Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
TestDisk
open-in-new
<h2 id="features">Features</h2> <p>TestDisk can recover deleted partitions, rebuild partition tables or rewrite the <a href="/facts/Master_boot_record/nEJerupp">master boot record</a> (MBR).<a class="footnote-ref" id="fnref:4" href="#fn:4"><sup>4</sup></a><a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a> </p> <h3>Partition recovery</h3> <p>TestDisk retrieves the <a href="/facts/Logical_block_addressing/WWtvA0E2">LBA</a> size and <a href="/facts/Cylinder-head-sector/rUMqWXob">CHS</a> geometry of attached <a href="/facts/Data_storage_device/uCvJ6nrq">data storage devices</a> (i.e. <a href="/facts/Hard_disk/kekLSGSE">hard disks</a>, <a href="/facts/Memory_card/Rwy2lKS2">memory cards</a>, <a href="/facts/USB_flash_drive/Jv0qmTCF">USB flash drives</a>, and <a href="/facts/Virtual_disk/vdFff04T">virtual disk</a> images) from the <a href="/facts/BIOS/2RY3dzQe">BIOS</a> or the <a href="/facts/Operating_system/8XTuvMh2">operating system</a>. The geometry information is required for a successful recovery. TestDisk reads sectors on the storage device to determine if the partition table or filesystem on it requires repair (see next section). </p><p>TestDisk is able to recognize the following partition table formats:<a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a> </p> <ul><li>Apple partition map</li> <li>GUID Partition Table</li> <li>Humax</li> <li>PC/Intel Partition Table (master boot record)</li> <li>Sun Solaris slice</li> <li>Xbox fixed partitioning scheme</li> <li>Non-partitioned media</li></ul> <p>TestDisk can perform deeper checks to locate partitions that have been deleted from the partition table.<a class="footnote-ref" id="fnref:7" href="#fn:7"><sup>7</sup></a> However, it is up to the user to look over the list of possible partitions found by TestDisk and to select those that they wish to recover. </p><p>After partitions are located, TestDisk can rebuild the partition table and rewrite the MBR.<a class="footnote-ref" id="fnref:8" href="#fn:8"><sup>8</sup></a> </p> <h3>Filesystem repair</h3> <p>TestDisk can deal with some specific logical filesystem corruption.<a class="footnote-ref" id="fnref:9" href="#fn:9"><sup>9</sup></a> </p> <h3>File recovery</h3> <p>When a file is deleted, the list of disk clusters occupied by the file is erased, marking those sectors available for use by other files created or modified thereafter. TestDisk can recover deleted files especially if the file was not fragmented and the clusters have not been reused. </p><p>There are two file recovery mechanisms in the TestDisk package:<a class="footnote-ref" id="fnref:10" href="#fn:10"><sup>10</sup></a> </p> <ul><li>TestDisk proper uses knowledge of the filesystem structure to perform "undelete".</li> <li><a href="/facts/PhotoRec/tbIhRVLG">PhotoRec</a> is a "file carver". It does not need any knowledge of the file system, but instead looks for patterns of known file formats in the partition or disk image. It works best on unfragmented files and cannot recover the file name.</li></ul> <h2 id="digital-forensics">Digital forensics</h2> <p>TestDisk can be used in <a href="/facts/Digital_forensics/MPF5Vdpq">digital forensics</a> to retrieve partitions that were deleted long ago.<a class="footnote-ref" id="fnref:11" href="#fn:11"><sup>11</sup></a> It can mount various types of disk images including the <a href="/facts/EnCase/AT8GP3YS">Expert Witness File Format</a> used by <a href="/facts/EnCase/AT8GP3YS">EnCase</a>.<a class="footnote-ref" id="fnref:12" href="#fn:12"><sup>12</sup></a><a class="footnote-ref" id="fnref:13" href="#fn:13"><sup>13</sup></a> Binary <a href="/facts/Disk_image/wbVUwIeh">disk images</a>, such as those created with <a href="/facts/Ddrescue/Hco1L5HV">ddrescue</a>, can be read by TestDisk as though they were storage devices.<a class="footnote-ref" id="fnref:14" href="#fn:14"><sup>14</sup></a> </p><p>In TestDisk versions prior to version 7, a malformed disk or its image can be used to inject malicious code into a running TestDisk application on <a href="/facts/Cygwin/0ANCmAgH">Cygwin</a>.