TestDisk doesn't use the current partition structure to find partitions. TestDisk assumes the existence of partitions and scans all relevant drive cylinders for them. A primary partition starts at the beginning of a cylinder (head=0, sector=1), while a logical partition starts a little further along (head=1, sector=1). For each possible partition starting location, TestDisk can search for the presence of a partition header, which confirms the presence of a known partition type. Thus, the size of a partition is determined directly from its structure on the disk. Each partition that TestDisk discovers is added to a list of found partitions.
TestDisk checks for a magic value SWAP-SPACE
(version 1) or
SWAPSPACE2
(version 2) to determine if a sector is a the beginning
of swap partition. The first version of Linux SWAP is limited to 128Mb.
TestDisk checks for the magic value HM
and version 1 or 2.
TestDisk checks for the magic value FAT12
.
TestDisk checks for the magic value FAT16
.
TestDisk checks for the magic value FAT32
.
Even if the boot sector has been destroyed, the FAT32
partition can be found using the backup boot sector
at 6 sector offset, the standard offset for backup
boot sector.
TestDisk checks for the magic value IBM
.
TestDisk checks for the magic value FAT
.
TestDisk checks for the magic value NTFS
.
A backup boot sector is present at the last sector of
the partition. TestDisk checks the last sector of each
cylinder, but it can only works if the partition is
aligned to cylinder boundary.
TestDisk checks for the magic value Nw_PaRtItIoN
.
TestDisk checks for the magic value 0xa92b4efc
.
It's not easy to detect software RAID because the superblock
is after the filesystem. In practice, for each filesystem
found, TestDisk checks if a MD RAID superblock is present
after the filesystem, but this can only work for Raid 1.
Otherwise, MD RAID superblock can only be found if
TestDisk checks every sectors (slow mode).
TestDisk checks for the magic value 0x82564557
.
TestDisk checks for the three magic value 0x42465331
,
0xdd121031
and 0x15b6830e
.
TestDisk checks for the magic value 0xEF53
.
If a journal is present in the compatibility option, it's an Ext3
partition. Even if the primary superblock is overwritten,
TestDisk may found the partition.
There are backup of superblock in different groups. With sparse superblock feature,
the groups chosen are 0, 1 and powers of 3, 5 and 7.
TestDisk assumes that s_blocks_per_group=8 * block size and checks
for the presence of superblock signature in the position of supposed group 3.
It tries with block size of 1024, 2048 and 4096 bytes.
TestDisk checks for the magic value ReIsErFs
(version 1)
and ReIsEr2Fs
(version 2).