How to: Recover data with testdisk!

[Higgo]

Go easy on me. This is my first how to. I have been up for 36 hours trying various methods to recover my lost data! Given that i'm not the most confident Linux user and I managed to succeed. I though it was necessary to share my experience.

I was making the transition from windows xp to Ubuntu Edgy. Somewhere along the line I hurt my NTFS data partition. I have all my music, videos, thunderbird profile, everything on this one drive! I was unable to mount it or use ntfsfix or even chkdsk from the recovery console off the windows xp install CD. I was not paying the best of attention when I broke it but I believe I accidentally installed grub to /dev/hda instead of /dev/sda! Maybe?

After trying ddrescue and failing. I came across TestDisk (http://www.cgsecurity.org/wiki/TestDisk).
I decided to give it a go:
sudo apt-get testdisk
Don't ask me which repo it is on. It wasn't working very well. It kept exiting.

The version on the repositories is not the current version. However there was a rpm on the main website. I thought I would try alien out for the first time.

Steps:

sudo apt-get install alien

wget http://www.cgsecurity.org/testdisk-6.6-1.i386.rpm

sudo alien testdisk-6.6-1.i386.rpm

sudo dpkg -i testdisk_6.6-2_i386.deb


Ok we have TestDisk and PhotoRec installed.

Change to the folder of where you want to recover your files to.

cd /media/data/recover

sudo testdisk

The following steps may not replicate your needs. There are some examples of how to use TestDisk here (http://www.cgsecurity.org/wiki/Data_Recovery_Examples)

Choose create log file

Select which device to use for me it was /dev/hda

Select INTEL/PC Partition

Choose 'Analyze' then 'Proceed' then select 'Search'. TestDisk should now scan your device for partitions (If it hasn't already discovered them). This may take a little while. About 5 minutes on my 80 GB hard drive.

TestDisk should now list a series of partitions. I think it is listing past partitions on my drive. I'm not to sure. There are are a couple of NTFS and EXT partitions displayed. I'm guessing from past installations. Select your partition and choose 'List'. From here you can get a folder listing. Pressing 'C' to copy that folder and it's child objects in to your recovery folder.

Browse to your recovery folder!


Tips:

DMA enabled on your drive? Does your drive support it?

sudo hdparm -d /dev/hda


Turn it on

sudo hdparm -d1 /dev/hda


I can finally go to sleep now knowing I have my important data back. This has been a 36 hour ordeal and taught me a lot about Linux. I believe Christophe Grenie is the author of this great utility. I am in debt to him. Thank you.

I also believe this program can fix corrupt filesystems and be used to recover data from recently formatted drives. There are probably better how to's and easier way to recover your data, but this is all I know for now. Don't ask me what PhotoRec does! The project website has great documentation.

I guess I should also start backing up my data...


Higgo

[ceeg]

I am totally in debt to you for discovering TestDisk and posting this guide. I resized my windows partition without backing anything up and had thought I lost the rails application i've been developing for the last two weeks :(

What a scare.

[kpkeerthi]

Nice one. Thanks.

[BarNone49]

Very nice. Works perfect. I recovered entirely wiped NTFS OS partitions using this, and it worked like a charm.

[slick1a]

The above seems to be what im looking for .

my thread (to save copy and paste the same thing) http://ubuntuforums.org/showthread.php?p=4514259#post4514259

I got as far as
Code:

sudo apt-get install alien <here no probs ldconfig deferred processing now taking place


Code:

wget http://www.cgsecurity.org/testdisk-6.6-1.i386.rpm < for this :

wget http://wwwcgsecurity.org/testdisk-6.6.1.i386.rpm
--17:01:39-- http://wwwcgsecurity.org/testdisk-6.6.1.i386.rpm
=> `testdisk-6.6.1.i386.rpm'
Resolving wwwcgsecurity.org... failed: Name or service not known.

Code:

sudo alien testdisk-6.6-1.i386.rpm <for this :

wget http://wwwcgsecurity.org/testdisk-6.6.1.i386.rpm
--17:01:39-- http://wwwcgsecurity.org/testdisk-6.6.1.i386.rpm
=> `testdisk-6.6.1.i386.rpm'
Resolving wwwcgsecurity.org... failed: Name or service not known.

Code:

sudo dpkg -i testdisk_6.6-2_i386.deb <and for this :

wget http://wwwcgsecurity.org/testdisk-6.6.1.i386.rpm
--17:01:39-- http://wwwcgsecurity.org/testdisk-6.6.1.i386.rpm
=> `testdisk-6.6.1.i386.rpm'
Resolving wwwcgsecurity.org... failed: Name or service not known.