<a class="footnote-ref" id="fnref:15" href="#fn:15"><sup>15</sup></a> </p> <h2 id="file-system-support">File system support</h2> <p>File system support for TestDisk is shown in the table: </p> <table><tbody><tr><th rowspan="2" scope="col">Name<a class="footnote-ref" id="fnref:16" href="#fn:16"><sup>16</sup></a></th><th scope="col">Partition Recovery</th><th colspan="2" scope="col">Filesystem Recovery</th><th scope="col">File Recovery</th></tr><tr><th scope="col">Find filesystem</th><th scope="col">Boot sector/superblock Restore</th><th scope="col">File table repair</th><th scope="col">Undelete<a class="footnote-ref" id="fnref:17" href="#fn:17"><sup>17</sup></a></th></tr><tr><th scope="row"><a href="/facts/File_Allocation_Table/uFvpmWxa">FAT12/16/32</a></th><td>Yes</td><td>Yes<a class="footnote-ref" id="fnref:18" href="#fn:18"><sup>18</sup></a><a class="footnote-ref" id="fnref:19" href="#fn:19"><sup>19</sup></a></td><td>Yes<a class="footnote-ref" id="fnref:20" href="#fn:20"><sup>20</sup></a></td><td>Yes</td></tr><tr><th scope="row"><a href="/facts/ExFAT/w9R3QhPC">exFAT</a></th><td>Yes</td><td>Yes<a class="footnote-ref" id="fnref:21" href="#fn:21"><sup>21</sup></a></td><td>Use <a href="/facts/Fsck/v9IpnBLS">fsck</a></td><td>Yes</td></tr><tr><th scope="row"><a href="/facts/NTFS/dryNM3BK">NTFS</a></th><td>Yes</td><td>Yes<a class="footnote-ref" id="fnref:22" href="#fn:22"><sup>22</sup></a><a class="footnote-ref" id="fnref:23" href="#fn:23"><sup>23</sup></a></td><td>Yes<a class="footnote-ref" id="fnref:24" href="#fn:24"><sup>24</sup></a></td><td>Yes</td></tr><tr><th scope="row"><a href="/facts/Ext2/ftyVw4Kv">ext2</a>, <a href="/facts/Ext3/VSEhX1WQ">ext3</a>, and <a href="/facts/Ext4/zFbQRpsh">ext4</a></th><td>Yes</td><td>Yes<a class="footnote-ref" id="fnref:25" href="#fn:25"><sup>25</sup></a></td><td>Use <a href="/facts/Fsck/v9IpnBLS">fsck</a></td><td>Yes</td></tr><tr><th scope="row">HFS, <a href="/facts/HFS%252B/sWk14kM5">HFS+</a>, HFSX</th><td>Yes</td><td>Yes<a class="footnote-ref" id="fnref:26" href="#fn:26"><sup>26</sup></a></td><td>Use <a href="/facts/Fsck/v9IpnBLS">fsck</a></td><td>No</td></tr><tr><th scope="row"><a href="/facts/BeOS/tGYfe835">BeOS</a></th><td>Yes</td><td colspan="2" rowspan="12">No</td><td>No</td></tr><tr><th scope="row"><a href="/facts/BSD_disklabel/0PLBexY1">BSD disklabel</a> (FreeBSD/OpenBSD/NetBSD)</th><td>Yes</td><td>No</td></tr><tr><th scope="row"><a href="/facts/Cramfs/j0r9BsBp">Cramfs</a></th><td>Yes</td><td>No</td></tr><tr><th scope="row"><a href="/facts/IBM_Journaled_File_System_2_(JFS2)/bmJLqaP8">IBM JFS2</a></th><td>Yes</td><td>No</td></tr><tr><th scope="row">Linux RAID (<a href="/facts/Mdadm/Nhv2GcUQ">mdadm</a>)<a class="footnote-ref" id="fnref:27" href="#fn:27"><sup>27</sup></a></th><td>Yes</td><td>No</td></tr><tr><th scope="row">Linux Swap 1 and 2</th><td>Yes</td><td>No</td></tr><tr><th scope="row"><a href="/facts/Logical_Volume_Manager/ku3Ivefk">LVM and LVM2</a></th><td>Yes</td><td>No</td></tr><tr><th scope="row"><a href="/facts/Novell_Storage_Services/69Ix126V">Novell Storage Services</a> (NSS)</th><td>Yes</td><td>No</td></tr><tr><th scope="row"><a href="/facts/ReiserFS/aGg9PTtk">ReiserFS</a> 3.5, 3.6 and 4</th><td>Yes</td><td>No</td></tr><tr><th scope="row">Sun Solaris i386 disklabel</th><td>Yes</td><td>No</td></tr><tr><th scope="row"><a href="/facts/Unix_File_System/qWU9Tlnh">UFS and UFS2</a> (Sun/BSD/…)</th><td>Yes</td><td>No</td></tr><tr><th scope="row"><a href="/facts/XFS/2I4Wn5wG">XFS</a> from SGI</th><td>Yes</td><td>No</td></tr></tbody></table> <p>Some features, such as partition table editing and PhotoRec "carving", do not depend on the file system at all. </p> <h2 id="see-also">See also</h2> <ul> <li>Free and open-source software portal</li></ul> <ul><li><a href="/facts/PhotoRec/tbIhRVLG">PhotoRec</a></li> <li><a href="/facts/List_of_data_recovery_software/KvNG11I1">List of data recovery software</a></li> <li><a href="/facts/List_of_free_and_open-source_software_packages/l3x4PXwn">List of free and open-source software packages</a></li></ul> <h2 id="external-links">External links</h2> <ul><li><a href="https://www.cgsecurity.org/wiki/TestDisk">TestDisk