Sometimes it happens that you accidentally deleted a partition (partition) on your hard drive, or, say, carelessly formatted the wrong one. HDD. In these cases, it is strongly recommended to turn off the computer as soon as possible so that nothing is written to the hard disk and deleted information is not overwritten.

In order to completely restore the partition after deletion or accidental formatting, the TestDisk program will help us.

TestDisk: instruction

Step 1. Download the disk image with the program or download the Ultimate Boot CD (UBCD), which already includes TestDisk.
(We recommend reading our article on how to create bootable flash drive with UBCD :)

Step 2 Boot from a CD or USB disk containing the TestDisk program.

Step 3 If you booted from UBCD 4.11, then find the utility in the appropriate section: Filesystem Tools -> Partition Tools -> TestDisk v6.6.

Attention! When starting the program, we answer all questions “OK" using the "ENTER" key, or just wait automatic execution default actions:

After a couple of minutes, the program will load.

Step 4 In the TestDisk program, select the hard disk on which you want to find the partition, and click Proceed (continue):

Step 5 Choose a type file system. If the hard drive was used with Windows OS, select Intel:

Step 6 Click Analyze for analysis hard drive:

Step 7 When the program determines the type of file system, press Proceed to start searching for the overwritten partition:

The program looks for deleted partitions (partitions) and shows the progress as a percentage:

If deleted partitions are found, they will be displayed as a list.

(In the picture below we see that in our case the program found two sections - Data1 and Data2 )

Step 8 To restore the desired partition, select it with the Up Arrow and Down Arrow keys and press the Enter key:

(Let's say we were looking for the Data1 partition and we want to restore it so that it becomes visible again in Windows)

Step 9 Now you need to select the Write command with the arrows! and press Enter to run it. With this action, we restore the partition table and the selected partition will again be visible in Windows along with all its contents:

Step 10 We confirm the intention to write the partition table by pressing the Y (yes) key:

The program has restored the partition and informs you about the need to restart! It is done!

Step 11 Exit from the program.

Press Enter to close the message:

... and exit the program with the Quit commands (all commands are still run with the ENTER key):

The program reports successful completion operation of the TestDisk utility. You can press RESET to restart your computer.

Attention! The file system works in such a way that when files or partitions are deleted, only their coordinates on the physical disk are erased, while the data remains, but is replaced with new information as needed. Hence, it follows that the contents of the deleted partition will remain intact only in case that, if after deleting the partition you did not have time to overwrite the hard disk area. For if you delete a partition, and then dump a couple of movies on the same hard drive, then the new data will partially or completely overwrite the area where the deleted partition was previously. Therefore, if you accidentally deleted the partition you need, immediately start restoring it!

This problematic example ( Recovery example ) situation is step by step actions when working with TestDisk, allowing you to restore and fix damaged / th partition / s.

One of the conditions for working in the program is:

The program must be launched with "administrator" privileges/rights.

Important points for using TestDisk:

To go to TestDisk, use the arrow keys Up down And PageUp/PageDown .

To continue, confirm your choice by pressing the key Enter .

To return to the previous display or exit TestDisk, use the key Q (exit ).

To save the changes made while running TestDisk, you must confirm them with the key Y (yes) and/or Enter

To write data to the MBR partition, you need to select "Write" by selecting from the keyboard and press the key Enter .

signs

1. If the primary partition on the hard disk contains an operating system, then most likely it will no longer boot; due to the primary boot sector partition.
2. If the hard disk contains secondary partitions that cannot be accessed or you can connect your disk to a second channel in another computer (usually a CD / DVD drive is connected there), and the following symptoms are observed, the following symptoms would be noted as follows:

Windows Explorer or Disk Manager displays the first primary partition as raw unformatted and Windows shows:
The drive is not formatted, do you want to format it now? [ Your disk is not formatted. Format it now?]
The logical partition is missing. IN Windows Explorer logical drive is not available. In the Disk Management snap-in, it only displays "unallocated space" at the location where this logical partition was located.

Running Test Disk

If TestDisk is not already installed, it can be downloaded from TestDisk Download . Unpack all files from the archive including subfolders.

To recover a lost partition or recover a file hard disk, USB drive, smart cards..., you must have necessary rights to access the device.

To restore a partition from a device image or restore the image's file system, run

testdisk image.dd to split the image
testdisk image.E01 to recover files from the Encase EWF image
testdisk "image.???" if the Encase image is split into multiple files.

To restore a file system that is not shown in TestDisk, run testdisk device , for example

testdisk /dev/mapper/truecrypt0 or testdisk /dev/loop0 to recover NTFS or FAT32 boot sector files from a TrueCrypt partition. The same method works with filesystems encrypted with cryptsetup/dm-crypt/LUKS.
testdisk /dev/md0 to restore the filesystem on a Linux Raid device.

Creating a log

Use the up/down arrow buttons to select the "problem" hard drive.

