Custom Search

Recover files with Testdisk

Testdisk is an advanced tool that gives blazing results with data recovery, even insane and miraculous in some cases.

What testdisk can do

Erased or damaged file systems, as long as no new data have been written over the previous ones, testdisk can analyse the hard drive and give you access to the files as they existed before.

Failed hard drives, testdisk is able to bypass and tolerate damaged sectors of a defect hard drive and let you acess files that can still be recovered.

Deleted files, testdisk can let ou access deleted files on ubuntu file system (ext2, ext3, ext4). It can do the same thing for Windows with a different approach, however it is easier to use recuva for Windows.

From a backup, testdisk can also do the same operations on a file that contains a raw copy of a hard drive. Such files can be created with dd or ddrescue.

Ubuntu for good results

These instructions have been written for Ubuntu since it is the only universal operating system for that type of operation. It is the only one to be able to read and write on any hard drive and file system, even those of Windows and Mac. It is also the only one that you can boot from its bootable CD, on any computer even if the computer doesn't boot anymore because of a defect hard drive. And Ubuntu is very stable when working with hard disk failures.

You can use testdisk on Windows or Mac since a compatible version exist for these systems. However, you will not benefit from these advantages, which are required in most cases.

Prerequisities

Installation, To install testdisk on Ubuntu, you must enable the universe repository and install testdisk package.

Directory tree, You must have an idea about what is a directory tree to know where are the files you are searching for and where you want to recover them. Think also about the trash if the file you want to recover could have been in it before being deleted.

Enough space, You also need to use another external hard drive, a USB stick or any other storage device with sufficient space for the files and folders you want to recover.

Exclusive access to the hard drive, it is always best to boot from the Ubuntu bootable CD or to connect the hard drive you want to analyse on a PC that is already booted on Ubuntu since it prevents softwares that are on that hard drive to start and read/write on it, testdisk cannot reliably analyse a hard drive if its content is changing during the analysis. Neglecting this point may reduce the quality of results and even cause damage to the file system if you modify it with testdisk.

Proceed

  1. Open the Terminal, among the applications in the Ubuntu menu in the top left corner.
  2. Type sudo testdisk to work with a real hard drive or type sudo testdisk /location-of-the-backup-file to work with a raw backup file generated by dd or ddrescue. Press the Enter key on the keyboard. If asked, type your administrator password and press Enter. Testdisk might ask you to enlarge the size of the window.
  3. Unless you want a log file of the operations, choose No Log with the arrow and Enter keys.
  4. Hard drives are shown, it is possible to distinguish them with the size and the model name. Go on the hard drive you want to analyse and press Enter.
  5. You are asked for what is the partition table, for a normal PC it is always Intel. EFI GPT is for recent Apple Macs, Mac is for old PPC Mac, None is for USB stick and camera cards. Choose the right one and press Enter.
  6. Choose Analyse and press Enter.
  7. Testdisk shows the current partitions, press Enter again to do a Quick Search, testdisk looks for damanged or deleted partitions. If absolutely no partition (damaged or not) is found, you can try to recover files with photorec instead.
  8. Choose the partition that contains the files you want to recover and press the letter P. If you can't identify what is the right partition, you can try one. At any time your can come back to this menu by pressing the letter Q (quit).
  9. You are now in the directory tree (files and folders) of the partition! Each line starting with d letter is a folder, each line starting with a hyphen - is a file. Red lines are files that have been deleted. You can move in files and folders with arrow keys on the keyboard, you can open a folder by pressing Enter and you can quit a folder by going on the double dot .. and pressing Enter. The location where you are is always shown at the top near the word Directory. You can recover a file or a folder at any time by pressing C.
  10. The first time you will press C, you will be asked where to copy the files. You have to move up to the destination folder and press Y. For that purpose, you need to know the path of that folder. Once done, testdisk confirms you if the operation succeeded of failed, completely or partially. If you copy a large amount of files, be patient and wait for the transfer even if nothing happens on the screen. If time is really too long, you can press Q to quit testdisk.