Sie sind auf Seite 1von 10

TestDisk and PhotoRec Repair

Disks and Recover Files


Generic Company Place Holder TestDisk
PCWORLD RATING

Perform low-level disk repair and file recovery--from a command prompt or DOS box--with
this handy pair of utilities.
By Jon L. Jacobi, PCWorld

Mar 20, 2011 3:33 AM

If you're a fan of character-based interfaces--such as DOS--and free data recovery, you're


going to love TestDisk and its companion utility, PhotoRec (a brother program included in
the TestDisk download). Both free programs run in a DOS box or from a command line and
test, report on, fix common disk boot problems, and recover files from damaged hard drives.
All this is done at low level, below the operating system.
Running TestDisk and PhotoRec in a DOS box under Windows, there's no mouse control--but
cursoring through the programs is just as easy.

You don't install TestDisk and PhotoRec. You simply unzip the archive to the location from
which you want to run it. This may be a bit confusing for users used to installing, but it
makes the apps portable, which is far more important to the techier types who are the
intended audience. Simply drag the files around on your flash drive and run them from
there. Being portable also makes these utilities suitable for inclusion on boot discs. Though
character-based, TestDisk and PhotoRec are just as easy to use as a GUI-based program.
The options are logically laid out, the language readily understandable for anyone
comfortable with command-line utilities, and you simply cursor up and down, right and left to
navigate. The way the cursor control is facilitated to accommodate two functions per page is
actually quite clever.
I ran both programs through their paces and they worked quite well. They accurately
reported the types of drives I had attached to my system and recovered all the deleted files I
threw at them--regardless of an existing partition or not. There were some misfires in the
recognition, but there are in every recovery program I've ever used. But I'm definitely going
to give both TestDisk and PhotoRec a long hard look in future repair operations. I like
character-based utilities.

AT A GLANCE
; Generic Company Place Holder TestDisk

; PCWORLD RATING
; Perform low-level disk repair and file recovery--from a command prompt or
DOS box--with this handy pair of utilities.

; Pros

Low-level disk repair and recovery bypasses OS

No GUI for less-advanced users.

; Cons

Test Disk is a powerful data recovery software developed by CGSecurity for


Windows, Mac and Linux-based PCs.
This freeware enables users to recover lost partitions from different file systems
including FAT12/16/32, BeFS, CramFS, Linux RAID, NTFS, HSF, BSDand
many more. It can also recover deleted partition as well as fix partition table.
In addition, TestDisk is designed to fix FAT tables, recover FAT32 and NTFS boot
sectors from back-up and rebuild FAT and NTFS boot sector. It can also copy and
undelete files from FAT, NTFS and ext2 file system.
Furthermore, this freeware features a user-friendly interface and several other features
that would appeal to both novice and expert users.
Checking out Tom's Guide for more Windows Applications and Windows
Information.
And if you have any questions or need some help regarding any tech. issues, you may
visit the Tom's Guide forums to help you out.
TestDisk is OpenSource software and is licensed under the terms of the GNU General Public
License (GPL v2+).

TestDisk is powerful free data recovery software! It was primarily designed to help recover lost
partitions and/or make non-booting disks bootable again when these symptoms are caused by
faulty software: certain types of viruses or human error (such asaccidentally deleting a Partition
Table). Partition table recovery using TestDisk is really easy.
TestDisk can

Fix partition table, recover deleted partition


Recover FAT32 boot sector from its backup
Rebuild FAT12/FAT16/FAT32 boot sector
Fix FAT tables
Rebuild NTFS boot sector
Recover NTFS boot sector from its backup
Fix MFT using MFT mirror
Locate ext2/ext3/ext4 Backup SuperBlock
Undelete files from FAT, exFAT, NTFS and ext2 filesystem
Copy files from deleted FAT, exFAT, NTFS and ext2/ext3/ext4 partitions.

TestDisk has features for both novices and experts. For those who know little or nothing about data
recovery techniques, TestDisk can be used to collect detailed information about a non-booting drive
which can then be sent to a tech for further analysis. Those more familiar with such procedures
should find TestDisk a handy tool in performing onsite recovery.

