TestDisk

TestDisk is a free and open-source data recovery utility that helps users recover lost partitions or repair corrupted filesystems.^[1] TestDisk can collect detailed information about a corrupted drive, which can then be sent to a technician for further analysis. TestDisk supports DOS, Microsoft Windows (i.e. NT 4.0, 2000, XP, Server 2003, Server 2008, Vista, Windows 7, Windows 8.1, Windows 10), Linux, FreeBSD, NetBSD, OpenBSD, SunOS, and MacOS. TestDisk handles non-partitioned and partitioned media.^[2] In particular, it recognizes the GUID Partition Table (GPT), Apple partition map, PC/Intel BIOS partition tables, Sun Solaris slice and Xbox fixed partitioning scheme. TestDisk uses a command line user interface. TestDisk can recover deleted files with 97% accuracy.^[3]

Developer(s)	Christophe Grenier
Stable release	7.2 / February 22, 2024 (2024-02-22)
Repository	git.cgsecurity.org/cgit/testdisk/
Written in	C
Type	Data recovery
License	GPL
Website	www.cgsecurity.org/wiki/TestDisk

Features

TestDisk can recover deleted partitions, rebuild partition tables or rewrite the master boot record (MBR).^[4][3]

Partition recovery

TestDisk retrieves the LBA size and CHS geometry of attached data storage devices (i.e. hard disks, memory cards, USB flash drives, and virtual disk images) from the BIOS or the operating system. The geometry information is required for a successful recovery. TestDisk reads sectors on the storage device to determine if the partition table or filesystem on it requires repair (see next section).

TestDisk is able to recognize the following partition table formats:^[2]

• Apple partition map
• GUID Partition Table
• Humax
• PC/Intel Partition Table (master boot record)
• Sun Solaris slice
• Xbox fixed partitioning scheme
• Non-partitioned media

TestDisk can perform deeper checks to locate partitions that have been deleted from the partition table.^[2] However, it is up to the user to look over the list of possible partitions found by TestDisk and to select those that they wish to recover.

After partitions are located, TestDisk can rebuild the partition table and rewrite the MBR.^[2]

Filesystem repair

TestDisk can deal with some specific logical filesystem corruption.^[5]

File recovery

When a file is deleted, the list of disk clusters occupied by the file is erased, marking those sectors available for use by other files created or modified thereafter. TestDisk can recover deleted files especially if the file was not fragmented and the clusters have not been reused.

There are two file recovery mechanisms in the TestDisk package:^[2]

• TestDisk proper uses knowledge of the filesystem structure to perform "undelete".
• PhotoRec is a "file carver". It does not need any knowledge of the file system, but instead looks for patterns of known file formats in the partition or disk image. It works best on unfragmented files and cannot recover the file name.

Digital forensics

TestDisk can be used in digital forensics to retrieve partitions that were deleted long ago.^[3] It can mount various types of disk images including the Expert Witness File Format used by EnCase.^[2][6] Binary disk images, such as those created with ddrescue, can be read by TestDisk as though they were storage devices.^[7]

In TestDisk versions prior to version 7, a malformed disk or its image can be used to inject malicious code into a running TestDisk application on Cygwin.^[7]

File system support

File system support for TestDisk is shown in the table:

Name[2]	Partition Recovery	Filesystem Recovery		File Recovery
	Find filesystem	Boot sector/ superblock Restore	File table repair	Undelete[2]
FAT12/16/32	Yes	Yes[a][b]	Yes[c]	Yes
exFAT	Yes	Yes[b]	Use fsck	Yes
NTFS	Yes	Yes[a][b]	Yes[d]	Yes
ext2, ext3, and ext4	Yes	Yes[e]	Use fsck	Yes
HFS, HFS+, HFSX	Yes	Yes[b]	Use fsck	No
BeOS	Yes	No		No
BSD disklabel (FreeBSD/OpenBSD/NetBSD)	Yes			No
Cramfs	Yes			No
IBM JFS2	Yes			No
Linux RAID (mdadm)[f]	Yes			No
Linux Swap 1 and 2	Yes			No
LVM and LVM2	Yes			No
Novell Storage Services (NSS)	Yes			No
ReiserFS 3.5, 3.6 and 4	Yes			No
Sun Solaris i386 disklabel	Yes			No
UFS and UFS2 (Sun/BSD/…)	Yes			No
XFS from SGI	Yes			No

Some features, such as partition table editing and PhotoRec "carving", do not depend on the file system at all.

1. Find filesystem parameters to rewrite a valid BIOS parameter block (analogous to "superblocks" in Unix file systems)
2. Restore the BPB using its backup (NTFS, FAT32, exFAT)
3. Use the two copies of the FAT to rewrite a coherent version
4. Restore the Master File Table (MFT) from its backup
5. Find backup superblock location to assist fsck
6. RAID 1: mirroring, RAID 4: striped array with parity device, RAID 5: striped array with distributed parity information and RAID 6: striped array with distributed dual redundancy information

See also

• Free and open-source software portal

• PhotoRec
• List of data recovery software
• List of free and open-source software packages