📝 Introduction

TestDisk is a free, open-source recovery tool that can restore lost partitions and recover deleted files from many filesystems. It runs in a terminal/console but is simple enough for beginners if you follow the steps carefully.

⚠️ Safety first (read this!)

  • Stop using the affected drive immediately. New data can overwrite your deleted files.
  • Recover to a different drive. Always copy recovered files to another disk/USB—not the source.
  • If the drive is failing: Consider imaging it first (optional, advanced). Example (Linux):
# Install GNU ddrescue (Debian/Ubuntu)
sudo apt update && sudo apt install gddrescue

# Make a raw image of /dev/sdX to an external disk (replace X and paths)
sudo ddrescue -f -n /dev/sdX /media/$USER/EXTERNAL/disk.img /media/$USER/EXTERNAL/disk.log
Note: If this looks too advanced, skip imaging and proceed—just don’t write anything to the source drive.

💻 Install TestDisk

Windows

  1. Download TestDisk from the official website (cgsecurity.org).
  2. Extract the ZIP file.
  3. Open the extracted folder and run testdisk_win.exe.

macOS

  1. Install via Homebrew:
brew install testdisk
  1. Run TestDisk from Terminal:
sudo testdisk

Linux (Debian/Ubuntu/Mint)

sudo apt update
sudo apt install testdisk
sudo testdisk

Linux (Fedora)

sudo dnf install testdisk
sudo testdisk

Linux (Arch/Manjaro)

sudo pacman -S testdisk
sudo testdisk

🚀 Basic recovery workflow

These are the beginner-friendly steps to attempt file recovery with TestDisk.

  1. Start TestDisk with admin rights (needed to access disks): 
    sudo testdisk
  2. Create a log when prompted (press Enter to accept Create).
  3. Select the affected disk (use arrow keys) → press Enter.
  4. Partition table type: usually auto-detected (press Enter to accept).
  5. Select Analyse → press Enter.
  6. Choose Quick Search. If your partition is found, highlight it and press p to List files.
    • Use arrow keys to navigate folders.
    • Select files/folders to copy, then press C (uppercase C) to copy.
    • Select a different destination drive/folder and confirm.
  7. If not found, choose Deeper Search and repeat the step above.
  8. Press Q to go back/exit when finished.
Tip: Always copy recovered files to an external drive or a different internal disk.

🧭 Undelete by filesystem (NTFS, FAT/exFAT, ext2/3/4)

TestDisk can undelete files directly from certain filesystems without scanning entire partitions.

NTFS (Windows disks)

  1. Start TestDisk → select disk → confirm partition table.
  2. Select Advanced → choose the NTFS partition → press Enter.
  3. Select Undelete → navigate with arrow keys.
  4. Deleted files show in red or marked as deleted. Highlight them and press C to copy.
  5. Choose a different destination and confirm.

FAT/exFAT (USB sticks, SD cards)

  1. Advanced → pick the FAT/exFAT partition → Undelete.
  2. Select files/folders → press C to copy → choose destination.

ext2/3/4 (Linux)

  1. Advanced → pick the ext partition → Undelete.
  2. Select files/folders → press C to copy → choose destination.

Helpful Linux commands

Mount an external drive as recovery destination:

# See disks and partitions
lsblk

# Create a mount point and mount (replace sdb1 and the path)
sudo mkdir -p /mnt/recovery
sudo mount /dev/sdb1 /mnt/recovery

# Use /mnt/recovery as the copy destination inside TestDisk

🧪 Alternative: PhotoRec (file carver)

PhotoRec is included with TestDisk and recovers files by their signatures (useful when the filesystem is badly damaged). It ignores filenames and folder structure but can salvage many file types.

  1. Run PhotoRec:
sudo photorec
  1. Select the affected disk → choose a partition (or Whole disk).
  2. Choose filesystem type when asked (Other for FAT/NTFS/exFAT, ext2/ext3/ext4 for Linux).
  3. Select Free (faster; searches unallocated space) or Whole (slower; deeper).
  4. Pick a different destination drive/folder for recovered files → confirm to start.
Note: After recovery, sort files by type/date; PhotoRec may assign generic names.

🛠 Troubleshooting

Drive doesn’t appear in TestDisk
→ On Linux/macOS, run with sudo. On Windows, run as Administrator. Check cables/ports; for USB drives, try another port.

“Permission denied” when choosing destination
→ Pick a folder you own (e.g., your home) or ensure the destination is mounted with write access.

Recovered files are corrupted
→ They may have been partially overwritten. Try Deeper Search or use PhotoRec. If the disk is failing, image it first with ddrescue.

Not enough space on destination
→ Free space or connect a larger external drive before copying.

📚 Resources & Further Reading

  • Official TestDisk & PhotoRec site (downloads, docs): cgsecurity.org
  • TestDisk: “Step By Step” guide (official wiki)
  • PhotoRec: File recovery examples (official wiki)

License: TestDisk & PhotoRec are free and open-source.