By taking a quick glance @ my above thread link you will see the dilema im having.

1. what am i doing incorrectly ?

2. I have the tools i need but cannot locate them to use

3. Can anyone help ????

[DigitalRedneck]

It seems you forgot the period after the www

Also, the file is not available anymore. Only v6.9 seems to be available on the site now, and it doesn't want to convert with alien.

[aysiu]

This tutorial's a bit old. You don't need to use an .rpm to install testdisk.

There's a native (.deb) Ubuntu package for it:
http://packages.ubuntu.com/gutsy/testdisk

[slick1a]

The following is intended for research purposes only , I take no resposibility if you do not read this post in full before trying anything.

If TestDisk is not yet installed, it can be downloaded from TestDisk Download. Extract the files from the archive including the sub-directories.

One condition:

* TestDisk must be executed with "Administrator privileges."

Important points for using TestDisk:

* To navigate in TestDisk, use the Arrow and PageUp/PageDown keys.
* To proceed, confirm your choice(s) with the Enter key.
* To return to a previous display or quit TestDisk, use the q (Quit) key.
* To save modifications under TestDisk, you must confirm them with the y (Yes) and/or Enter keys, and
* To actually write partition data to the MBR, you must choose the "Write" selection and press the Enter key.

Code sudo testdisk-6.9/linux/testdisk_static

Here's how i did it;

1. opened terminal typed 'pho' and hit the autocomplete button (tab) why didnt i just think of this in the first place ?? dur !!

2. Enlarged terminal window as 'Photorec' needs 25 lines to work

3. Of options : Disk /dev/hdc - 2048 B (R0) selected Disk /dev/sdf - 320 GB / 298 GiB (R0)

4. Hit proceed - N/B of note: Some disks won't appear unless your a root user. Disk capacity must be correctly detected for a successful recovery. if a disk listed above has an incorrect size, check jumper settings, BIOS detection, and install the latest OS patches and disk drivers.

5. now select the partion table type, pushing enter when done :
[intel] Intel/PC Partition < my choice > usually the default value is the correct one as TestDisk auto-detects the partition table type
[Mac] Apple partition map
[None] non partitioned media
[Sun] Sun solaris partition
[Xbox] Xbox partition
[return] return to disk selection

6. checked file options photorec searches for, as i'm specifically searching for .jpegs

7. To recover lost files, Photorec needs to know the filesystem type were the files are stored:

[ EXT2/EXT3] EXT2/EXT3 filesystem
[ Other] FAT/NTFS/HFS+/ReiserFS/. . . < my choice

8. then i got fumbled so i looked up

9. http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

10. After following the above link , I located missing .jpegs . I recommend this tool for anyone who has accidently deleted a hard drive or has missing files which YOU KNOW are there somewhere.

[bryncoles]

hello! sorry to jump on an aging thread, but i was very impressed with this software when i first found it. it detected external drives when i plugged them in and recovered files fine. then i ran it as 'root', using the 'sudo' command. i was curious to see if it would work on the internal drives you see!

now, it wont do anything at all unless i run as root - wont recover files from digital camera's etc. this is rather perplexing! have i changed the file permissions on it or something? how can i change it again to its initial state - where it could detect and read external drives without being root?

[pac-man]

I was wondering if this application works for this:

I was using ubuntu to transfer some files from my NTFS partition to the external drive (NTFS too). suddenly the system locked up and I had to reboot the computer using the power button. WHen I was back data was lost!

Can this application recover specific folders and files or only whole partitions?

[az]

I was wondering if this application works for this:

I was using ubuntu to transfer some files from my NTFS partition to the external drive (NTFS too). suddenly the system locked up and I had to reboot the computer using the power button. WHen I was back data was lost!

Can this application recover specific folders and files or only whole partitions?

Testdisk can recover partitions. The testdisk package also installs photorec which is a file-carving program. File-carving can find lost files.

What data was lost and where was it (on your machine's disk or the external disk?)

There are other ways to restore lost files by using what's left of the filesystem.

See
http://help.ubuntu.com/community/DataRecovery
and
http://ubuntu-rescue-remix.org

[quixote]

testdisk is a real find! Thank you, thank you, thank you! (I'd mark the official "Thanks" button, only it's not there for some reason.)

I managed to make an 8GB PCMCIA completely inaccessible by being careless and confused in Virtualbox - WinXP. Needless to say, I had files on it that I really wanted. I searched the forums, found this thread, installed testdisk, ran it, and was back in business. The partition table had lost its end-of-file. Testdisk wrote it back in, and everything was accessible again.

