SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>TestDisk</title>

</head>

<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">TestDisk</span></span>

</h1>

</header>

/* start https://en.wikipedia.org/ */

.mw-parser-output .infobox-subbox{padding:0;border:none;margin:-3px;width:auto;min-width:100%;font-size:100%;clear:none;float:none;background-color:transparent}.mw-parser-output .infobox-3cols-child{margin:auto}.mw-parser-output .infobox .navbar{font-size:100%}@media screen{html.skin-theme-clientpref-night .mw-parser-output .infobox-full-data:not(.notheme)>div:not(.notheme)[style]{background:#1f1f23!important;color:#f8f9fa}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .infobox-full-data:not(.notheme)>div:not(.notheme)[style]{background:#1f1f23!important;color:#f8f9fa}}@media(min-width:640px){body.skin--responsive .mw-parser-output .infobox-table{display:table!important}body.skin--responsive .mw-parser-output .infobox-table>caption{display:table-caption!important}body.skin--responsive .mw-parser-output .infobox-table>tbody{display:table-row-group}body.skin--responsive .mw-parser-output .infobox-table th,body.skin--responsive .mw-parser-output .infobox-table td{padding-left:inherit;padding-right:inherit}}

/* end https://en.wikipedia.org/ */

</style><table class="infobox vevent"><tbody><tr><td colspan="2" class="infobox-image logo"></td></tr><tr><td colspan="2" class="infobox-image logo"></td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;"><a href="Programmer" title="Programmer">Developer(s)</a></th><td class="infobox-data">Christophe Grenier</td></tr><tr style="display: none;"><td colspan="2" class="infobox-full-data"></td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;"><a href="Software_release_life_cycle" title="Software release life cycle">Stable release</a></th><td class="infobox-data"><div style="margin:0px;">7.2

/ February 22, 2024<span style="display: none;"> (<span class="bday dtstart published updated itvstart">2024-02-22</span>)</span></div></td></tr><tr style="display:none"><td colspan="2">

</td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;"><a href="Repository_(version_control)" title="Repository (version control)">Repository</a></th><td class="infobox-data"><style data-mw-deduplicate="TemplateStyles:r1126788409">

/* start https://en.wikipedia.org/ */

.mw-parser-output .plainlist ol,.mw-parser-output .plainlist ul{line-height:inherit;list-style:none;margin:0;padding:0}.mw-parser-output .plainlist ol li,.mw-parser-output .plainlist ul li{margin-bottom:0}

/* end https://en.wikipedia.org/ */

</style><div class="plainlist"><ul><li><span class="url"><a rel="nofollow" class="external text" href="https://git.cgsecurity.org/cgit/testdisk/">git<wbr>.cgsecurity<wbr>.org<wbr>/cgit<wbr>/testdisk<wbr>/</a></span> </li></ul>

</div></td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;">Written in</th><td class="infobox-data"><a href="C_(programming_language)" title="C (programming language)">C</a></td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;"><a href="Software_categories#Categorization_approaches" title="Software categories">Type</a></th><td class="infobox-data"><a href="Data_recovery" title="Data recovery">Data recovery</a></td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;"><a href="Software_license" title="Software license">License</a></th><td class="infobox-data"><a href="GNU_General_Public_License" title="GNU General Public License">GPL</a></td></tr><tr><th scope="row" class="infobox-label" style="white-space: nowrap;">Website</th><td class="infobox-data"><span class="url"><a rel="nofollow" class="external text" href="https://www.cgsecurity.org/wiki/TestDisk">www<wbr>.cgsecurity<wbr>.org<wbr>/wiki<wbr>/TestDisk</a></span></td></tr></tbody></table>

