- 1 I can't start TestDisk
- 2 How to use TestDisk ?
- 3 How to use TestDisk in a script ?
- 4 Can I use TestDisk with disk image ?
- 5 What to do if the hard disk contains bad sectors ?
- 6 A wrong capacity for my hard disk is reported
- 7 Where are the files I have undeleted/copied?
- 8 I can't move, delete, rename the recovered files !
- 9 How to open the image.dd file ?
- 10 Mac OS X PowerPC: Writing the partition table
- 11 How to check and repair a filesystem
- 12 How to make the system bootable again
- 13 How to undelete files
I can't start TestDisk
cygwin1.dll not found,
c\cygwin is missing
How to use TestDisk ?
Read the TestDisk Step By Step guide.
How to use TestDisk in a script ?
TestDisk usage can be automated. The action need to be described with some specific parameters and the resulting command line can be added to a Unix shell script or Windows batch file. Read Scripted run.
Can I use TestDisk with disk image ?
TestDisk can work with disk images including forensics images created by EnCase and FTK imager.
What to do if the hard disk contains bad sectors ?
If your goal is to recover some precious files and you know where they are, in the advanced menu of TestDisk, select your partition, try to list the content of the filesystem and copy your files. If it doesn't work or if the hard disk is seriously damaged, it's usually better to clone the hard disk first.
A wrong capacity for my hard disk is reported
- If your HD is reported as 137GB only, you need to enable LBA-48 access mode.
- If the size is incorrectly reported as 2TB, connect the hard disk directly in SATA or PATA instead of USB. If the problem persists, the PCB may have suffer from an electronic choc.
Where are the files I have undeleted/copied?
By default, TestDisk copies the files in the current folder.
By example, look at
testdisk-6.11.3/win/ on a Windows computer or
If you have run TestDisk from a temporary folder, ie.
c:\Users\bob\appdata\local\temp\Rar$EX00.034\testdisk created by WinRar, the archiver may have deleted the folder including the recovered files when you have closed TestDisk. You need to extract all the files from the archive before running TestDisk.
I can't move, delete, rename the recovered files !
- You may need to take ownership of the folders: http://support.microsoft.com/kb/308421
- Change the owner of the files, example
sudo chown -R username recup_dir.*
How to open the image.dd file ?
An image is interesting if the original disk has physical problem (ie. bad sectors) or if you really need a copy.
mount -o loop,ro image.dd directory
- rename image.dd to image.img or image.dmg and double-click on the file
- Specify the image pathname in parameter to run TestDisk or PhotoRec on the disk image.
See Image Creation for more information
Mac OS X PowerPC: Writing the partition table
Use pdisk to recreate the Mac partition map using the values given by TestDisk.
How to check and repair a filesystem
- To check a FAT partition from Windows, run chkdsk /f c:
fsck.vfat -a devicename
- To check an NTFS partition from Windows, run chkdsk /f c:
- If the superblock of a reiserfs partition is missing, it can be rebuilt with reiserfsck --rebuild-sb device.
How to make the system bootable again
- DOS - Win9x: If your OS doesn't boot, you can reinstall the system files with
- Windows 2000/XP/2003/...
- Run fixmbr from the Recovery Console (ie. fixmbr \Device\HardDisk0)
- Check c:\boot.ini
- Run fixboot to repair NTFS boot sector.
- Remember to update your /etc/fstab to reflect the new partition order.
- Update your multiboot configuration and reinstall the multiboot in the Master Boot Record.
- Lilo: /etc/lilo.conf,
- Grub: /boot/grub/grub.conf,
- Lilo: /etc/lilo.conf,
How to undelete files
- Recover deleted files from NTFS partition
- Undelete files and directories from FAT12, FAT16 and FAT32 filesystem. FAT file systems are commonly found on flash memory cards, digital cameras, and many other portable devices.
- Undelete files from ext2 filesystem
- ReiserFS: Read the ReiserFS file undelete HOWTO
If the system is too badly damaged to be repaired or to allow file undeletion, try PhotoRec.