Under BSD, see this document if you want to know how to pach the library source.
Go into the TestDisk source directory (cd testdisk/src) and simply run: make dos, make linux or make bsd according to your operating system.
Once you have all the required binaries for DJGPP installed and have correctly set the Environment variables, it's very simple to compile TestDisk using the makefile included with the
source code!
The Makefile is set to compile TestDisk with debug information that can be used by the GNU program GDB. The DOS executable released in the download has been stripped of this
data, using strip testdisk.exe, and has also been packed with the DJP exe packer program by running djp -s testdisk.exe; download it from the same servers as
DJGPP archived as: djgpp/v2misc/mlp*b.zip.
If you want to subscribe to TestDiskDev, send a mail to sympa@nef.esiea.fr with "subscribe testdisk-dev" in the body or in the subject
Our mailing list is about:
- bugtracking and developing TestDisk
- developing new functionality
- porting TestDisk to NT/W2K
- various other data recovery related issues
We're interested in people to team up with who:
- are familiar with programming
- are familiar with data recovery
- are interested in doing tests on computers they can access
- Solaris recovery
- Windows 2000/NT port
- Save/Undo function
- Linux Software RAID SUperblock detection
- a partition copy function
- a disk copy function
- a save/restore MBR function