Example problem
We have a 36GB hard disk containing 3 partitions. Unfortunately;
- the boot sector of the primary NTFS partition has been damaged, and
- a logical NTFS partition has been accidentally deleted.
This recovery example guides you through TestDisk, step by step, to recover these ‘lost’ partitions by:
- rewriting the corrupted NTFS boot sector, and
- recovering the accidentally deleted logical NTFS partition.
Recovery of a FAT32 partition (instead of an NTFS partition) can be accomplished by following exactly the same steps. Other recovery examples are also available. For Information about FAT12, FAT16, ext2/ext3, HFS+, ReiserFS and other partition types, read Running the TestDisk Program.
Symptoms
If this hard disk’s primary partition contained an operating system, it would most likely no longer boot up — due to its corrupted boot sector. If the hard disk was a secondary (data) drive or you can connect the drive to another computer in its secondary channel (usually where a CD/DVD drive is connected), the following symptoms would be observed:
- Windows Explorer or Disk Manager displays the first primary partition as raw (unformatted) and Windows prompts: [You should never do so without knowing why!]
- A logical partition is missing. In Windows Explorer, that logical drive is no longer available. The Windows Disk Management Console now displays only «unallocated space» where this logical partition had been located.
A partition is still missing: Deeper Search
Deeper Search will also search for FAT32 backup boot sector, NTFS backup boot superblock, ext2/ext3 backup superblock
to detect more partitions,
| it will scan each cylinder | (click on thumb). |
After the Deeper Search, the results are displayed as follows:
The first partition «Partition 1» was found by using backup boot sector.
In the last line of your display, you can read the message «NTFS found using backup sector!» and the size of your partition.
The «partition 2» is displayed twice with different size.Partitions listed as D(eleted) will not be recovered if you let them listed as deleted.
Both partitions are listed with status D for deleted, because they overlap each other. You need to identify which partition to recover.
Highlight the first partition Partition 2 and press p to list its data.
| The file system of the upper logical partition (label Partition 2) is damaged | (click on thumb). |
- Press q for Quit to go back to the previous display.
- Let this partition with a damaged file system marked as .
- Highlight the second partition below
- Press p to list its files.
It works, your files are listed, you have found the correct partition!
Use the left/right arrow to navigate into your folders and watch your files for more verification
Note: FAT directory listing is limited to 10 clusters — some files may not appear but it doesn’t affect recovery.
Press q for Quit to go back to the previous display.
The available status are Primary, * bootable, Logical and Deleted.
Using the left/right arrow keys, change the status of the selected partition from to . This way you will be able to recover this partition.
| set partition to recover |
Hint: read How to recognize primary and logical partitions?
Note: If a partition is listed *(bootable) but if you don’t boot from this partition, you can change it to Primary partition.
Press Enter to proceed.
Running TestDisk executable
If TestDisk is not yet installed, it can be downloaded from TestDisk Download. Extract the files from the archive including the sub-directories.
To recover a lost partition or repair the filesystem from a hard disk, USB key, Smart Card, etc., you need enough rights to access a physical device.
- Under DOS, run TestDisk.exe
- Under Windows, start TestDisk (ie ) from an account in the Administrator group. Under Vista, right-click testdisk_win.exe and then «Run as administrator» to launch TestDisk.
- Under Unix/Linux/BSD, you need to be root to run TestDisk (ie. )
- Under MacOSX, if you are not root, TestDisk (ie ) will restart itself using sudo after confirmation on your part.
- Under OS/2, TestDisk doesn’t handle a physical device, only a disk image. Sorry.
To recover partition from a media image or repair a filesystem image, run
- to work from a raw disk image
- to recover files from an Encase EWF image
- if the Encase image is split into several files.
To repair a filesystem not listed by TestDisk, run , i.e.
- or to repair the NTFS or FAT32 boot sector files from a TrueCrypt partition. The same method works with filesystem encrypted with cryptsetup/dm-crypt/LUKS.
- to repair a filesystem on top of a Linux RAID device.
NTFS Boot sector recovery
The boot sector of the first partition named is still damaged. It’s time to fix it.
The status of the NTFS boot sector is bad and the backup boot sector is valid.
Boot sectors are not identical.
To copy the backup of the boot sector over the boot sector, select Backup BS, validate with Enter, use y to confirm and next OK.
More information about repairing your boot sector under TestDisk Menu Items.
The following message is displayed:
The boot sector and its backup are now both OK and identical: the NTFS boot sector has been successfully recovered.
Press Enter to quit.
TestDisk displays You have to restart your Computer to access your data so press Enter a last time and reboot your computer.
Current partition table status
TestDisk displays the menus (also see TestDisk Menu Items).
- Use the default menu «Analyse» to check your current partition structure and search for lost partitions.
- Confirm at Analyse with Enter to proceed.
Now, your current partition structure is listed.
Examine your current partition structure for missing partitions and errors.
The first partition is listed twice which points to a corrupted partition or an invalid partition table entry.
Invalid NTFS boot points to a faulty NTFS boot sector, so it’s a corrupted filesystem.
Only one logical partition (label Partition 2) is available in the extended partition.
One logical partition is missing.
Confirm at Quick Search to proceed.