Operating systems
TestDisk can run under

DOS (either real or in a Windows 9x DOS-box),


Windows (NT4, 2000, XP, 2003, Vista, 2008, Windows 7 (x86 & x64),

Windows 10

Linux,

FreeBSD, NetBSD, OpenBSD,

SunOS and

MacOS X

Download binary executables and source files for DOS, Win32, MacOSX and Linux.

Documentation

TestDisk Step by Step to recover lost partitions and repair damaged

FAT/NTFS boot sector

TestDisk and Live rescue cd

TestDisk compilation. Developers are welcome to contribute code to TestDisk

& PhotoRec.

Recover deleted files


Recover deleted files from NTFS partition
Undelete files and directories from FAT12, FAT16, FAT32 and
exFAT filesystem. FAT file systems are commonly found on flash memory
cards, digital cameras, and many other portable devices.
Undelete files from ext2 filesystem

Recovery examples

Computer forensics self training using TestDisk & PhotoRec

Running the TestDisk Program , a menu by menu explanation

TestDisk FAQ

Support

TestDisk & PhotoRec In The News

TestDisk Team
To recover lost pictures or files from digital camera or harddisk, run the PhotoRec command.

Filesystems
TestDisk can find lost partitions for all of these file systems:

BeFS ( BeOS )
BSD disklabel ( FreeBSD/OpenBSD/NetBSD )
CramFS, Compressed File System
DOS/Windows FAT12, FAT16 and FAT32
XBox FATX
Windows exFAT
HFS, HFS+ and HFSX, Hierarchical File System
JFS, IBM's Journaled File System
Linux btrfs
Linux ext2, ext3 and ext4
Linux GFS2
Linux LUKS encrypted partition
Linux RAID md 0.9/1.0/1.1/1.2
RAID 1: mirroring
RAID 4: striped array with parity device
RAID 5: striped array with distributed parity information
RAID 6: striped array with distributed dual redundancy
information
Linux Swap (versions 1 and 2)
LVM and LVM2, Linux Logical Volume Manager
Mac partition map
Novell Storage Services NSS
NTFS ( Windows NT/2000/XP/2003/Vista/2008/7 )
ReiserFS 3.5, 3.6 and 4
Sun Solaris i386 disklabel
Unix File System UFS and UFS2 (Sun/BSD/...)
XFS, SGI's Journaled File System
Wii WBFS
Sun ZFS

PhotoRec, Digital Picture and File Recovery


PhotoRec is file data recovery software designed to recover lost files including video, documents
and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from
digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it
will still work even if your media's file system has been severely damaged or reformatted.
PhotoRec is free - this open source multi-platform application is distributed under GNU General
Public License (GPLV v2+). PhotoRec is a companion program to TestDisk, an application for
recovering lost partitions on a wide variety of file systems and making non-bootable disks bootable
again. You can download them from this link.
For more safety, PhotoRec uses read-only access to handle the drive or memory card you are about
to recover lost data from. Important: As soon as a picture or file is accidentally deleted, or you
discover any missing, do NOT save any more pictures or files to that memory device or hard disk
drive; otherwise you may overwrite your lost data. This means that while using PhotoRec, you must
not choose to write the recovered files to the same partition they were stored on.
Contents
[hide]

;
;
;
;
;
;
;

1 Operating systems
2 File systems
3 Media
4 Known file formats
5 How PhotoRec works
6 Other topics
7 Problems?

Operating systems
PhotoRec runs under

DOS/Windows 9x
Windows NT 4/2000/XP/2003/Vista/2008/7/10
Linux
FreeBSD, NetBSD, OpenBSD
Sun Solaris
Mac OS X

and can be compiled on almost every Unix system.

Download TestDisk & PhotoRec

File systems
PhotoRec ignores the file system; this way it works even if the file system is severely damaged.
It can recover lost files from at least

FAT
NTFS
exFAT
ext2/ext3/ext4 filesystem
HFS+

ReiserFS includes some special optimizations centered around tails, a name for files and end
portions of files that are smaller than a filesystem block. In order to increase performance, ReiserFS
is able to store files inside the b*tree leaf nodes themselves, rather than storing the data somewhere
else on the disk and pointing to it. Unfortunately, PhotoRec isn't able to deal with this - that's why it
doesn't work well with ReiserFS.

