TestDisk Documentation - CGSecurity - Data recovery ...

1 TestDisk DocumentationRelease GRENIEROct 01, 2019 Contents1 - Partition recovery .. - Filesystem repair .. - File recovery .. - File recovery .. - File recovery ..42 : Installation of distribution package .. binaries ..63 Building from environment .. Compilation environment ..84 Creating a live .. (command line) .. (GNOME) .. X .. from the USB stick ..125 Storage: can I repair it or recover data from it ?156 Starting the image .. TestDisk , PhotoRec or QPhotoRec under Windows .. TestDisk , PhotoRec under Linux .. QPhotoRec under Linux X11 .. QPhotoRec under Linux Wayland .. TestDisk , PhotoRec under macOS .. fidentify under Windows .. fidentify under Linux or macOS ..197 Repairing filesystems from Windows.

2 Filesystems from Linux .. filesystems from macOS .. FAT32, exFAT and NTFS boot sector using TestDisk .. : Repairing FAT boot sector .. : Repairing NTFS boot sector .. : repairing ext2/3/4 filesystem superblock .. HFS/HFS+ volume header using TestDisk .. Bitlocker volume ..258 Recovering deleted files using : undelete file for FAT, exFAT, ext2 .. : undelete file for NTFS ..299 Recovering deleted partition using TestDisk .. creation .. selection .. table type selection .. current partition table .. Search for partitions .. for more partitions .. selection ..3210 How to make the system bootable DOS - Window 95/98 .. Windows 2000/XP/2003 .. Windows Vista/Windows 7/.. , Windows Server 2008/.. Linux/FreeBSD.

3 3611 Recovering deleted files using Start photorec .. disk selection .. Source partition selection .. PhotoRec options .. Selection of files to recover .. File system type .. Carve the partition or unallocated space only .. Select where recovered files should be written .. recovery in progress .. recovery is completed .. PhotoRec: file name and date ..4012 Creating custom signature for Signature Syntax .. File location .. Check your custom signature with fidentify .. Run PhotoRec .. Improved file recover ..4313 Recovering lost videos from a memory card using PhotoRec4514 After using Sorting the files by extension .. Renaming files using exiftool .. Removing duplicated files.

4 48ii15 SMART status - disk health monitoring4916 DDRescue: data recovery from damaged ddrescue on Linux .. ddrescue on macOS .. DDRescue: disk to file image .. DDRescue: disk to disk copy .. ddrutility: restricting ddrescue to NTFS allocated data block ..5217 Scripted Automating recovery using TestDisk .. Automating recovery using PhotoRec .. Windows UAC ..6218 TestDisk and PhotoRec in various digital forensics test DFTT: Undelete files from a FAT16 filesystem .. DFTT: Undelete files from a NTFS filesystem .. DFRWS 2006 Forensics Challenge .. Forensics: write blockers ..66iiiivCHAPTER1 PresentationTestDisk & PhotoRec are free and open-source data recovery utilities. TestDisk has been created in 1998 and Pho-toRec in April 2002 by Christophe GRENIER, they can be downloaded from They aredistributed under the GNU General Public License v2 or later, you can run the program as you wish, for any purpose, study how the program works, and change it so it does your computing as you wish (You have access to thesource code.)

5 , redistribute copies so you can help your neighbor, distribute copies of your modified versions to others under the same license. By doing this you can give thewhole community a chance to benefit from your Documentation can be found online at Anyone can con-tribute to TestDisk & PhotoRec Documentation . We especially welcome the contributions of beginners. In fact, begin-ners have a distinct advantage over the experts, because they can more easily spot the places where Documentation islacking. If it s only to fix a spelling or grammar error, your contribution is also welcome!Archives with ready-to-use binaries are available for DOS (32-bit x86) Microsoft Windows (32-bit x86 or 64-bit x64) Linux (32-bit x86 or 64-bit x64) Mac OS X (PowerPC or Intel) / OS X / macOS Marvell 88F628x LinuxTestDisk & PhotoRec can also be compiled for other platforms, notably FreeBSD/OpenBSD/NetBSD, Unix-like computer operating system descended from Berkeley Software Distri-bution (BSD), a Research Unix derivative developed at the University of California, Berkeley.

