TestDisk

TestDisk is a free, open-source data recovery utility primarily used to recover lost partitions or repair damaged partition tables, and to make non-booting disks bootable again. It is particularly suitable for scenarios where partitions have been accidentally deleted or the partition table has been corrupted but the data has not yet been overwritten.

Core Functions

TestDisk can perform the following operations:

• Repair partition table: Recover deleted partitions or rebuild damaged partition tables.
• Repair boot sectors: Rebuild FAT/NTFS boot sectors or recover from backups.
• Fix file system structures: Such as repairing FAT tables, fixing MFT using the MFT mirror, and locating ext2/3/4 backup superblocks.
• Undelete files: Recover deleted files from FAT, exFAT, NTFS, and ext2 file systems.

Installation Methods

Installation methods vary across Linux distributions:

• Debian/Ubuntu: sudo apt-get install testdisk
• CentOS/RHEL: sudo yum install -y epel-release && sudo yum install -y testdisk (requires enabling the EPEL repository first)

Basic Operating Workflow (Recovering Partitions)

The following is the standard process for recovering lost partitions using TestDisk, primarily based on Linux environment examples.

1. Preparation and Startup

• Stop writing to the disk: Immediately stop using the affected disk to avoid overwriting the data you want to recover.
• Create a backup (strongly recommended): If conditions permit, create a snapshot or complete image of the disk first. This is the safest approach.
• Run TestDisk: Enter sudo testdisk in the terminal, select Create to create a new log file, then select the target disk to operate on.

2. Select Partition Table Type

TestDisk typically auto-detects. You need to confirm based on the disk’s original type: select Intel for legacy MBR, and EFI GPT for newer GPT.

3. Scan for Lost Partitions

• Select Analyse to enter the analysis menu, then select Quick Search to start a quick scan.
• If Quick Search does not find the desired partition, return and select Deeper Search for a more thorough scan (takes longer).

4. Verify and Write

• After the scan results appear, use the arrow keys to highlight the found partition, press P to view the file list, and confirm whether the files are complete.
• After confirming it is correct, press Enter to mark it (usually shows as * or P), then select Write to write the partition table to the disk, and enter Y to confirm.

5. Verification

After exiting TestDisk, run lsblk to check if the partition has reappeared, or attempt to mount the partition to verify data integrity.

Key Cautions

• Do not save to the source disk: When recovering files, the save location must be another disk, never the disk being recovered.
• Success is not guaranteed: If the partition data has been overwritten, TestDisk cannot recover it. The earlier the operation, the higher the success rate.
• Partition recovery is not file recovery: If the partition table is restored but the file system is still corrupted, you may need to use fsck or PhotoRec and other tools for further processing.