How to recover files using testdisk
Testdisk is very well known under Linux. However, it also exists for Windows and Mac.
TestDisk is a free data recovery software designed to help recover lost
partitions and/or make non-booting disks bootable again when these symptoms
are caused by faulty software, certain types of viruses or human error.
It can also be used to repair some filesystem errors.
Start Testdisk with the simple command "testdisk".
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER
https://www.cgsecurity.org
TestDisk is a free data recovery software designed to help recover lost
partitions and/or make non-booting disks bootable again when these symptoms
are caused by faulty software, certain types of viruses or human error.
It can also be used to repair some filesystem errors.
Information gathered during TestDisk use can be recorded for later
review. If you choose to create the text file, testdisk.log , it
will contain TestDisk options, technical information and various
outputs; including any folder/file names TestDisk was used to find and
list onscreen.
Use arrow keys to select, then press Enter key:
[ Create ] Create a new log file
[ Append ] Append information to log file
>[ No Log ] Don't record anything
Normally you could choose "No Log" and press "Enter".
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER
https://www.cgsecurity.org
TestDisk is free software, and
comes with ABSOLUTELY NO WARRANTY.
Select a media (use Arrow keys, then press Enter):
>Disk /dev/sda - 250 GB / 232 GiB - Samsung SSD 850 EVO 250GB
Disk /dev/sdb - 2000 GB / 1863 GiB - TOSHIBA External USB 3.0
>[Proceed ] [ Quit ]
Note: Disk capacity must be correctly detected for a successful recovery.
If a disk listed above has an incorrect size, check HD jumper settings and BIOS
detection, and install the latest OS patches and disk drivers.
Now suppose you want to search for deleted files on /dev/sda and save them somewhere on /dev/sdb.
Therefore, select /dev/sda and press "Enter" to proceed.
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER
https://www.cgsecurity.org
Disk /dev/sda - 250 GB / 232 GiB - Samsung SSD 850 EVO 250GB
Please select the partition table type, press Enter when done.
>[Intel ] Intel/PC partition
[EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
[Humax ] Humax partition table
[Mac ] Apple partition map (legacy)
[None ] Non partitioned media
[Sun ] Sun Solaris partition
[XBox ] XBox partition
[Return ] Return to disk selection
Hint: Intel partition table type has been detected.
Note: Do NOT select 'None' for media with only a single partition. It's very
rare for a disk to be 'Non-partitioned'.
If you confirm that it is a PC partition, select "Intel" and press "Enter" to proceed:
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER
https://www.cgsecurity.org
Disk /dev/sda - 250 GB / 232 GiB - Samsung SSD 850 EVO 250GB
CHS 30401 255 63 - sector size=512
[ Analyse ] Analyse current partition structure and search for lost partitions
>[ Advanced ] Filesystem Utils
[ Geometry ] Change disk geometry
[ Options ] Modify options
[ MBR Code ] Write TestDisk MBR code to first sector
[ Delete ] Delete all data in the partition table
[ Quit ] Return to disk selection
Note: Correct disk geometry is required for a successful recovery. 'Analyse'
process may give some warnings if it thinks the logical geometry is mismatched.
Supposed you do not want to search for lost partitions, select "advanced" and press "Enter" to proceed:
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER
https://www.cgsecurity.org
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63
Partition Start End Size in sectors
1 * Linux 0 32 33 7294 119 35 117183594
2 E extended 7294 166 39 17810 231 21 168943618
5 L Linux Swap 7294 166 41 8084 200 52 12693504
X extended 8084 226 43 17810 231 21 156248484
> 6 L Linux 8084 233 22 17810 231 21 156248064
[ Type ] [Superblock] >[ List ] [Image Creation] [ Quit ]
List and copy files
As you know that the file that you accidentally deleted is located on the home partition (sector 6), select that sector and then select "List".
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER
https://www.cgsecurity.org
6 L Linux 8084 233 22 17810 231 21 156248064
Directory /
drwxr-xr-x 0 0 4096 15-Apr-2020 13:09 .
drwxr-xr-x 0 0 4096 15-Apr-2020 13:09 ..
drwx------ 0 0 16384 29-Apr-2020 17:04 lost+found
>drwxr-xr-x 1000 1000 4096 24-May-2020 13:16 user1
Next
Use Right to change directory, h to hide deleted files
q to quit, : to select the current file, a to select all files
C to copy the selected files, c to copy the current file
Select "user1" (the username) and press "Enter".
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER
https://www.cgsecurity.org
6 L Linux 8084 233 22 17810 231 21 156248064
Directory /user1
Previous
>drwxrwxr-x 1000 1000 4096 24-May-2020 17:12 Data
drwxrwxr-x 1000 1000 4096 1-May-2020 18:42 temp
Next
Use Left arrow to go back, Right to change directory, h to hide deleted files
q to quit, : to select the current file, a to select all files
C to copy the selected files, c to copy the current file
Now select the folder "Data" (case sensitive!), which is the folder in which the file that you search for was located before it has been deleted or marked as to be overwritten, and press "Enter".
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER
https://www.cgsecurity.org
6 L Linux 8084 233 22 17810 231 21 156248064
Directory /user1/Data
drwxrwxr-x 1000 1000 4096 24-May-2020 16:53 .
drwxr-xr-x 1000 1000 4096 24-May-2020 13:16 ..
>-rw-rw-r-- 1000 1000 0 24-May-2020 16:53 example-file1.odt
-rw-rw-r-- 1000 1000 0 24-May-2020 16:53 example-file2.odt
Next
Use Left arrow to go back, Right to change directory, h to hide deleted files
q to quit, : to select the current file, a to select all files
C to copy the selected files, c to copy the current file
Now select "example-file.odt" which is the file that you want to restore and press "c".
TestDisk 7.1, Data Recovery Utility, July 2019
Please select a destination where /user1/Data/example-file2.odt will be copied.
Keys: Arrow keys to select another directory
C when the destination is correct
Q to quit
Directory /home/user1
drwxr-xr-x 1000 1000 4096 24-May-2020 13:16 .
drwxr-xr-x 0 0 4096 15-Apr-2020 13:09 ..
drwxrwxr-x 1000 1000 4096 24-May-2020 17:12 Data
drwxr-xr-x 1000 1000 4096 12-May-2020 18:32 Desktop
>drwxr-xr-x 1000 1000 4096 24-May-2020 17:16 Documents
drwxr-xr-x 1000 1000 4096 15-May-2020 14:27 Downloads
Now I select the folder where the file shall be restored to.
In case everything went fine, the output should be "Copy done! 1 ok, 0 failed":
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER
https://www.cgsecurity.org
6 L Linux 8084 233 22 17810 231 21 156248064
Directory /user1/Data/example-file1.odt
Copy done! 1 ok, 0 failed
drwxrwxr-x 1000 1000 4096 24-May-2020 16:53 .
drwxr-xr-x 1000 1000 4096 24-May-2020 13:16 ..
>-rw-rw-r-- 1000 1000 0 24-May-2020 16:53 example-file1.odt
-rw-rw-r-- 1000 1000 0 24-May-2020 16:53 example-file2.odt
Next
Use Left arrow to go back, Right to change directory, h to hide deleted files
q to quit, : to select the current file, a to select all files
C to copy the selected files, c to copy the current file
You can now quit the application.
Check for similar articles.