<p><b>TestDisk</b> is a <a href="Free_and_open-source" class="mw-redirect" title="Free and open-source">free and open-source</a> <a href="Data_recovery" title="Data recovery">data recovery</a> utility that helps users recover lost <a href="Partition_(computing)" class="mw-redirect" title="Partition (computing)">partitions</a> or repair corrupted filesystems.<sup id="cite_ref-1" class="reference"><a href="#cite_note-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup> TestDisk can collect detailed information about a corrupted drive, which can then be sent to a technician for further analysis. TestDisk supports <a href="DOS" title="DOS">DOS</a>, <a href="Microsoft_Windows" title="Microsoft Windows">Microsoft Windows</a> (i.e. <a href="Windows_NT_4.0" title="Windows NT 4.0">NT 4.0</a>, <a href="Windows_2000" title="Windows 2000">2000</a>, <a href="Windows_XP" title="Windows XP">XP</a>, <a href="Windows_Server_2003" title="Windows Server 2003">Server 2003</a>, <a href="Windows_Server_2008" title="Windows Server 2008">Server 2008</a>, <a href="Windows_Vista" title="Windows Vista">Vista</a>, <a href="Windows_7" title="Windows 7">Windows 7</a>, <a href="Windows_8.1" title="Windows 8.1">Windows 8.1</a>, <a href="Windows_10" title="Windows 10">Windows 10</a>), <a href="Linux" title="Linux">Linux</a>, <a href="FreeBSD" title="FreeBSD">FreeBSD</a>, <a href="NetBSD" title="NetBSD">NetBSD</a>, <a href="OpenBSD" title="OpenBSD">OpenBSD</a>, <a href="SunOS" title="SunOS">SunOS</a>, and <a href="MacOS" title="MacOS">MacOS</a>. TestDisk handles non-partitioned and partitioned media.<sup id="cite_ref-grenier2021_2-0" class="reference"><a href="#cite_note-grenier2021-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup> In particular, it recognizes the <a href="GUID_Partition_Table" title="GUID Partition Table">GUID Partition Table</a> (GPT), <a href="Apple_partition_map" class="mw-redirect" title="Apple partition map">Apple partition map</a>, PC/Intel BIOS partition tables, Sun <a href="Solaris_(operating_system)" class="mw-redirect" title="Solaris (operating system)">Solaris</a> <a href="Slice_(disk)" class="mw-redirect" title="Slice (disk)">slice</a> and <a href="Xbox_(console)" title="Xbox (console)">Xbox</a> fixed partitioning scheme. TestDisk uses a <a href="Command-line_interface" title="Command-line interface">command line user interface</a>. TestDisk can recover deleted files with 97% accuracy.<sup id="cite_ref-:0_3-0" class="reference"><a href="#cite_note-:0-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="Features">Features</h2></div>

<p>TestDisk can recover deleted partitions, rebuild partition tables or rewrite the <a href="Master_boot_record" title="Master boot record">master boot record</a> (MBR).<sup id="cite_ref-4" class="reference"><a href="#cite_note-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-:0_3-1" class="reference"><a href="#cite_note-:0-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading3"><h3 id="Partition_recovery">Partition recovery</h3></div>

<p>TestDisk retrieves the <a href="Logical_block_addressing" title="Logical block addressing">LBA</a> size and <a href="Cylinder-head-sector" title="Cylinder-head-sector">CHS</a> geometry of attached <a href="Data_storage_device" class="mw-redirect" title="Data storage device">data storage devices</a> (i.e. <a href="Hard_disk" class="mw-redirect" title="Hard disk">hard disks</a>, <a href="Memory_card" title="Memory card">memory cards</a>, <a href="USB_flash_drive" title="USB flash drive">USB flash drives</a>, and <a href="Virtual_disk" class="mw-redirect" title="Virtual disk">virtual disk</a> images) from the <a href="BIOS" title="BIOS">BIOS</a> or the <a href="Operating_system" title="Operating system">operating system</a>. The geometry information is required for a successful recovery. TestDisk reads sectors on the storage device to determine if the partition table or filesystem on it requires repair (see next section).

</p><p>TestDisk is able to recognize the following partition table formats:<sup id="cite_ref-grenier2021_2-1" class="reference"><a href="#cite_note-grenier2021-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup>

</p>

<ul><li>Apple partition map</li>

<li>GUID Partition Table</li>

<li>Humax</li>

<li>PC/Intel Partition Table (master boot record)</li>

<li>Sun Solaris slice</li>

<li>Xbox fixed partitioning scheme</li>

<li>Non-partitioned media</li></ul>

<p>TestDisk can perform deeper checks to locate partitions that have been deleted from the partition table.<sup id="cite_ref-grenier2021_2-2" class="reference"><a href="#cite_note-grenier2021-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup> However, it is up to the user to look over the list of possible partitions found by TestDisk and to select those that they wish to recover.

