testdisk

TestDisk & PhotoRec

TestDisk & PhotoRec are free and open-source data recovery utilities. They can be downloaded from https://www.cgsecurity.org/.

TestDisk can be used to recover lost partitions, fix boot sectors, and recover files from damaged or deleted file systems. It is mainly used to recover data from hard drives, but it can also work with other storage devices such as USB drives and memory cards. It supports a wide variety of file systems, including NTFS, exFAT, FAT, ext2, ext3, and ext4.

PhotoRec is designed to recover lost files, including photos, videos, and music files, from various types of storage devices. It can recover files from hard drives, memory cards, and USB drives, and it can also recover files from digital cameras and other portable devices.

• 1. Presentation
  • 1.1. TestDisk - Partition recovery
  • 1.2. TestDisk - Filesystem repair
  • 1.3. TestDisk - File recovery
  • 1.4. PhotoRec - File recovery
  • 1.5. QPhotoRec - File recovery
• 2. Installation
  • 2.1. Linux: Installation of distribution package
  • 2.2. macOS: Installation via Homebrew
  • 2.3. Official binaries
• 3. Building from source
  • 3.1. Compilation environment
  • 3.2. Cross Compilation environment
  • 3.3. Compilation
• 4. Creating a live USB
  • 4.1. Windows
  • 4.2. Linux (command line)
  • 4.3. Linux (GNOME)
  • 4.4. OS X
  • 4.5. Starting from the USB stick
• 5. Storage: can I repair it or recover data from it ?
• 6. Starting the tools
  • 6.1. Disk image
  • 6.2. Running TestDisk, PhotoRec or QPhotoRec under Windows
  • 6.3. Running TestDisk, PhotoRec under Linux
  • 6.4. Running QPhotoRec under Linux X.org X11
  • 6.5. Running QPhotoRec under Linux Wayland
  • 6.6. Running TestDisk, PhotoRec under macOS
  • 6.7. Running Fidentify under Windows
  • 6.8. Running Fidentify under Linux or macOS
• 7. Repairing filesystem
  • 7.1. Repairing filesystems from Windows
  • 7.2. Repairing filesystems from Linux
  • 7.3. Repairing filesystems from macOS
  • 7.4. Repairing FAT32, exFAT and NTFS boot sector using TestDisk
  • 7.5. TestDisk: Repairing FAT boot sector
  • 7.6. TestDisk: Repairing NTFS boot sector
  • 7.7. TestDisk: repairing ext2/3/4 filesystem superblock
  • 7.8. Repairing HFS/HFS+ volume header using TestDisk
  • 7.9. Repairing BitLocker volume
• 8. Recovering deleted files using TestDisk
  • 8.1. TestDisk: undelete file for FAT, exFAT, ext2
  • 8.2. TestDisk: undelete file for NTFS
• 9. Recovering deleted partition using TestDisk
  • 9.1. Start testdisk
  • 9.2. Log creation
  • 9.3. Disk selection
  • 9.4. Partition table type selection
  • 9.5. Analyze current partition table
  • 9.6. Quick Search for partitions
  • 9.7. Search for more partitions
  • 9.8. Partitions selection
• 10. How to make the system bootable again
  • 10.1. DOS - Window 95/98
  • 10.2. Windows 2000/XP/2003
  • 10.3. Windows Vista/Windows 7/…, Windows Server 2008/…
  • 10.4. Linux/FreeBSD
• 11. Recovering deleted files using PhotoRec
  • 11.1. Start PhotoRec
  • 11.2. Disk selection
  • 11.3. Source partition selection
  • 11.4. PhotoRec options
  • 11.5. Selection of files to recover
  • 11.6. File system type
  • 11.7. Carve the partition or unallocated space only
  • 11.8. Select where recovered files should be written
  • 11.9. Recovery in progress
  • 11.10. Recovery is completed
  • 11.11. PhotoRec: file name and date
  • 11.12. PhotoRec: matching filename and data location
• 12. Creating custom signature for PhotoRec
  • 12.1. Signature Syntax
  • 12.2. File location
  • 12.3. Check your custom signature with fidentify
  • 12.4. Run PhotoRec
  • 12.5. Improved file recover
• 13. Recovering lost videos from a memory card using PhotoRec
• 14. After using PhotoRec
  • 14.1. Sorting the files by extension
  • 14.2. Renaming files using exiftool
  • 14.3. Removing duplicated files
• 15. SMART status - Disk health monitoring
• 16. DDRescue: data recovery from damaged disk
  • 16.1. ddrescue on Linux
  • 16.2. ddrescue on macOS
  • 16.3. DDRescue: disk to file image
  • 16.4. DDRescue: disk to disk copy
  • 16.5. ddrutility: restricting ddrescue to NTFS allocated data block
• 17. Scripted run
  • 17.1. Automating recovery using TestDisk
  • 17.2. Automating recovery using PhotoRec
  • 17.3. Windows UAC
• 18. TestDisk and PhotoRec in various digital forensics test cases
  • 18.1. DFTT: Undelete files from a FAT16 filesystem
  • 18.2. DFTT: Undelete files from a NTFS filesystem
  • 18.3. DFRWS 2006 Forensics Challenge
  • 18.4. Forensics: write blockers
• 19. Linux / macos / BSD command line
  • 19.1. Starting a terminal
  • 19.2. Users
  • 19.3. Filesystem
  • 19.4. Commands