Test Disk - Partition Recovery

Partition Recovery

TestDisk queries the BIOS or the operating system in order to find the data storage devices (hard disks, memory cards, …) and their characteristics (LBA size and CHS geometry). TestDisk can

• Recover deleted partition
• Rebuild partition table
• Rewrite the Master boot record (MBR)

TestDisk does a quick check of the disk's structure and compares it with the partition table for entry errors. Next, it searches for lost partitions of these file systems:

• Be File System (BeOS)
• BSD disklabel (FreeBSD/OpenBSD/NetBSD)
• Cramfs, Compressed File System
• DOS/Windows FAT12, FAT16, and FAT32
• Windows exFAT
• HFS, HFS+ and HFSX, Hierarchical File System
• JFS, IBM's Journaled File System
• Linux ext2, ext3 and ext4
• Linux RAID
  • RAID 1: mirroring
  • RAID 4: striped array with parity device
  • RAID 5: striped array with distributed parity information
  • RAID 6: striped array with distributed dual redundancy information
• Linux Swap (versions 1 and 2)
• LVM and LVM2, Linux Logical Volume Manager
• Novell Storage Services (NSS)
• NTFS (Windows NT/2000/XP/2003/Vista/2008/7)
• ReiserFS 3.5, 3.6 and 4
• Sun Solaris i386 disklabel
• Unix File System UFS and UFS2 (Sun/BSD/…)
• XFS, SGI’s Journaled File System

However, it's up to the user to look over the list of possible partitions found by TestDisk and to select the one(s) which were being used just before the drive failed to boot or the partition(s) were lost. In some cases, especially after initiating a detailed search for lost partitions, TestDisk may show partition data which is simply from the remnants of a partition that had been deleted and overwritten long ago.

A step by step guide explains how to use this software. TestDisk can be used in Computer forensics procedure, it supports the EWF file format used by EnCase.