Wiki</a></li> <li><a href="https://www.cgsecurity.org/wiki/In_The_News">List of news articles about TestDisk and PhotoRec</a></li> <li><a href="https://www.howtoforge.com/data_recovery_with_testdisk">Data Recovery With TestDisk</a>, Falko Timme, HowtoForge</li> <li><a href="https://www.digitalforensics.ch/nikkel05b.pdf">Digital Forensics using Linux and Open Source Tools</a></li></ul> <p>Test Disk Team: Main Contributor: Christophe Grenier. Location: Paris, France. URL: cgsecurity.org. He started the project in 1998 and is still the main developer. He is also responsible for the packaging of TestDisk & PhotoRec for DOS, Windows, Linux (generic version), MacOS X, and Fedora distribution. </p> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>Moggridge, J. (2017). "Security of patient data when decommissioning ultrasound systems". Ultrasound. 25 (1). Leeds, England: 16–24. doi:10.1177/1742271X16688043. PMC 5308389. PMID 28228821. <a href="https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5308389" target="_blank">https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5308389</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>Grenier, Christophe (2021-05-31), TestDisk Documentation, CG Security (PDF) <a href="https://www.cgsecurity.org/testdisk_doc/" target="_blank">https://www.cgsecurity.org/testdisk_doc/</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>kumar, Hany; Saharan, Ravi; Panda, Saroj Kumar (March 2020). "Identification of Potential Forensic Artifacts in Cloud Storage Application". 2020 International Conference on Computer Science, Engineering and Applications (ICCSEA). pp. 1–5. doi:10.1109/ICCSEA49143.2020.9132869. ISBN 978-1-7281-5830-3. S2CID 220367251. <a href="978-1-7281-5830-3" target="_blank">978-1-7281-5830-3</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>Debra Littlejohn Shinder, Michael Cross (2002). Scene of the cybercrime, page 328. Syngress. ISBN 978-1-931836-65-4. <a href="/wiki/ISBN_(identifier)" target="_blank">/wiki/ISBN_(identifier)</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>kumar, Hany; Saharan, Ravi; Panda, Saroj Kumar (March 2020). "Identification of Potential Forensic Artifacts in Cloud Storage Application". 2020 International Conference on Computer Science, Engineering and Applications (ICCSEA). pp. 1–5. doi:10.1109/ICCSEA49143.2020.9132869. ISBN 978-1-7281-5830-3. S2CID 220367251. <a href="978-1-7281-5830-3" target="_blank">978-1-7281-5830-3</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>Grenier, Christophe (2021-05-31), TestDisk Documentation, CG Security (PDF) <a href="https://www.cgsecurity.org/testdisk_doc/" target="_blank">https://www.cgsecurity.org/testdisk_doc/</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> <li id="fn:7"><p>Grenier, Christophe (2021-05-31), TestDisk Documentation, CG Security (PDF) <a href="https://www.cgsecurity.org/testdisk_doc/" target="_blank">https://www.cgsecurity.org/testdisk_doc/</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li> <li id="fn:8"><p>Grenier, Christophe (2021-05-31), TestDisk Documentation, CG Security (PDF) <a href="https://www.cgsecurity.org/testdisk_doc/" target="_blank">https://www.cgsecurity.org/testdisk_doc/</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li> <li id="fn:9"><p>Jack Wiles, Kevin Cardwell, Anthony Reyes (2007). The best damn cybercrime and digital forensics book period, page 373. Syngress. ISBN 978-1-59749-228-7. <a href="/wiki/ISBN_(identifier)" target="_blank">/wiki/ISBN_(identifier)</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li> <li id="fn:10"><p>Grenier, Christophe (2021-05-31), TestDisk Documentation, CG Security (PDF) <a href="https://www.cgsecurity.org/testdisk_doc/" target="_blank">https://www.cgsecurity.org/testdisk_doc/</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></p></li> <li id="fn:11"><p>kumar, Hany; Saharan, Ravi; Panda, Saroj Kumar (March 2020). "Identification of Potential Forensic Artifacts in Cloud Storage Application". 