Whenever possible, choose raw (raw) /dev/rdisk* devices instead of logical /dev/disk* devices to improve data transfer speed.

Partition Table Type Selection

TestDisk displays the Partition Table types.

Select the "Analyse" menu item to check the partition structure of the current disk and search for "lost" partitions.
Press Enter to continue.

Answer the question Should TestDisk search for partition created under Vista? (Search for partitions created under Vista OS?).

Select this section and click p to display the file list (To exit the file list display mode, press q ).

All folders and files are displayed normally. (The utility does not understand the Russian language, so files with Russian names will not be displayed correctly)

Press Enter to continue.

Save partition table or continue searching?

When all desired sections are present and data about them is displayed correctly, you should select the item Write in the menu to keep the partition structure. The Extd Part menu item gives you the ability to decide whether the extended section will use everything available. disk space or only necessary (minimum).
Since the first section is still missing , select menu item Deeper Search (if it was not automatically selected) and press (Enter) to continue.

Section still missing: Deeper Search

Deeper Search also looks for FAT32 boot sector backup, NTFS boot sector superblock backup, ext2/ext3 superblock backup to find more partitions,

After Deeper Search, the results will be displayed as below picture:
First section "Partition 1" was found using backup boot sector. At the bottom of the window you can see the message "NTFS found using backup sector!" and partition size. Second section Partition 2 displayed twice with different sizes.
Both sections are labeled with status D to remove because they overlap.

highlight the first partition 2 and press p to list its data.

The file system of the upper logical partition (label Partition 2) is damaged

(click on thumb).

Let this partition Partition 2 with a damaged file system marked as D(deleted) .
Highlight the second partition Partition 2 below
Press p to list its files.

It works, you have found the correct partition!

Use the left/right arrow to navigate into your folders and watch your files for more verification

Note: FAT directory listing is limited to 10 clusters, some files may not appear but it doesn't affect recovery.

Press q for Quit to go back to the previous display.

The available status are Primary, * bootable, Logical and Deleted.

Using the left/right arrow keys, change the status of the selected partition to L(ogical)

Confirm at Write with Enter, y and and Ok.

Now, all partitions are registered in the partition table.

Restoring the NTFS boot sector

The boot sector of the first partition named Partition 1 is still damaged. It "s time to fix it. The status of the NTFS boot sector is bad and the backup boot sector is valid. Boot sectors are not identical.

To copy the backup of the boot sector over the boot sector, select , validate with Enter, use y to confirm and next Ok.

More Information about repairing your boot sector under TestDisk Menu Items . The following message is displayed:

The boot sector and its backup are now both ok and identical: the NTFS boot sector has been successfully recovered.

Press Enter to quit.

TestDisk displays You have to restart your computer to access your data so press Enter a last time and reboot your computer.

Recovering deleted files

TestDisk can recover

files from NTFS partitions since version 6.11.

If it doesn't work or for other filesystem, try PhotoRec , a signature based file recovery utility.

In this manual, we will tell you how to use the TestDisk utility: restore the boot sector, hard disk partitions. General principles work with this powerful tool.

Introduction to TestDisk

TestDisk is a free cross-platform application that was created with one goal in mind - to help users recover lost partitions or make non-bootable drives bootable and vice versa. We have already written about a similar problem, considering the possibilities Partition programs Table Doctor Recovery, which also performs hard disk partition recovery. Often similar problems arise due to the human factor or from the outside - as a result of damage by viruses. In addition, you can use the TestDisk utility to fix some file system errors.

Of the capabilities of TestDisk, the HDD diagnostic function should be noted. The results of the application can be written to the testdisk.log log, which will contain the set parameters, technical information and other output.

TestDisk 7.0 utility interface for Mac OS X

What to do if the hard drive contains bad sectors

If you want to recover certain important files, and you know exactly where they might be, select a partition from the TestDisk menu, try listing the contents of the file system, and copy your files. If that didn't work and/or the hard drive was badly damaged, the best thing to do would be to clone the HDD for further manipulation in the Test Disk program with the contents of your hard drive's file system.

Where can I find the files that have been restored/copied?

By default, the TestDisk utility copies the recovered data to the current folder. That is, you need to look in the testdisk-6.11.3/win/ folder (in the case of Windows) or in the testdisk-6.12-WIP directory.

If you launched Testdisk in a temporary folder, after unpacking the TestDisk distribution with the archiver, after closing the application, all files will most likely be deleted from this very temporary folder, including the recovered data. Thus, you must unpack all the files from the archive yourself, and strictly before running the TestDisk application.

I can't copy, move, rename files restored to TestDisk!

windows: you need to set the owner of the folder (see http://support.microsoft.com/kb/308421)
mac os x and linux: Change the owner of the directory, to do this, use the command in Testdisk:

sudo chown -R username recup_dir.*

Partition (and file system) recovery

FAT file system:

For DOS: Run scandisk c:
To check a FAT-formatted partition in a Windows environment, run chkdsk /f c:
Run fsck.vfat -a devicename

File NTFS system:

To check an NTFS partition on Windows, run chkdsk /f c:

File ReiserFS system:

If there is no superblock in the reiserfs partition, you can restore it in the Testdisk program like this: – reiserfsck --rebuild-sb your_device.