</p><p>After partitions are located, TestDisk can rebuild the partition table and rewrite the MBR.<sup id="cite_ref-grenier2021_2-3" class="reference"><a href="#cite_note-grenier2021-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading3"><h3 id="Filesystem_repair">Filesystem repair</h3></div>

<p>TestDisk can deal with some specific logical filesystem corruption.<sup id="cite_ref-5" class="reference"><a href="#cite_note-5"><span class="cite-bracket">[</span>5<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading3"><h3 id="File_recovery">File recovery</h3></div>

<p>When a file is deleted, the list of disk clusters occupied by the file is erased, marking those sectors available for use by other files created or modified thereafter. TestDisk can recover deleted files especially if the file was not fragmented and the clusters have not been reused.

</p><p>There are two file recovery mechanisms in the TestDisk package:<sup id="cite_ref-grenier2021_2-4" class="reference"><a href="#cite_note-grenier2021-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup>

</p>

<ul><li>TestDisk proper uses knowledge of the filesystem structure to perform "undelete".</li>

<li><a href="PhotoRec" title="PhotoRec">PhotoRec</a> is a "file carver". It does not need any knowledge of the file system, but instead looks for patterns of known file formats in the partition or disk image. It works best on unfragmented files and cannot recover the file name.</li></ul>

<div class="mw-heading mw-heading2"><h2 id="Digital_forensics">Digital forensics</h2></div>

<p>TestDisk can be used in <a href="Digital_forensics" title="Digital forensics">digital forensics</a> to retrieve partitions that were deleted long ago.<sup id="cite_ref-:0_3-2" class="reference"><a href="#cite_note-:0-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup> It can mount various types of disk images including the <a href="EnCase#Expert_Witness_File_Format" title="EnCase">Expert Witness File Format</a> used by <a href="EnCase" title="EnCase">EnCase</a>.<sup id="cite_ref-grenier2021_2-5" class="reference"><a href="#cite_note-grenier2021-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup><sup id="cite_ref-altheide2011_6-0" class="reference"><a href="#cite_note-altheide2011-6"><span class="cite-bracket">[</span>6<span class="cite-bracket">]</span></a></sup> Binary <a href="Disk_image" title="Disk image">disk images</a>, such as those created with <a href="Ddrescue" title="Ddrescue">ddrescue</a>, can be read by TestDisk as though they were storage devices.<sup id="cite_ref-nemeth2015_7-0" class="reference"><a href="#cite_note-nemeth2015-7"><span class="cite-bracket">[</span>7<span class="cite-bracket">]</span></a></sup>

</p><p>In TestDisk versions prior to version 7, a malformed disk or its image can be used to inject malicious code into a running TestDisk application on <a href="Cygwin" title="Cygwin">Cygwin</a>.<sup id="cite_ref-nemeth2015_7-1" class="reference"><a href="#cite_note-nemeth2015-7"><span class="cite-bracket">[</span>7<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="File_system_support">File system support</h2></div>

<p>File system support for TestDisk is shown in the table:

</p>

</th>

<th scope="col">Partition Recovery

</th>

<th colspan="2" scope="col">Filesystem Recovery

</th>

<th scope="col">File Recovery

</th></tr>

<tr>

<th scope="col">Find filesystem

</th>

<th scope="col">Boot sector/<br>superblock Restore

</th>

<th scope="col">File table repair

</th>

<th scope="col">Undelete<sup id="cite_ref-grenier2021_2-7" class="reference"><a href="#cite_note-grenier2021-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup>

</th></tr>

<tr>

</th>

<td style="background:#9EFF9E;color:black;vertical-align:middle;text-align:center;" class="table-yes">Yes

</td></tr>

<tr>

<th scope="row"><a href="ExFAT" title="ExFAT">exFAT</a>

</th>

<td style="background:#9EFF9E;color:black;vertical-align:middle;text-align:center;" class="table-yes">Yes

</td></tr>

<tr>

</th>

<td style="background:#9EFF9E;color:black;vertical-align:middle;text-align:center;" class="table-yes">Yes

</td></tr>

<tr>

</th>

<td style="background:#9EFF9E;color:black;vertical-align:middle;text-align:center;" class="table-yes">Yes

</td></tr>

<tr>

<th scope="row">HFS, <a href="HFS%2B" class="mw-redirect" title="HFS+">HFS+</a>, HFSX

</th>