🌳 Recovering lost files with TestDisk and PhotoRec

A personal note first: TestDisk & PhotoRec recovered my main HDD. This is the OG open-source recovery software — by Christophe Grenier / CGSecurity. Shout-out to the team, and thank you. This is the manual I wish I’d had that night: a practical guide to recovering lost partitions (TestDisk) and deleted/lost files (PhotoRec).

1. What each tool does

Tool	Purpose
TestDisk	Repairs partition tables, recovers deleted/lost partitions, fixes boot sectors, and can undelete files by name on FAT/NTFS/exFAT (it reads the filesystem’s own directory structure).
PhotoRec	Ignores the filesystem entirely and scans raw disk sectors for known file signatures (headers/footers), “carving out” files. Works even on badly corrupted, reformatted, or unknown filesystems. Recovered files lose their original names and folder structure.

Rule of thumb: try TestDisk’s Undelete first (fast, keeps filenames). If that doesn’t find your file — or the filesystem itself is damaged/reformatted — use PhotoRec (slower, thorough, generic filenames).

2. Before you start — critical safety rules

• Stop using the affected drive immediately. Every write risks overwriting the very data you want back.
• Never run these tools from the drive you’re recovering. Run them from your system drive or a USB stick.
• Never save recovered files back onto the source drive. Always recover to a different physical disk.
• Run as Administrator (Windows) / with sudo (Linux/macOS) — otherwise the tools often can’t access raw disks.
• If the data is irreplaceable, image the whole disk first (Section 6) and experiment on the copy, not the original.

3. Download & setup

Downloads: cgsecurity.org/wiki/TestDisk_Download

3.1 Windows

1. Download the Windows .zip (e.g. testdisk-7.x-WIP.win64.zip).
2. Extract to a folder on your system drive (e.g. C:\Recovery\testdisk) — not the drive you’re recovering.
3. Inside you’ll find:
   • testdisk_win.exe — TestDisk (console)
   • photorec_win.exe — PhotoRec (console)
   • qphotorec_win.exe — PhotoRec with a simple GUI (easier for beginners)

3.2 Linux

# Debian/Ubuntu
sudo apt update && sudo apt install testdisk
# Fedora
sudo dnf install testdisk
# Arch
sudo pacman -S testdisk

Then run with root: sudo testdisk / sudo photorec. Identify your drive first — disks are /dev/sdX or /dev/nvmeXnY, not letters:

lsblk
# or
sudo fdisk -l

Triple-check the device before proceeding — targeting the wrong disk is dangerous. Never point these at your OS drive by mistake.

3.3 macOS

brew install testdisk   # installs both testdisk and photorec

Run with sudo testdisk / sudo photorec. Identify your drive with diskutil list (look for your external by size/name, e.g. /dev/disk4). If it’s mounted, it’s often safer to unmount the volume first (keeps the raw device accessible):

diskutil unmountDisk /dev/disk4

4. Using TestDisk

The console UI is identical across Windows, Linux, and macOS — only disk naming differs. It’s keyboard-only: arrows move, Enter selects, q goes back; on-screen hints show the current keys.

4.1 Recovering a lost/deleted partition

1. Create / No Log → choose No Log.
2. Select the disk — check the size to pick the right physical disk.
3. Partition table type — usually auto-detected (Intel/MBR or EFI GPT); accept it.
4. Analyse — reads the current structure.
5. Quick Search — finds identifiable partitions; lost ones often appear in a different color/status.
6. If not found, run Deeper Search (slower).
7. Select the correct partition and mark it (P = Primary, etc.).
8. Write — commits the partition table. Only once you’re confident — this modifies the disk.

4.2 Undeleting files (partition intact)

1. Launch as admin/root; select disk → partition type → Analyse.
2. Highlight the partition → Advanced → Undelete.
3. Deleted files appear in a different color (often red) with their original names.
4. Select with : or space, press c to copy.
5. Choose a destination on a different drive. Files copy with names intact.

Limitation: this only works if the file’s directory entry hasn’t been overwritten. If it’s not listed, move to PhotoRec.

5. Using PhotoRec

Console version (most control, identical across OSes). Windows: run photorec_win.exe as admin. Linux/macOS: sudo photorec.

1. Select the disk — double-check size/model.
2. Select the partition (if several).
3. Filesystem type — [ ext2/ext3/ext4 ] for Linux FS; [ Other ] for FAT/exFAT/NTFS/HFS+ (Windows/Mac drives).
4. Scan mode:
   • Free — only unallocated space. Faster. Right for a simple deletion.
   • Whole — every sector. Slower, but needed if the drive was reformatted, the partition table was damaged, or Free found nothing.
5. Restrict file types (recommended): choose File Opt → s to deselect all → Enter/Space on just what you need (e.g. mp4, mov, mkv) → b to save. Saves destination space and cleanup time.
6. Destination → choose Search, navigate, press C to select the current folder — on a different physical drive.
7. Scan runs — live progress; minutes to hours depending on size and interface (USB 3.0 ≫ 2.0).
8. Pause/Resume — it writes progress to the destination and can resume. If the destination fills up, free space and resume.

After the scan

• Files land in recup_dir.1, recup_dir.2, … with generic names (f0000123.mp4).
• Sort by file size (match what you remember), date modified, and by opening in VLC — it previews partial/corrupt recoveries better than most players.

6. Optional: image the disk first (extra safety)

If the data is critical, make a raw image and scan that instead of the live drive:

• Use TestDisk’s imaging option, or dd / Win32 Disk Imager, to write a .img/.dd copy to a large-enough drive.
• Run PhotoRec/TestDisk against the image — re-run as many times as needed with zero further risk to the original.
• Needs destination space ≥ the whole source disk (unlike normal recovery, which only needs room for recovered files).

7. Quick troubleshooting

Problem	Fix
Tool can’t see the disk	Run as admin/root; check the connection/power
Destination fills mid-scan	Free space or move files, then resume
Recovered file won’t play	Try VLC; try Whole mode; try other files of similar size
Undelete doesn’t list the file	Directory entry overwritten — use PhotoRec
Scan is very slow	Normal for large USB drives; limited by drive/interface

8. Summary workflow

Deleted a file?
 └─ TestDisk → Advanced → Undelete   (fast, keeps filename)
      ├─ Found → copy to another drive → done
      └─ Not found → PhotoRec
           └─ Free mode + restrict file type → Search
                └─ Recovered → preview in VLC → identify & rename

Related

• Tools