How to recover lost data using TestDisk

There’s one big event that can trigger an overwhelming sense of dread when you’re installing an OS on a friend or family member’s PC: data loss. It’s bad enough when it happens to your own data, but when it’s someone else’s machine, the feeling can be unbearable.

I know because that’s the situation I found myself in during a recent family reunion in upstate New York. I was attempting to install Ubuntu 16.04 alongside a Windows 7 installation on my mother’s laptop. And not thinking (I shamefully admit), I failed to make a backup of her data before I resized her Windows partition. It wasn’t until I tried to boot back into Windows 7 that realized what I had done.

After a mild panic attack and several assurances to her that I could fix it, I found the program that saved my butt: TestDisk. TestDisk has been around for a while, and was even reviewed by PCWorld in 2011. It works like a charm, but does so without the aid of a flashy GUI. It turns out it’s in the official Ubuntu repositories that ship with Ubuntu 16.04. (It’s also available in the Arch Linux Extra repo.)

TestDisk to the rescue

TestDisk’s website says the program is designed “to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software: certain types of viruses or human error (such as accidentally deleting a Partition Table).” One thing to understand about storage drives is that when you delete a file or partition table, the data is still on the disk. The deletion just removes the pointer to the data, allowing the the OS to write over those blocks. (You can delete the data itself too, but usually this requires deliberate deletion with tools like shred.)

You can use TestDisk as a rescue for Windows or Linux partitions, but you’ll need an Ubuntu live USB drive so you can boot into a separate environment on your PC, and then retrieve the lost files. With Ubuntu running, install TestDisk using the command sudo apt-get install testdisk. You’ll need to run it with administrator privileges: sudo testdisk.

While TestDisk is a console program, its menus and commands are easy to navigate even for people who aren’t command-line wizards.

On the first run, TestDisk will ask if you want to start a new log file. (You probably do.) From there, the program will look for any drives automatically. If no drives are found, you’ll need to specify the block device as an argument to TestDisk, e.g.: sudo testdisk /dev/sda. If you’re unsure about where the drives you’re looking to recover are located, use the command lsblk to get more information.

Once you see the drives, TestDisk will try to automatically detect the partitions, including those that have been deleted. TestDisk will also look for file entries automatically, though damaged or deleted partitions will require a deeper scan. The deeper scan will take some time, since TestDisk will read the entire partition, block by block. Once the scan is done and you see all the files, you can copy the files to backup media (like you, err, I, should

Once your files have been recovered by TestDisk, you can copy them to backup media.

It’s important to note that TestDisk only takes care of software faults in a drive’s data, and will not save you in the event of physical failure. As always, you really should keep a good backup of your data. With a complete and current backup, you’re always free to wipe a drive if anything goes wrong.

How to recover lost data using TestDisk