Sometimes there are some decisions you make and erase your whole Partition of a Hard Drive. This happens usually when you are installing a new OS in your system. This is a problem that many face during their learning period in IT courses. I similarly have faced this issue about 4-5 times and this things create a great havoc. When google to recover the data I have lost, there are software Packages but you have to pay to use their services. I myself have let the hard disk be in the same state due to my financial problems. I lost so many great pictures of myself :(
So I considered this to be my first topic in my Blog. Anyways, I am new to this so let me know if there are any corrections.
TestDisk is powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software: certain types of viruses or human error (such as accidentally deleting a Partition Table). Partition table recovery using TestDisk is really easy.
I wont explain all the technical details, but if you have accidentally erased your hard drive which contained Sensitive Information and if you want to recover it, TestDisk is the tool for you. Somethings to keep in mind- For Recovery of the Hard Drive, You must not enter any type of data of files in the empty partition. As you know your Computer never deletes your data, it will simply overwrite it on the deleted files. Enough Introduction, we wil get to Installation process. It is available by default in 90% of Linux Distros out there but if it isnt then you can simply install it using apt,dnf, yum etc.. according to the Linux Distro. It is also available on Windows and Mac but I personally have never used it. After Installing it, check your version using
Version
testdisk –version
Start the Application
sudo testdisk
Enter your Password.
Your Window Should probably look like This
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
TestDisk is free data recovery software designed to help recover lost
partitions and/or make non-booting disks bootable again when these symptoms
are caused by faulty software, certain types of viruses or human error.
It can also be used to repair some filesystem errors.
Information gathered during TestDisk use can be recorded for later
review. If you choose to create the text file, testdisk.log , it
will contain TestDisk options, technical information and various
outputs; including any folder/file names TestDisk was used to find and
list onscreen.
Use arrow keys to select, then press Enter key:
>[ Create ] Create a new log file
[ Append ] Append information to log file
[ No Log ] Don't record anything
Its upto you if you want to create a log file or not. I would recommend you creating log files because if you run into an error you can always use this log files to get to the root of the problem.
Select the respective option and then the following screen shows up listing all the Hard Drives connected to your PC. In my case it is Internal Seagate 500 GB and 3999 MB PD
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
TestDisk is free software, and
comes with ABSOLUTELY NO WARRANTY.
Select a media (use Arrow keys, then press Enter):
>Disk /dev/sda - 500 GB / 465 GiB - APPLE HDD HTS545050A7E362
Disk /dev/sdb - 3999 MB / 3814 MiB
>[Proceed ] [ Quit ]
Note: Disk capacity must be correctly detected for a successful recovery.
If a disk listed above has an incorrect size, check HD jumper settings and BIOS
detection, and install the latest OS patches and disk drivers.
Select the hard drive whose files you want to recover and press Enter.
Now the Partition List shows up. Dont get overwhelmed, if it is a normal HDD, select Intel Partition.
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
Disk /dev/sdb - 3999 MB / 3814 MiB
Please select the partition table type, press Enter when done.
>[Intel ] Intel/PC partition
[EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
[Humax ] Humax partition table
[Mac ] Apple partition map (legacy)
[None ] Non partitioned media
[Sun ] Sun Solaris partition
[XBox ] XBox partition
[Return ] Return to disk selection
Hint: Intel partition table type has been detected.
Note: Do NOT select 'None' for media with only a single partition. It's very
rare for a disk to be 'Non-partitioned'.
Now comes the tricky part.
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
Disk /dev/sdb - 3999 MB / 3814 MiB
CHS 1016 124 62 - sector size=512
>[ Analyse ] Analyse current partition structure and search for lost partitions
[ Advanced ] Filesystem Utils
[ Geometry ] Change disk geometry
[ Options ] Modify options
[ MBR Code ] Write TestDisk MBR code to first sector
[ Delete ] Delete all data in the partition table
[ Quit ] Return to disk selection
Note: Correct disk geometry is required for a successful recovery. 'Analyse'
process may give some warnings if it thinks the logical geometry is mismatched.
Select Analyse
It will analyse all the partitions in the given Drive. If you have formatted your Drive, all the previous formatted partitions should be visible here.
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
Disk /dev/sdb - 3999 MB / 3814 MiB - CHS 1016 124 62
Current partition structure:
Partition Start End Size in sectors
Warning: number of heads/cylinder mismatches 255 (FAT) != 124 (HD)
Warning: number of sectors per track mismatches 63 (FAT) != 62 (HD)
1 * FAT32 LBA 0 33 3 1016 1 2 7809024 [UBUNTU 20_0]
Warning: Bad ending sector (CHS and LBA don't match)
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
>[Quick Search] [ Backup ]
Try to locate partition
There may be a bunch of warnings. I have ignored them until now. Here we will see the information of the disk and two options.
- Quick Search
- Backup
Select Quick Search
We will see the partitions of the Disk in this window.
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
Disk /dev/sdb - 3999 MB / 3814 MiB - CHS 1016 124 62
Partition Start End Size in sectors
>* FAT32 0 33 3 1016 1 2 7809024 [EFI System Partition] [UB
UNTU 20_0]
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
FAT32, blocksize=4096, 3998 MB / 3813 MiB
Here We can Change the partitions characteristics such as primary, logical etc.
You can See the Keys. We select her “P” to list all the files in the partitions.
We now see all the files here in the Partition. Normal files are in white text. We see Deleted files in Red Color.
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
* FAT32 0 33 3 1016 1 2 7809024 [EFI System Partition] [
Directory /
>drwxr-xr-x 0 0 0 9-Jun-2021 05:24 System Volume Information
-r-xr-xr-x 0 0 69145 9-Jun-2021 05:24 LDLINUX.SYS
drwxr-xr-x 0 0 0 9-Jun-2021 05:24 .disk
drwxr-xr-x 0 0 0 9-Jun-2021 05:24 BOOT
drwxr-xr-x 0 0 0 9-Jun-2021 05:24 CASPER
drwxr-xr-x 0 0 0 9-Jun-2021 05:34 DISTS
drwxr-xr-x 0 0 0 9-Jun-2021 05:34 EFI
drwxr-xr-x 0 0 0 9-Jun-2021 05:34 INSTALL
drwxr-xr-x 0 0 0 9-Jun-2021 05:34 ISOLINUX
-rwxr-xr-x 0 0 49053 9-Jun-2021 05:38 MD5SUM.TXT
drwxr-xr-x 0 0 0 9-Jun-2021 05:34 POOL
drwxr-xr-x 0 0 0 9-Jun-2021 05:38 PRESEED
-rwxr-xr-x 0 0 94 9-Jun-2021 05:38 _YSLINUX.CFG
-rwxr-xr-x 0 0 240 9-Jun-2021 05:38 AUTORUN.INF
-rwxr-xr-x 0 0 34494 9-Jun-2021 05:38 AUTORUN.ICO
Use Right to change directory, h to hide deleted files
q to quit, : to select the current file, a to select all files
C to copy the selected files, c to copy the current file
Now be careful, We now select all the files which we want to recover.
We can select files individually by pressing “:” while navigating the files, or we can just select all the files in the partition by pressing “a”.
After Selection Press “C” to copy the selected files and then the home directory will open. Select the folder of your choice where you want to store the backup. And Press “C” to paste the file. A Notification will show if the operation was successful or not in the terminal Press “q” multiple times to exit testdisk
Congratulations on Recovering your files.
This is my first article I have published on the internet. If you find any mistakes or if you want to give any suggestions, please contact me through any of my social links below.