World Library  
Flag as Inappropriate
Email this Article
 

TestDisk

TestDisk
Developer(s) Christophe Grenier
Stable release 7.0 / April 18, 2015 (2015-04-18)
Development status Active
Written in C
Platform Cross-platform
Type Data recovery
License GPL (free software)
Website www.cgsecurity.org/articles/TestDisk

TestDisk is a free and open-source data recovery utility. It is primarily designed to help recover lost data storage partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally erasing a partition table). TestDisk can be used to collect detailed information about a corrupted drive, which can then be sent to a technician for further analysis.

Contents

  • Supported operating systems 1
  • Supported partition table type 2
  • Partition recovery 3
  • Filesystem repair 4
  • File recovery 5
  • Popularity 6
  • See also 7
  • References 8
  • External links 9

Supported operating systems

TestDisk supports these operating systems:

Supported partition table type

TestDisk recognizes the following disk partitioning:

It also handles non-partitioned media.

Partition recovery

TestDisk queries the BIOS or the operating system in order to find the data storage devices (hard disks, memory cards, …) and their characteristics (LBA size and CHS geometry). TestDisk can[1]

TestDisk does a quick check of the disk's structure and compares it with the partition table for entry errors. Next, it searches for lost partitions[2][3] of these file systems:

However, it is up to the user to look over the list of possible partitions found by TestDisk and to select those that were being used just before the drive failed to boot or the partition(s) were lost. In some cases, especially after initiating a detailed search for lost partitions, TestDisk may show remnants of partitions that had been deleted and overwritten long ago.

A step-by-step guide[4] explains how to use this software. TestDisk can be used in computer forensics procedure,[5] it supports the EWF file format used by EnCase.

Filesystem repair

TestDisk can deal with some specific logical filesystem corruption:[6]

  • File Allocation Table, FAT[7]
    • FAT12 and FAT16
      • Find filesystem parameters to rewrite a valid boot sector
      • Use the two copies of the FAT to rewrite a coherent version
    • FAT32
      • Find filesystem parameters to rewrite a valid boot sector
      • Restore the boot sector using its backup
      • Use the two copies of the FAT to rewrite a coherent version
  • exFAT
    • Restore the boot sector using its backup
  • NTFS[8]
    • Find filesystem parameters to rewrite a valid boot sector
    • Restore the boot sector using its backup
    • Restore the Master File Table (MFT) from its backup
  • Extended file systems, ext2, ext3 and ext4
    • Find backup superblock location to assist fsck[9]
  • HFS+
    • Restore the boot sector using its backup

File recovery

When a file is deleted, the list of disk clusters occupied by the file is erased, marking those sectors available for use by other files created or modified thereafter. If the file wasn't fragmented and the clusters haven't been reused, TestDisk can recover the deleted file:

  • FAT file undelete[10]
  • NTFS file undelete[11]
  • exFAT file undelete
  • ext2 file undelete[12]

Popularity

TestDisk and PhotoRec (by the same author) have been downloaded more than 150,000 times in July 2008 from the primary website. In fact these utilities are even more popular as they can be found on various Linux Live CDs:

They are also packaged for numerous Linux distribution

See also

References

  1. ^ Debra Littlejohn Shinder, Michael Cross (2002). Scene of the cybercrime, page 328. Syngress. ISBN 978-1-931836-65-4.
  2. ^ Ido Perelmutter - Debian Administration, Recovering from file system corruption using TestDisk
  3. ^ Ionut Ilascu, Softpedia, Your HDD Is Missing a Slice? Try TestDisk for a change
  4. ^ TestDisk Step by Step
  5. ^ Presentation of TestDisk in The Sleuth Kit Informer
  6. ^ Jack Wiles, Kevin Cardwell, Anthony Reyes (2007). The best damn cybercrime and digital forensics book period, page 373. Syngress. ISBN 978-1-59749-228-7.
  7. ^ Advanced FAT Repair
  8. ^ NTFS boot sector and MFT repair
  9. ^ Locate ext2/ext3/ext4 backup superblock
  10. ^ FAT file undelete
  11. ^ NTFS file undelete
  12. ^ ext2 file undelete
  13. ^ TestDisk on ALT Linux
  14. ^ ArchLinux Extra Repository
  15. ^ TestDisk on Debian
  16. ^ TestDisk in Fedora
  17. ^ """RepoView: "Fedora EPEL 6 - x86_64. Retrieved 27 July 2013. 
  18. ^ TestDisk in FreeBSD ports
  19. ^ TestDisk in Gentoo
  20. ^ TestDisk in Gentoo Portage
  21. ^ [2]
  22. ^ TestDisk in Source Mage
  23. ^ TestDisk in Ubuntu

External links

  • TestDisk Wiki
  • List of news articles about TestDisk and PhotoRec
  • Falko Timme, Data Recovery With TestDisk HowTo
  • Digital Forensics using Linux and Open Source Tools
This article was sourced from Creative Commons Attribution-ShareAlike License; additional terms may apply. World Heritage Encyclopedia content is assembled from numerous content providers, Open Access Publishing, and in compliance with The Fair Access to Science and Technology Research Act (FASTR), Wikimedia Foundation, Inc., Public Library of Science, The Encyclopedia of Life, Open Book Publishers (OBP), PubMed, U.S. National Library of Medicine, National Center for Biotechnology Information, U.S. National Library of Medicine, National Institutes of Health (NIH), U.S. Department of Health & Human Services, and USA.gov, which sources content from all federal, state, local, tribal, and territorial government publication portals (.gov, .mil, .edu). Funding for USA.gov and content contributors is made possible from the U.S. Congress, E-Government Act of 2002.
 
Crowd sourced content that is contributed to World Heritage Encyclopedia is peer reviewed and edited by our editorial staff to ensure quality scholarly research articles.
 
By using this site, you agree to the Terms of Use and Privacy Policy. World Heritage Encyclopedia™ is a registered trademark of the World Public Library Association, a non-profit organization.
 


Copyright © World Library Foundation. All rights reserved. eBooks from Project Gutenberg are sponsored by the World Library Foundation,
a 501c(4) Member's Support Non-Profit Organization, and is NOT affiliated with any governmental agency or department.