2020 International Conference on Computer Science, Engineering and Applications (ICCSEA). pp. 1–5. doi:10.1109/ICCSEA49143.2020.9132869. ISBN 978-1-7281-5830-3. S2CID 220367251. <a href="978-1-7281-5830-3" target="_blank">978-1-7281-5830-3</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></p></li> <li id="fn:12"><p>Grenier, Christophe (2021-05-31), TestDisk Documentation, CG Security (PDF) <a href="https://www.cgsecurity.org/testdisk_doc/" target="_blank">https://www.cgsecurity.org/testdisk_doc/</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></p></li> <li id="fn:13"><p>Altheide, C., & Carvey, H. (2011). File System and Disk Analysis. In Digital Forensics with Open Source Tools. Elsevier. https://booksite.elsevier.com/samplechapters/9781597495868/Chapter_3.pdf <a href="https://booksite.elsevier.com/samplechapters/9781597495868/Chapter_3.pdf" target="_blank">https://booksite.elsevier.com/samplechapters/9781597495868/Chapter_3.pdf</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></p></li> <li id="fn:14"><p>Németh, Z. L. (2015). "Modern binary attacks and defences in the windows environment — Fighting against microsoft EMET in seven rounds". 2015 IEEE 13th International Symposium on Intelligent Systems and Informatics (SISY). pp. 275–280. doi:10.1109/SISY.2015.7325394. ISBN 978-1-4673-9388-1. S2CID 18914754. <a href="978-1-4673-9388-1" target="_blank">978-1-4673-9388-1</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></p></li> <li id="fn:15"><p>Németh, Z. L. (2015). "Modern binary attacks and defences in the windows environment — Fighting against microsoft EMET in seven rounds". 2015 IEEE 13th International Symposium on Intelligent Systems and Informatics (SISY). pp. 275–280. doi:10.1109/SISY.2015.7325394. ISBN 978-1-4673-9388-1. S2CID 18914754. <a href="978-1-4673-9388-1" target="_blank">978-1-4673-9388-1</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></p></li> <li id="fn:16"><p>Grenier, Christophe (2021-05-31), TestDisk Documentation, CG Security (PDF) <a href="https://www.cgsecurity.org/testdisk_doc/" target="_blank">https://www.cgsecurity.org/testdisk_doc/</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></p></li> <li id="fn:17"><p>Grenier, Christophe (2021-05-31), TestDisk Documentation, CG Security (PDF) <a href="https://www.cgsecurity.org/testdisk_doc/" target="_blank">https://www.cgsecurity.org/testdisk_doc/</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></p></li> <li id="fn:18"><p>Find filesystem parameters to rewrite a valid BIOS parameter block (analogous to "superblocks" in Unix file systems) <a href="/wiki/BIOS_parameter_block" target="_blank">/wiki/BIOS_parameter_block</a> <a href="#fnref:18" class="footnote-back-ref">↩</a></p></li> <li id="fn:19"><p>Restore the BPB using its backup (NTFS, FAT32, exFAT) <a href="#fnref:19" class="footnote-back-ref">↩</a></p></li> <li id="fn:20"><p>Use the two copies of the FAT to rewrite a coherent version <a href="#fnref:20" class="footnote-back-ref">↩</a></p></li> <li id="fn:21"><p>Restore the BPB using its backup (NTFS, FAT32, exFAT) <a href="#fnref:21" class="footnote-back-ref">↩</a></p></li> <li id="fn:22"><p>Find filesystem parameters to rewrite a valid BIOS parameter block (analogous to "superblocks" in Unix file systems) <a href="/wiki/BIOS_parameter_block" target="_blank">/wiki/BIOS_parameter_block</a> <a href="#fnref:22" class="footnote-back-ref">↩</a></p></li> <li id="fn:23"><p>Restore the BPB using its backup (NTFS, FAT32, exFAT) <a href="#fnref:23" class="footnote-back-ref">↩</a></p></li> <li id="fn:24"><p>Restore the Master File Table (MFT) from its backup <a href="#fnref:24" class="footnote-back-ref">↩</a></p></li> <li id="fn:25"><p>Find backup superblock location to assist fsck <a href="/wiki/Fsck" target="_blank">/wiki/Fsck</a> <a href="#fnref:25" class="footnote-back-ref">↩</a></p></li> <li id="fn:26"><p>Restore the BPB using its backup (NTFS, FAT32, exFAT) <a href="#fnref:26" class="footnote-back-ref">↩</a></p></li> <li id="fn:27"><p>RAID 1: mirroring, RAID 4: striped array with parity device, RAID 5: striped array with distributed parity information and RAID 6: striped array with distributed dual redundancy information <a href="#fnref:27" class="footnote-back-ref">↩</a></p></li> </ol>