How to recover data from a failed drive using TestDisk

Home > Search > How-to
  by

TestDisk is a software program which attempts to find and fix filesystem issues with a faulty drive.

If using Linux, use the apt-get or yum command to install TestDisk.

apt-get install testdisk
yum install testdisk

 

If you have more than one disk, and you are able to boot into windows, you can download test disk from http://www.cgsecurity.org/wiki/TestDisk_Download. If you are unable to boot into Windows, you will need to make a bootable flash drive. 

  1. Download the grml iso from http://grml.org/download/
  2. Click here to create a bootable USB ISO using Universal USB Installer (UUI)

 


Steps to repair a faulty disk in Windows

  1. In the first prompt, highlight Create and press enter.
  2. Highlight the faulty drive and press enter.

Note: If the faulty drive is not listed, boot into BIOS, and ensure the motherboard detects the faulty drive.

  1. The next prompt in TeskDisk lists the partition types. By default, the partition type for the faulty disk will be highlighted. Press enter.
  2. Highlight Analyse and press enter
  3. Typically, the partition 1 will be listed twice. This this screen shot, the FAT16 P (primary) partition is listed twice. This implies a corrupted filesystem. Highlight Quick Search and press enter. This can take hours to complete.

     

  1. After quick search has completed, if message No partition found or selected for recovery is displayed, hightlight Deeper Search and press enter.
  2. After Quick Search or Deeper Search, at least one partition should be listed highlighted green.

      

  1. We want find the partition which has our data, and we want to ensure no data has been lost. Highlight each partition and press p (print). Use the left/right arrow keys to navigate. If your only did a Quick Search, and some of your data is missing, do a Deeper Search. After finding the partition which has the data, press q (quit).
  2. At the begining of each parition, just after the > will be a character. If the drive is not being used to boot an Operating System, press the left/right arrow keys to toggle the partition type to P (Primary).
    • * = Boot Partition
    • P = Primary Partitions
    • L = Logical Partition
    • E = Extended Partition

      

  1. Highlight Write and press enter.
    • Hightlight each partition and press p (print). Review your data to ensure none of your data has been lost. Uses the left/right arrow keys to navigate. If no data is missing, press q (quit).
  2. Typically, Boot Sector will be Bad, and Backup Boot Sector will be OK. We need to remedy this, so that both are OK. Highlight Backup BS and press y (yes).

 


Steps to repair a faulty disk in Linux

  1. Use the lsscsi command to determine where the faulty drive is mounted (/dev/sda in this example)
root@linux ~ # lsscsi
[0:0:0:0]  disk  ATA      ST500LM000-1EJ16  DEMH  /dev/sda
[6:0:0:0]  disk  SanDisk  SandDisk Cruzer   8.02  /dev/sdb
  1. Type testdisk and press enter.
  2. In the first prompt, highlight Create and press enter.
  3. Highlight the faulty drive and press enter.

Note: If the faulty drive is not listed, boot into BIOS, and ensure the motherboard detects the faulty drive.

  1. The next prompt in TeskDisk lists the partition types. By default, the partition type for the faulty disk will be highlighted. Press enter.
  2. Highlight Analyse and press enter
  3. Typically, the partition 1 will be listed twice. This this screen shot, the FAT16 P (primary) partition is listed twice. This implies a corrupted filesystem. Highlight Quick Search and press enter. This can take hours to complete.

     

  1. After quick search has completed, if message No partition found or selected for recovery is displayed, hightlight Deeper Search and press enter.
  2. After Quick Search or Deeper Search, at least one partition should be listed highlighted green.

      

  1. We want find the partition which has our data, and we want to ensure no data has been lost. Highlight each partition and press p (print). Use the left/right arrow keys to navigate. If your only did a Quick Search, and some of your data is missing, do a Deeper Search. After finding the partition which has the data, press q (quit).
  2. At the begining of each parition, just after the > will be a character. If the drive is not being used to boot an Operating System, press the left/right arrow keys to toggle the partition type to P (Primary).
    • * = Boot Partition
    • P = Primary Partitions
    • L = Logical Partition
    • E = Extended Partition

      

  1. Highlight Write and press enter.
    • Hightlight each partition and press p (print). Review your data to ensure none of your data has been lost. Uses the left/right arrow keys to navigate. If no data is missing, press q (quit).
  2. Typically, Boot Sector will be Bad, and Backup Boot Sector will be OK. We need to remedy this, so that both are OK. Highlight Backup BS and press y (yes).

This page has additional information: http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step.



Add a Comment




We will never share your name or email with anyone. Enter your email if you would like to be notified when we respond to your comment.




Please enter in the box below so that we can be sure you are a human.




Comments