Computer

S Test Disk

1. Opportunities

This example recovery with TestDisk will help you step by step to restore partitions and bad sectors. After reading this guide, you will be able to recover your data.

We have a 36 GB hard drive containing 3 partitions. Unfortunately:

the boot sector of the primary NTFS partition has been corrupted, and
the NTFS logical partition was accidentally deleted.

This management will help you, using TestDisk, step by step, to recover these "lost" partitions, which could be caused by:

overwriting damaged NTFS boot sectors;
recovering accidentally deleted NTFS logical partitions.

Restoring a FAT32 partition (instead of an NTFS partition) can be achieved by following exactly the same steps. Other recovery examples are also available. For information about FAT12, FAT16, ext2/ext3, HFS+, ReiserFS and other partition types.

One of the conditions:
TestDisk must be run with administrator privileges.

Important points for using TestDisk:
To navigate in TestDisk, use the arrow keys and the PageUp/PageDown keys.

To continue, confirm your choice.

To return to the previous screen or exit TestDisk, use Q (quit).

To save changes to TestDisk, you must commit them. at(Yes) and/or enter the keys, and

To actually write the data partition to the MBR, you must select the "Create" selection and press the Enter key.

signs

If the primary partition of a given hard drive contained an operating system, it will most likely no longer boot - due to boot sector corruption. If the hard drive was a secondary one or you can plug the drive into another computer (usually where the CD/DVD drive is) , the following symptoms would be observed:

Windows Explorer or Disk Manager displays the first primary partition as raw materials(unformatted) and Windows prompts: the disk is not formatted, do you want to format it now?
[You should never do without knowing why!]
The logical partition is missing. In Windows Explorer, that logical drive is no longer available. The Windows Disk Management Console now only shows the "unallocated space" where this logical partition was located.

Running the executable TestDisk

If TestDisk is not already installed, then it can be downloaded from TestDisk Download. Extract the files from the archive, including subdirectories.

To recover lost partitions or repair a file system from a hard drive, USB key, smart card, etc., you need to have access to the physical device.

To restore a partition from a media image or repair a file system image, run

TestDisk image.dd create disk image
TestDisk image.E01 recover files from EWF image Encase
Image.???"TestDisk" if the Encase image is split into multiple files.

To restore a file system not listed by TestDisk, start the TestDisk device, i.e.

TestDisk /dev/mapper/truecrypt0 or TestDisk /dev/loop0 to repair NTFS or FAT32 sector boot files from TrueCrypt partitions. The same method of working with the file system encrypted with cryptsetup / dm-crypt / luks.
TestDisk /dev/md0 to restore the file system on top of a Linux RAID device.

Creation input

Select Create to instruct TestDisk to create a log file containing technical information and messages. If you have no reason to add data to the log or you are running read-only media from TestDisk, then you can create the log elsewhere.
Select No if you don't want to receive messages and details about the process, which will be written to the log file (useful if for example TestDisk started from reading a single location).

Disc selection

All hard drives should be detected and listed with size by TestDisk:

Select the partition table type - usually the default is correct, as TestDisk automatically detects the partition table type.

Press the Enter key to continue.

The current state of the partition table

The first partition is listed twice, which indicates a corrupted partition or an invalid partition table entry.
Invalid NTFS boot points to a bad NTFS boot sector, so it's a corrupted file system.
Only one logical partition (partition label 2) can be purchased as an extended partition. One logical partition is missing.

Confirm on quick search , to continue.

Quick search for sections

During quick search , TestDisk found two partitions, including the missing logical partition marked Section 3 .

When all sections are available and the data is correct in the list, you have to go to the menu Create to keep the partition structure. The Extd Part menu gives you the option to decide if the extended partition will use all free disk space or only the required (minimum) space.

Since the first section is still missing , highlight menu deep search (if not done automatically already) and press Enter to continue.

Section still missing: deep search

Deep Search will also look for FAT32 boot sector backup, NTFS boot superblock backup, ext2/ext3 superblock backup to detect multiple partitions,

After a deep search, the results are displayed as follows:
First section "section 1" was found using a boot sector backup. On the last line of the screen, you can read the message "NTFS found using backup sector!" and the size of your partition. "Section 2" is displayed twice with different size.
Both sections are listed with status D for removed because they overlap.

Press Q for Exit to return to the previous screen.

Let this partition be Partition 2 with a corrupted file system marked as D (deleted).

Highlight the second section section 2 below

Press the P button to the list of your files.