6 Haiku, a free and open-source operating system compatible with the now discontinued BeOS. SunOS/Solaris, a Unix-branded operating system developed by Sun Microsystems for their workstation andserver computer systems,1 TestDisk Documentation , Release TestDisk - Partition recoveryTestDisk recognizes the following disk partitioning: Apple partition map GUID Partition Table Humax PC/Intel Partition Table (master boot record) Sun Solaris slice Xbox fixed partitioning schemeIt also handles non-partitioned can recover deleted partition rebuild partition table rewrite the Master boot record (MBR) TestDisk does a quick check of the disk s structure and compares it with the partition table for entry errors. Next, itsearches for lost partitions of these file systems: Be File System (BeOS) BSD disklabel (FreeBSD/OpenBSD/NetBSD) Cramfs, Compressed File System DOS/Windows FAT12, FAT16, and FAT32 Windows exFAT HFS, HFS+ and HFSX, Hierarchical File System IBM Journaled File System 2 (JFS2) Linux ext2, ext3 and ext4 Linux RAID RAID 1: mirroring RAID 4: striped array with parity device RAID 5: striped array with distributed parity information RAID 6: striped array with distributed dual redundancy information Linux Swap (versions 1 and 2) LVM and LVM2, Linux Logical Volume Manager Novell Storage Services (NSS) Windows New Technology File System (NTFS) ReiserFS , and 4 Sun Solaris i386 disklabel Unix File System UFS and UFS2 (Sun/BSD/.)

7 XFS, SGI s Journaled File System2 Chapter 1. PresentationTestDisk Documentation , Release TestDisk - Filesystem repairTestDisk can deal with some specific logical filesystem corruption: File Allocation Table, FAT12 and FAT16 Find filesystem parameters to rewrite a valid boot sector Use the two copies of the FAT to rewrite a coherent version File Allocation Table, FAT32 Find filesystem parameters to rewrite a valid boot sector Restore the boot sector using its backup Use the two copies of the FAT to rewrite a coherent version exFAT Restore the boot sector using its backup NTFS (New Technology File System) boot sector and MFT repair Find filesystem parameters to rewrite a valid boot sector Restore the boot sector using its backup Restore the Master File Table (MFT)

8 From its backup Extended file systems, ext2, ext3 and ext4 Find backup superblock location to assist fsck HFS+ Restore the boot sector using its TestDisk - File recoveryWhen a file is deleted, the list of disk clusters occupied by the file is erased, marking those sectors available for use byother files created or modified thereafter. If the file wasn t fragmented and the clusters haven t been reused, TestDiskcan recover the deleted file for various filesystem: FAT NTFS exFAT PhotoRec - File recoveryPhotoRec is a file carver data recovery software tool. It doesn t recover the original filenames but it can recover deletefiles even from corrupted filesystem. PhotoRec recognizes and recovers numerous file formats including ZIP, Office,PDF, HTML, JPEG and various graphics file formats.

9 The whole list of file formats recovered by PhotoRec containsmore than 480 file extensions (about 300 file families). It s possible to create custom signature to recover file formatunknown to TestDisk - Filesystem repair3 TestDisk Documentation , Release QPhotoRec - File recoveryQPhotoRec is a file carver data recovery software tool with a graphical user interface. Like PhotoRec, it doesn trecover the original filenames but it can recover delete files even from corrupted 1. Linux: Installation of distribution CentOSAs root,yum install TestDisk FedoraAs root,dnf install TestDisk Fedora CoprCopr is an automatic build system. It provide the latest development version. As root,dnf copr enable grenier/testdiskdnf install TestDisk Debian / UbuntuAs root,apt install testdisk5 TestDisk Documentation , Release Official Official binaries: stable or WIP ?

10 Using the development version (WIP=Work In Progress) is usually recommended as fixes are not backported. TheWIP archive may be modified several times per week but keep the same name. If this version doesn t start, you canalways use the stable version and warn the developer of the problem with the beta Installation of official binaries for Windows Download the archive (32-bit x86 or 64-bit x64) from Extract all the files including the Installation of official binaries for Mac OS X Download the archive from Mac OS X Intel / OS X / macOS Mac OS X PowerPC for very old Mac (Mac OS X <= ) Extract all the files including the Installation of official binaries for LinuxDownload the archive from Currently we have for the last stable version for the development versionThe archives contains static binaries for Intel (x86_64 or i686) platforms.