Media
PhotoRec works with hard disks, CD-ROMs, memory cards (CompactFlash, Memory Stick, Secure
Digital/SD, SmartMedia, Microdrive, MMC, etc.), USB memory drives, DD raw image, EnCase E01
image, etc.
PhotoRec has been successfully tested with various portable media players including iPod and the
following Digital Cameras:

Canon EOS 60D, 300D, 10D


Casio Exilim EX-Z 750
Fujifilm X-T10
HP PhotoSmart 620, 850, 935
Nikon CoolPix 775, 950, 5700
Olympus C350N, C860L, Mju 400 Digital, Stylus 300
Sony Alpha DSLR, DSC-P9, NEX-6
Pentax K20D
Praktica DCZ-3.4

Known file formats

PhotoRec searches for known file headers. If there is no data fragmentation, which is often the case,
it can recover the whole file. PhotoRec recognizes and recovers numerous file formats including
ZIP, Office, PDF, HTML, JPEG and various graphics file formats. The whole list of file formats
recovered by PhotoRec contains more than 480 file extensions (about 300 file families).
Want to know if PhotoRec can recover your files ? Upload a sample file via the PhotoRec online
checker (BETA).

How PhotoRec works


FAT, NTFS, ext2/ext3/ext4 file systems store files in data blocks (also called clusters under
Windows). The cluster or block size remains at a constant number of sectors after being initialized
during the formatting of the file system. In general, most operating systems try to store the data in a
contiguous way so as to minimize data fragmentation. The seek time of mechanical drives is
significant for writing and reading data to/from a hard disk, so that's why it's important to keep the
fragmentation to a minimum level.
When a file is deleted, the meta-information about this file (file name, date/time, size, location of the
first data block/cluster, etc.) is lost; for example, in an ext3/ext4 file system, the names of deleted
files are still present, but the location of the first data block is removed. This means the data is still
present on the file system, but only until some or all of it is overwritten by new file data.
To recover these lost files, PhotoRec first tries to find the data block (or cluster) size. If the file
system is not corrupted, this value can be read from the superblock (ext2/ext3/ext4) or volume boot
record (FAT, NTFS). Otherwise, PhotoRec reads the media, sector by sector, searching for the first
ten files, from which it calculates the block/cluster size from their locations. Once this block size is
known, PhotoRec reads the media block by block (or cluster by cluster). Each block is checked
against a signature database which comes with the program and has grown in the type of files it can
recover ever since PhotoRec's first version came out.
For example, PhotoRec identifies a JPEG file when a block begins with:

0xff, 0xd8, 0xff, 0xe0


0xff, 0xd8, 0xff, 0xe1
or 0xff, 0xd8, 0xff, 0xfe

If PhotoRec has already started to recover a file, it stops its recovery, checks the consistency of the
file when possible and starts to save the new file (which it determined from the signature it found).
If the data is not fragmented, the recovered file should be either identical to or larger than the original
file in size. In some cases, PhotoRec can learn the original file size from the file header, so the

recovered file is truncated to the correct size. If, however, the recovered file ends up being smaller
than its header specifies, it is discarded. Some files, such as *.MP3 types, are data streams. In this
case, PhotoRec parses the recovered data, then stops the recovery when the stream ends.
When a file is recovered successfully, PhotoRec checks the previous data blocks to see if a file
signature was found but the file wasn't able to be successfully recovered (that is, the file was too
small), and it tries again. This way, some fragmented files can be successfully recovered.

Other topics

Working with CD-R/CR-RW/DVD/floppy...


PhotoRec Step By Step
Recover data from an iPhone
How to help
After Using PhotoRec: Some ideas to sort recovered files
PhotoRec FAQ
Scripted run: Running PhotoRec without user interaction (Batch mode).
Developers How to contribute code to TestDisk & PhotoRec

Problems?
Don't hesitate to visit the PhotoRec forum if you have

some difficulties using PhotoRec,


some ideas to improve it

If there is a file format you would like to be added, feel free to contact the developer Christophe
GRENIER.