TestDisk Documentation
TestDisk Data Recovery Utility
|
TestDisk Documentation |
|
You can see some complexe examples of data recovery with TestDisk.
On Dell computer, there is a special partition called DellUtility.
It's a FAT16 partition that is not visible from Windows because its partition
type is DE.
Disk 80 - CHS 4865 255 63 - 38162 MB (Enh BIOS mode) * FAT16 >32M 0 1 1 3 254 63 64197 [DellUtility] P HPFS - NTFS 4 0 1 4864 254 63 78091965
Select the DellUtility partition, use 'T' to change the partition type to DE.
Use the arrow key to boot on the NTFS partition.
Disk 80 - CHS 4865 255 63 - 38162 MB (Enh BIOS mode) P Dell Utility 0 1 1 3 254 63 64197 [DellUtility] * HPFS - NTFS 4 0 1 4864 254 63 78091965
In this case, all partitions have been deleted.
TestDisk show no partition!
The user has run testdisk /debug /log.
Extract of testdisk.log
Analyse Disk /dev/hdb - CHS 5169 240 63 - 38161 MB No partition is bootable search_part() Disk /dev/hdb - CHS 5169 240 63 - 38161 MB FAT32 at 0/1/1 heads/cylinder 255 (FAT) != 240 (HD)
A FAT32 partition has been found but it has been rejected
because of a bad harddisk geometry. The BIOS has selected
another harddisk geometry because of the content of the
MBR (empty in this case).
Under TestDisk, choose geometry, set the number of heads to
255 instead of 240 and run again Analyse. TestDisk still
displays no partition!
In the log, the FAT partition is visible.
Disk /dev/hdb - CHS 4864 255 63 - 38154 MB FAT32 at 0/1/1 D empty 0 1 1 0 0 63 0 FAT1 : 32-9576 FAT2 : 9577-19121 start_rootdir : 19122 root cluster : 2 Data : 19122-78156145 sectors : 78156162 cluster_size : 64 no_of_cluster : 1220891 (2 - 1220892) => FAT32 fat_length 9545 calculated 9539 D FAT32 LBA 0 1 1 4864 254 63 78156162
This is another problem, the partition ends at cylinder 4864, but the harddisk has only 4864 cylinders (first cylinder is 0). In Options, choose "Allow partition last cylinder" and after set the geometry. This time, the partition is visible and can be recovered.
Analyse Disk 80 - CHS 3737 255 63 - 29313 MB (Enh BIOS mode) 1 * FAT32 0 1 1 382 254 63 6152832 [LOKAL DISK] 2 E extended LBA 383 0 1 3736 254 63 53882010 Partition sector doesn't have the endmark 0xAA55 5 L FAT32 383 1 1 3736 254 63 53881947 5 L FAT32 383 1 1 3736 254 63 53881947
The boot sector of the logical FAT32 partition is damaged. In Advanced, select this partition:
Interface Advanced 1 * FAT32 0 1 1 382 254 63 6152832 [LOKAL DISK] 2 E extended LBA 383 0 1 3736 254 63 53882010
5 L FAT32 383 1 1 3736 254 63 53881947 Boot sector test_FAT : Partition sector doesn't have the endmark 0xAA55 Backup boot sector OK First sectors (Boot code and partition information) are not identical. Second sectors (cluster information) are not identical. Third sectors (Second part of boot code) are not identical.
The backup boot sector is valide, choose "Backup BS" to copy backup boot sector over boot sector.
Analyse Disk 81 - CHS 2434 255 63 - 19092 MB (Enh BIOS mode) No partition is bootable
No partition is avaible.
Analyse Disk 81 - CHS 2434 255 63 - 19092 MB (Enh BIOS mode) L FAT32 1275 1 1 2433 254 63 18619272 [NO NAME]
Only the second NTFS partition is found. Select Search!
to try to find more partitions.
Analyse Disk 81 - CHS 2434 255 63 - 19092 MB (Enh BIOS mode) * HPFS - NTFS 0 1 1 1274 254 63 20482812 L FAT32 1275 1 1 2433 254 63 18619272 [NO NAME]
Both partitions have been found. Choose Write. The first NTFS has been found using backup boot sector, we need to restore the boot sector. In Advanced, select the first NTFS partition, choose "Backup BS" to copy backup boot sector over boot sector.
There were two FAT32 on the harddisk but they have been deleted. After running Analyze and Search!, TestDisk has found only the second one
Disk 81 - CHS 525 255 63 - 4118 MB L FAT32 384 1 1 524 254 63 2265102
Using A to add what we think is the missing partition,
a new partition table have been written with two FAT32:
1 P FAT32 0 1 1 383 254 63 6168897 2 E extended 384 0 1 524 254 63 2265165 5 L FAT32 384 1 1 524 254 63 2265102
Using Advanced, Boot, RebuildBS, we have try to rebuild
the boot sector of the first FAT32. Using List,
it is possible to see a listing of files from the root directory
but there is also a lot of garbage... Nothing has been written.
In the log file, we can see that 4 copies of FAT32 have been found:
FAT32 at 32(0/1/33), nbr=123 FAT32 at 8221(0/131/32), nbr=123 FAT32 at 16097(1/1/33), nbr=1234 FAT32 at 22100(1/96/51), nbr=1234
Normally only two copies of FAT should be found. There are remaining data from two different FAT32 partitions: one beginning at 0/1/1, the second at 1/1/1. We have done a mistake. This time, we add the correct partition and choose to Write
1 E extended 1 0 1 524 254 63 8418060 5 L FAT32 1 1 1 383 254 63 6152832 6 L FAT32 384 1 1 524 254 63 2265102
With RebuildBS (Advanced/Boot), we have been able to successfully rebuild the boot sector.