Recovering a Disk Partition with TestDisk and GParted Live

on

A friend recently asked me to perform a Windows system recovery on her laptop. The hard disk was split between a C drive for the OS and a D drive with 200GB of data.

I’m an experienced Linux user so I thought, come on, at least give me a challenge! Have you heard people saying be careful what you wish for? Well, 30 seconds into the recovery procedure, I got an obscure Error 333 message and a restart button. Both partitions had been deleted.

The good news was that before I started the system recovery process, we backed up the most important files. But that was just 5GB out of 200GB—the rest was gone. That’s a lot of lost data! Thankfully, I was able to use a cool free program called TestDisk to fully recover everything.

In this tutorial, I will show you how to create a bootable GParted Live USB drive and use TestDisk to recover your partitions.

Note that if you are still able to boot normally to your system and just want to recover your partitions in an external disk, there’s no reason to use GParted Live USB. Just download TestDisk for your platform (it’s free and open-source) and then skip to the Running TestDisk section of this tutorial.

For recovering individual files, instead of whole partitions, you might want to check my tutorial Recover Deleted Files Using the Free Open Source Tool PhotoRec.

Create a GParted Live USB drive

Start by downloading the GParted Live ISO. Choose the latest stable release for your computer architecture. If you are not sure choose amd64.

GParted

To create a bootable USB drive from the ISO image, you can choose any of these methods, or follow my suggestions below.

Windows

If you are on Windows, a good option is the open source tool Rufus. Just plug-in a USB drive, select the GParted ISO you downloaded and your USB drive and then click on Start.

Rufus

Linux

If you are on Ubuntu, you can use USB Creator which should be preinstalled.

USB Creator

If it’s not installed, you can install it manually.

sudo apt install usb-creator-gtk

Other platforms

For other Linux distributions and OSes, you could try UNetbootin.

UNetbootin

Boot into the GParted Live USB

Restart your computer and boot from the USB drive you have created. While GParted Live is booting it will ask you some questions, e.g. keyboard layout, don’t try to be a hero, just accept the defaults by pressing Enter.

When the window manager loads, the first open window is the GParted Partition Editor.

GParted Partition Editor

Try to find the disk drive you want recover by using the drop-down menu on the top-right and keep a note of the device name. I have selected /dev/sdb, which as you can see doesn’t have any valid partitions on it, since I “accidentally” deleted them for this tutorial.

Running TestDisk

Move the GParted Partition Editor window to the side and open a new terminal window, by double-clicking on the little terminal icon on the desktop. Then run TestDisk as root.

sudo -s
testdisk

TestDisk

Follow the steps below to recover your partitions.

  1. Select No Log. TestDisk

  2. Select the disk drive you want to recover, e.g. /dev/sdb. TestDisk

  3. Select your partition table type. Older disks are usually Intel (MBR), while EFI GPT partitions are found on newer systems. If you are not sure, start with Intel, and if your partitions are not found, repeat with EFI GPT. TestDisk

  4. Select Analyse and Quick Search. TestDisk TestDisk

  5. Your drive will be analysed and you will see a list of all found partitions. If you know what you are doing you can edit the list, otherwise just press Enter. TestDisk

  6. On the next screen you have the option to either perform a second Deeper Search, which could take a lot of time, or Write the found partition table to disk. If the quick search was successful choose Write. Be careful at this step because the changes will be permanent. Only choose Write if you recognize your partitions in the list, otherwise choose Quit and repeat. TestDisk

After you’re done, quit TestDisk and rescan your devices in the GParted Partition Editor by clicking GPartedRefresh Devices. Select your drive from the top-right drop-down menu.

GParted Partition Editor

If your deleted partitions were successfully recovered, as in the above screenshot, you can reboot your computer by double clicking on the Exit button.

You can learn more about TestDisk by looking at the official documentation.