Digital Forensics

testdisk

testdisk recovers what looks lost. Its main job is repairing partition tables and bringing back partitions that were deleted or corrupted — the kind of damage that makes a whole drive look empty. It ships alongside PhotoRec, a file-recovery tool that ignores the filesystem entirely and carves files straight out of the raw media by their signatures, which means it recovers data even when the filesystem is destroyed. Together they cover both “the drive’s structure is broken” and “the files are gone but the bytes are still there.” Both run as guided text-mode programs.

Official-repo package; Security → Digital Forensics → testdisk. It provides testdisk (partition recovery), photorec (file carving), and fidentify (file-type identification).

The help it prints

TESTDISK(8)                   Administration Tools                  TESTDISK(8)

NAME
     testdisk - Scan and repair disk partitions

SYNOPSIS
     testdisk [/log] [/debug] [/dump] [device|image.dd|image.e01]

     testdisk /version

     testdisk /list [/log]

DESCRIPTION
        TestDisk checks and recovers lost partitions
        It works with :
        - BeFS (BeOS)
        - BSD disklabel (FreeBSD/OpenBSD/NetBSD)
        - CramFS, Compressed File System
        - DOS/Windows FAT12, FAT16 and FAT32
        - HFS and HFS+, Hierarchical File System
        - JFS, IBM's Journaled File System
        - Linux ext2/ext3/ext4
        - Linux Raid
          RAID 1: mirroring
          RAID 4: striped array with parity device
          RAID 5: striped array with distributed parity information
          RAID 6: striped array with distributed dual redundancy information
        - Linux Swap (versions 1 and 2)
        - LVM and LVM2, Linux Logical Volume Manager
        - Mac partition map
        - Novell Storage Services NSS
        - NTFS (Windows NT/2K/XP/2003/Vista/...)
        - ReiserFS 3.5, 3.6 and 4
        - Sun Solaris i386 disklabel
        - Unix File System UFS and UFS2 (Sun/BSD/...)
        - XFS, SGI's Journaled File System

        It can undelete files from
        - DOS/Windows FAT12, FAT16 and FAT32
        - Linux ext2
        - NTFS (Windows NT/2K/XP/2003/Vista/...)

        For  more  information  on  how  to use, please visit the wiki pages on
     www.cgsecurity.org

OPTIONS
     /log   create a testdisk.log file

     /debug
            add debug information

     /dump  dump raw sectors

     /list  display current partitions

SEE ALSO
     fdisk(8), photorec(8).

AUTHOR
     TestDisk 7.2, Data Recovery Utility, February 2024
     Christophe GRENIER <grenier@cgsecurity.org>
     https://www.cgsecurity.org

2024                                February                        TESTDISK(8)

Using it

# Partition recovery — launches the guided text interface
sudo testdisk

# Or point it straight at an image
sudo testdisk disk.img

# File carving with PhotoRec (recovers by signature, filesystem-agnostic)
sudo photorec disk.img

Both walk you through menus: pick the disk/image, the partition table type, and what to search for. PhotoRec asks where to write recovered files — always choose a different drive than the one you’re recovering from, so you don’t overwrite the data you’re trying to save. For signature-based carving from a fixed image, foremost is a scriptable alternative.