Using Testdisk to recover partitions

Overview

This guide requires the use of a Linux live session, you can read about how to create one here.

Warning: Make a disk image

Attempting data recovery always has a chance to make your situation worse, causing the permanent loss of your data.

For priceless data you should seek professional data recovery services.

Always make a disk image before attempting recovery of data on a disk. You may need to restore this image to the disk between data recovery attempts.

Before attempting data recovery you should evaluate the SMART data for your disk. If it is failing data recovery may stress the disk and cause a complete failure.

This guide was written using a Windows 11 host that has a 128GB C:\ drive and a 256GB D:\ drive called “Game_Data”.

Using Testdisk

  1. From the Live media desktop click the application menu in the top left and open “Terminal Emulator”

    Opening Testdisk from the applications menu

  2. In the terminal type “testdisk” to start the application. Use the arrow keys to select “No Log” and hit Enter.

    Launching Testdisk in terminal

  3. When Testdisk opens you will see a list of disks, most likely you will only see your USB though. Use the arrow keys to highlight and select “Sudo” with Enter to load more disks.

    Selecting Sudo in Testdisk

  4. You should now see all possible disks. You will use the Up and Down arrows to select the disk you want to operate on then hit Enter to Proceed.

    Select your disk based on it’s size. If you have multiple disks of the same size removing the extra disks is the safest way to proceed.

    If you do not see your disk here then you should seek professional data recovery services.

    Complete disk selection in Testdisk

  5. Testdisk will attempt to determine the partition table that is on the disk. If it is correct or if you do not know press Enter to proceed otherwise correct the selection.

    Most modern systems should be using a “EFI GPT” table type

    Partition table selection in Testdisk

  6. Press Enter to Analyze the disk

    Disk analysis confirmation

  7. Press Enter to begin a “Quick Search”.

    You may be told a partitions cannot be recovered. Make note of this and press “Continue”

    Quick scan in Testdisk for partitions

  8. If you are lucky, Testdisk has found a partition. From here you can use “p” to list the files in the partition to confirm it is correct (Hit “q” to exit that view.) Then hit Enter to proceed to the next step.

    Partition discovery Testdisk

    Notes on recovering multiple partitions

    • If multiple partitions are found you can use the arrow keys to move between them. Select the partitions you want to restore with the Space bar. Some of those partitions may be duplicates and some may be labeled “Found using backup sector

    • You may not be able to select all partitions, for instance duplicate partitions will make an error if both are selected.

    • Selected partitions are shown in green.

    Multiple partitions example

  9. At this stage you can press Enter to “Deeper search” if this is not the correct partition or press the Right Arrow and Enter to “Write” the partition(s) to the disk.

    Write or deeper search screen

    An example of multiple partitions being written

    Multiple partitions that can be written

  10. After writing the partition back to the disk you will be brought back to Step 6. You can close the terminal and shutdown your computer. Remove the USB then boot your computer again to validate if partition recovery was a success.

    If you restored an OS disk, it most likely won’t be bootable but it is hopefully readable. You can refer to Recoverying files from a readable disk for the next steps in recovering your data.

After completing a partition or table recovery it is recommended you backup your data and properly reformat the disk. Follow Diskpart clean directions to do that.

Other resources