Why isn't that great program part of the OS? Why doesn't it live right under "system tools"?

Thanks for the tip. You saved me several days of maddening file recovery!

[chicken65]

hey, i need some help...

im a complete newbie to this knoppix shiz nizzle,

basically i went into test disk, it did its thaaang,

i eventaully found my drive and the files, and copied the entire DOCUMENTS directory (btw i had vista) - i booted knoppix from a cd i burned since my HD isnt working...

anyway i pushed c to copy, so where did that copy to? i just want my documents and then i say bye to this laptop!

plze someone help

thanks

[fluxerj]

TestDisk is a data recovery designed to help recover lost partitions
and/or make non-booting disks bootable again when these symptoms
are caused by faulty software, certain types of viruses or human error.
It can also be used to repair some filesystem errors.

Information gathered during TestDisk use can be recorded for later
review. If you choose to create the text file, testdisk.log , it
will contain TestDisk options, technical information and various
outputs; including any folder/file names TestDisk was used to find and
list onscreen.

[quixote]

chicken65: one way to figure out where knoppix puts things might be to try the same process on a different machine that still works.

1) boot from the liveCD
2) tell it you want to copy a (small!) directory (=folder)

>>> pay really close attention to anything on the screen. Is it telling you that it will copy to, say, "/dev/sda1" unless you specify a different destination? That gobbledygook is linux's way of referring to specific drive. The "/dev/sda" part refers to the physical object, say a 320GB drive. "/dev/sda1" refers to the first "partition" on that object, i.e. a formatted portion that windows might refer to as drive c: for instance. The next formatted partition would be /dev/sda2, and Windows might call that d:, and so on.

Very often, size is the only way to figure out what equals what. For instance, you know you have drives c: e: and f:, of 8GB, 20GB, and 200GB respectively. F: let's say is a USB hard drive to which you want to copy. Linux calls them, for instance, /dev/hda1, /dev/hda2, /dev/sda1, but by the sizes you can guess which is which. You might want to copy from, eg /dev/hda1 (drive c: ) to /dev/sda1 (drive f: ).

Anyway, back to the process:
3. Try to copy the files as you did before, and see where it puts them.
4. Go back to the bad laptop and try to copy the files to where you actually want them.

Hope it works! Come back and tell us how it goes.

[quixote]

(Just parenthetically: this hasn't got anything to do with testdisk, as such. It has to do with how to use a Knoppix LiveCD to recover your data. If you search the forums using those terms, somebody has probably answered the question already, in much better detail than I can give.)

[grs]

When I tried running it I got a "segmentation error" and the PC froze, what does that mean? How can I get past it.

[quixote]

I believe (this is way beyond my level of expertise) that "segmentation errors" happen when the system is having trouble allocating memory. That always leads to a system crash, but why it occurs can vary. Maybe it could just be two pieces of software that didn't work well together, in which case a reboot is all you need. Or I think it can also indicate deeper problems. Why specifically testdisk might do that in your case, I don't know. It may be a symptom of the same problem that led to you trying to use testdisk? :-)

[Dreamglider]

I Like this alot :) i messed um my disk but am able to access it with testdisk.

i had a 80Gb disk with 3 partitions.
NTFS from beginning to 60Gb
EXT3 from 60 to 75Gb
and a swap at the end.
i did a dd if=/source of=/destination
Being a noob and confused i did it the wrong way around and when i finaly figured it out dd had coppied some 40Gb.
Now i know the ubuntu partition is there and safe and i also know that test disk cant see the ntfs partition as parts (some 40Gb) were written with 0'es is there a way to see the remaining 20 gb of the ntfs partition ?

[noesiseon]

I'm hoping someone with more testdisk experience than I have can help me out.

Due to an unfortunate series of events, my MBR and partition tables have been wiped out on a 160gb system drive with 3 NTFS partitions. I am almost positive that no data has been lost, and I'd really rather not reformat. Testdisk is able to see the partitions and all of their files just fine, but only if I search using "None" for partition type.

The problem is that when using "None", I am unable to create or write a new partition table. Can someone please point me in the right direction for rebuilding the tables within testdisk, or at least using the info it generates?

Thanks.

[noesiseon]

Ok, I figured out how to do it after a lot of testing. For anyone else who is interested, here's what I did:

1. Make sure that testdisk is creating a log file as it goes.
2. Use the "Analyse" feature on your "None" partitioned disk.
3. After it finds the partitions, open up your log file.

In my case, the reason the NTFS partitions were not reading in the "PC" partition section was that the wrong Head and Sector #s were being used. The proper #s are listed in the log file. It looked something like

D 35 heads/cyl(NTFS) 24 sectors/track : hdd 255 heads/cyl 64 sectors/track
So, in my case the partitions were use 35 heads and 24 sectors instead of the default 255/64.