Boot Sector Recovery

Windows 9x

If your operating system does not start, you can reinstall system files using the sys c: command in the TestDisk application.

Windows 2000/XP/2003

Run the fixmbr utility via the Recovery Console (i.e. fixmbr \Device\HardDisk0)
Check c:boot.ini file
Run fixboot to repair the NTFS boot sector.

Windows Vista/Windows 7/...

Run bootrec.exe /fixmbr from the Recovery Console (see above)
Check c:boot.ini config
Run bootrec.exe /fixboot to restore the NTFS boot sector.

linux

Be sure to update the /etc/fstab file to reflect the order of the sections in the list.

Update multiboot configuration and reinstall boot to MBR (Master Boot Record).

Lilo: config - /etc/lilo.conf, lilo to reinstall
Grub: config - /boot/grub/grub.conf, grub-install device to reinstall the bootloader

In this article, we will show how the TestDisk utility program under Windows works, which is used to find and restore deleted partitions on a disk. For test purposes, we will intentionally delete the partition with important files from the laptop and then restore it.

Go to computer management

Choose Disk Management

We see that the laptop has one physical hard drive installed and three partitions have been created on it. Now we delete volume D: for the experiment:

Confirm deletion

And… instead of partition D: we have unallocated space:

Partition Recovery with Testdisk for Windows

We go to the official website of the program: http://www.cgsecurity.org/wiki/TestDisk

Go to the section download:

and download TestDisk for Windows:

Open the downloaded file:

Let's unpack it:

We go to the folder where the archive was unpacked:

and run the file testdisk_win.exe :

The console window launches.

Choose no log:

Select the physical hard drive and click Proceed:

Select partition type and click Enter:

Choose Analyze:

After that, the utility displays a list of partitions on the physical disk. Click Quick Search to start searching for deleted partitions:

After scanning the disk, the utility finds all partitions, including the deleted one. In our case, this is the DATA volume.

Partition properties are displayed on the left:

* - main boot
P- main
L-logical

Hover over the desired section and check its size. You can also press the key P to list the files on the selected drive. To exit back to the main window of the utility, press the key Q. When we made sure that desired section, press Enter:

Click Write to write information about the DATA volume to the disk partition table:

Now you need to press Y to confirm:

Choose OK:

Choose Quit:

Once again Quit to close the utility window:

Reloading...

And our D: drive is back with us:

TestDisk - how to use. You have lost a section hard drive on Windows, this can happen for many reasons, the virus got on your computer, the incorrect operation of any program or incorrect user actions, which happens more often. No need to panic your files are safe and sound, just the partition information has been removed hard drive, from the partition table. This table is something similar to links, the file seems to be there, and without a link to it, the system cannot see it, because its address is not known. The first thing to do in this case is not to try to do anything with it. hard drive (format, or try to write something to it). If this happened with system partition, that is, drive C, and the system does not start, then the hard drive must be removed, connected to another working computer and carried out with it all the following operations. In the case under consideration, partition E, located on the same hard drive with the system, has disappeared. A powerful absolutely free utility helped me with this. Test Disk. This program specially designed for recover lost partitions on hard drives, for recovery boot files, due to incorrect actions of programs, humans and viruses (for example, the partition table has disappeared), as well as in the event of a failure in the operation of the storage medium. On this moment, Test Disk counts the best tool in its category, which has repeatedly helped to cope where paid tools from such monsters as Acronis, Runtime and others could not help. It is believed that using a utility like Acronis Recovery often harms and aggravates the problem more than it helps you. And so, I present to you an overview of how I dealt with this problem. Download TestDisk from official website or , and unpack, be sure to another hard drive, not the one on which we are going to restore the partition, if you have one hard drive, then this must be done on another computer.

My E is missing.

We launch program double clicking on the icon

The program window opens

in the program we work with the keys, up, down, left, right.

Here select Create and press Enter

Here we select the problematic hard disk, I have it first, 20 GB in size and press Enter

Select the desired type of Partition Table. Usually the correct value is already selected "by default" because Test Disk when parsing, determines the table type automatically.

Press Enter to continue.

Select the "Analyse" menu item to check the partition structure of the current disk and search for "lost" partitions.

Press Enter to continue.

Answer the question Should TestDisk search for partition created under Vista? (Search for partitions created under Vista OS?).

Press Y to continue.

Test Disk displays search results in real time.

Test Disk found two partitions, including the lost logical one with the label L, at the bottom of the table we look at the size of the partition.

Select this section and press p to display the file list (To exit the file list display mode, press q).

All folders and files are displayed normally. (The utility does not understand the Russian language, so files with Russian names may not be displayed correctly)
Press Enter to continue.