TestDisk

TestDisk brings back partitions that have vanished and makes unbootable disks boot again. A drive that suddenly shows as empty. A partition table wiped by a mistake or a virus. A boot sector that a power cut left half-written, or a disk the system insists on formatting before it will touch it. These are the cases it was built for. It reads the disk sector by sector, finds the partitions that are still physically there, and writes a corrected table that points to them. It also rebuilds damaged boot sectors, repairs the file tables of FAT disks, finds the backup copies of key structures, and copies files off partitions that the system can no longer mount.

It does all of this from a text window. There are no icons and no mouse. You move through menus with the arrow keys and confirm with Enter, and the screens look like something from a much older computer. That puts people off, and it should not, because the menus are short and the program tells you what it found before you change anything.

TestDisk ships alongside a sister tool, PhotoRec, which recovers individual files by their content when the file system is beyond saving. The sections below walk through what each one does, how a recovery actually proceeds, and the rules that keep a bad day from becoming a worse one.

What a lost partition really is

A disk, as TestDisk sees it, is divided into partitions, and a small table at its start says where each one begins and ends. Delete the table, or corrupt it, and the data is all still there. The disk simply forgets where to look. That is why a drive that reports itself as empty or unallocated is usually recoverable. The partition’s own structures, its boot sector and file tables, are untouched a few sectors in.

The program’s main job is to find those structures by scanning the disk and to rebuild the table from what it finds. Quick Search reads the places partitions usually start. Deeper Search reads every cylinder, which takes longer on a large disk and finds partitions that have been moved or overwritten at the edges.

When it lists what it has found, you check which entries look right, mark them, and write the new table. The data never moved. Only the map did.

Quick Search, Deeper Search and writing the table

A TestDisk recovery begins by choosing the disk and the partition table type, which the program usually guesses correctly. Analyse reads the current table and shows it. Quick Search then lists the partitions it finds, with their type and size, and where each starts and ends, and a letter beside each marking whether it would be primary, logical or deleted. You can list the files on a found partition before committing, which is the moment to confirm it is the one you lost.

If Quick Search misses the partition, Deeper Search scans the whole disk. It finds more and it also finds ghosts, old partitions from previous layouts that overlap the current ones, so the list needs reading with care. Mark the entries you want, check that none overlap, and choose Write. Then reboot. The program’s own documentation walks through this with screenshots, and following it the first time is wise.

Rebuilding boot sectors and file tables

A partition can be present and still unreadable when its boot sector is damaged, and TestDisk has tools for that too. The Advanced menu shows the boot sector and its backup copy side by side, since both FAT and NTFS keep one. If the backup is good, one command copies it over the damaged original. If both are damaged, Rebuild BS writes a new boot sector from the partition’s own geometry.

For NTFS the master file table can be repaired from its backup copy. For FAT disks the two file allocation tables can be compared and repaired. For the ext family of file systems the program locates the backup superblock, which the system’s own repair tool then uses.

These operations change the disk, so the rule is to work on a copy of the disk where the data matters, and the documentation says so on every page.

Undeleting and copying files

Two file-level tools sit in the TestDisk Advanced menu. Undelete lists the deleted files that a FAT, exFAT, NTFS or ext2 partition still remembers, in a file browser, and copies the ones you choose to another disk. The other tool, List, browses a partition the system cannot mount and copies files and folders out of it. That is the route when a partition is found but you would rather save the files than rewrite the table.

Both copy to a destination you choose, which must be a different disk. Writing recovered files back onto the disk you are recovering from overwrites the very sectors you are trying to save. For a friendlier undelete on a healthy drive, Recuva does the same job with a mouse, and this tool is for the disks it cannot see.

PhotoRec, when the file system is gone

PhotoRec, the companion to TestDisk, ignores the file system entirely. It reads the disk from end to end looking for the signatures that mark the start of a known file type, a JPEG header, a ZIP header, a document header, and carves out what follows. It knows several hundred file types, and it works on a formatted card, a disk with a destroyed partition table or a drive the first tool could not make sense of.

What you give up is names and folders. Carved files come back as numbered files sorted by type, with no original names and no structure, so a thousand photos become a thousand numbered JPEGs. Fragmented files may come back broken. It is the last resort and often the only one that works on a camera card, which is what it was first written for. For a memory card recovery with a graphical interface, a dedicated photo recovery tool covers the common case more gently.

Working on a copy, and the failing-drive rule

Every recovery guide, including the one for TestDisk, agrees on one thing. Do not run repairs on the only copy. If the drive is making noises, throwing errors or showing a bad health report, image it first with a tool that copies sector by sector and skips bad blocks, then run the recovery on the image. A health check with CrystalDiskInfo tells you which case you are in before you start.

The program itself can write a copy of a partition’s image and work from it. The write step, the one that changes the partition table, is the only irreversible action, and the program asks before it does anything of the kind. Everything up to that point is reading. Take the time it offers to list files and confirm.

Where it asks patience

The TestDisk interface is the obvious hurdle, and the menus are terse enough that a wrong choice is easy without the documentation open beside you. Deeper Search on a large disk takes a long time and lists ghosts. Undelete covers only some file systems, and files recovered from NTFS can be incomplete when their space was reused. There is no progress estimate on the longest operations beyond a cylinder counter.

None of that reflects on what it does, which no graphical tool in its class does better. The program is the standard for partition recovery because it works.

The text window is what comes with a tool that has stayed small and fast, and bootable from a rescue stick made with Rufus when the machine itself will not start.

Conclusion

TestDisk suits anyone facing a drive that has lost its partitions or refuses to boot, from a home user with a vanished data disk to a technician on a bench. It also suits anyone with a formatted camera card full of photos that PhotoRec can carve back out. It reads before it writes, it asks before it changes anything, and it works on the disks that graphical tools cannot see.

It demands the documentation open beside it and a second disk to recover onto. Image a failing drive first, confirm the partition by listing its files, and let the one Write step be the last thing you do.