4. After you've figured out the proper number of heads and sectors for your partition(s), fire up testdisk again, but this time select "PC" for partition type.
5. Go into "Options" and then "Geometry".
6. Now change the cylinders and heads to the proper #s.
7. Run "Analyse" and the partitions should show up and be writable to the partition table.

Hope that helps someone.

[kiprit]

I am trying to use testdisk but when i select advanced options the options that come are:
Type Superblock Image Creation and Quit
I do not have undelete option. Do you know what may be causing this?

If I am to use photorec can I filter the files it will search with the location of the folder to look for or with the file name?

[mal_conductor]

These are my notes on testdisk and photorec.

with a solution for recovering specific files and seeing what was the old file names:

http://www.mediafire.com/?sharekey=5b659bde0dba72b97f7ec40ada4772a6e04e75f6 e8ebb871

[DarkReo]

Thing have happened after i accidently delete the partition of my external hard drive and i want to get back all my data on it. I'm a complete newbie.... what should i do?

I have done until the Rebuild part, but after that what should i do? Do I have to format the drive?:confused:

EDIT: luckily i didn't format it!!! after the rebuild instead of format i do the following again.

What I have done the 2nd time is
1st: choose "Create" option
2nd:select my external and choose "proceed"
3rd: Intel
4th: Analyze
5th: Quick search
6th: and this come out http://i118.photobucket.com/albums/o81/NgRoMeo/changes.jpg
I choose "continue" without changing anything
7th: Deeper search
8th: the same thing on step 6th come out i choose continue again
9th: Write

Lastly I want to say thank you for everyone's sharing the experience and thx for testdisk's helps!!

[mal_conductor]

Thing have happened after i accidently delete the partition of my external hard drive and i want to get back all my data on it. I'm a complete newbie.... what should i do?

I have done until the Rebuild part, but after that what should i do? Do I have to format the drive?:confused:

EDIT: luckily i didn't format it!!! after the rebuild instead of format i do the following again.

What I have done the 2nd time is
1st: choose "Create" option
2nd:select my external and choose "proceed"
3rd: Intel
4th: Analyze
5th: Quick search
6th: and this come out http://i118.photobucket.com/albums/o81/NgRoMeo/changes.jpg
I choose "continue" without changing anything
7th: Deeper search
8th: the same thing on step 6th come out i choose continue again
9th: Write

Lastly I want to say thank you for everyone's sharing the experience and thx for testdisk's helps!!

DARKREO,

Did the manual help you?

Did you find errors in the steps?
If there are errors I want to know so I can edit the manual.
I deleted my partition by accident, and the I recovered it using testdisk. I wrote the manual after I recoverd the partition. I had to recreate the problem and may not have been the same as my original problem; so the steps may have been different.

Thank you.

[Hobbsilla]

How would you go about doing this if you wanted to recover data from an external harddrive. Would you create the folder to where you want to restore you files in the external hard drive or you computer's internal harddrive? I accidentally formated my external harddrive and don't have enough space on my laptop to restore all of the files onto. Hope someone can help me.

[quixote]

Hobbsilla: you want to recover files off the formatted external HD? I don't think you can do that with testdisk. (Not sure.) I think then your only option is direct disk reads, and going through the results cluster by cluster, and putting critical files back together by hand. I haven't done that myself. I know one of the commands involved is "dd" so you could search for "dd" "disk recovery" (all together on the search line).

Maybe there are better methods. That one is very tedious and the files have to be life-or-death issues to be worth the bother.

To answer the HD question: best would be a second external HD as large or larger than the one you're trying to recover, assuming you're trying to recover the whole thing.

[aysiu]

How would you go about doing this if you wanted to recover data from an external harddrive. Would you create the folder to where you want to restore you files in the external hard drive or you computer's internal harddrive? I accidentally formated my external harddrive and don't have enough space on my laptop to restore all of the files onto. Hope someone can help me. You would create a folder on your internal hard drive and use sudo photorec to recover the deleted files off your external hard drive. You would need enough space to restore all the files onto, though, so either get a bigger internal hard drive or don't restore all the files.

More details here:
http://www.psychocats.net/ubuntucat/recoverdeletedfiles

And, yes, it can be done even if the drive is reformatted. I've done it many times before.

[Hobbsilla]

According to Evergreen's Linux Techcons, Testdisk should be able to recover all/almost all of my files without the need of getting a new harddrive to transfer them over to. I'm about to test it out.