8. Recovering deleted files using TestDisk

When a file is deleted, the data remains on the disk. Unless new data has overwritten your lost file, TestDisk can usually recover it. It’s possible for

• FAT12/16/32

• exFAT

• NTFS

• ext2

For other filesystems or if sought-after lost files are still missing, give PhotoRec a try. PhotoRec is a signature based file recovery utility and may be able to recover your data where other methods failed.

• Do not further use the media (HDD, USB key, …) on which the data stored have been deleted until data recovery process is completed.

• It is highly recommended that TestDisk or PhotoRec recovers files on another destination media, at minimum on another filesystem.

For maximum security, TestDisk doesn’t try to unerase files but lets you copy the deleted files onto another partition or disk. Remember, you must avoid writing anything on the filesystem that was holding the data. If you do, deleted files may be overwritten by new ones.

• 8.1. TestDisk: undelete file for FAT, exFAT, ext2
  • 8.1.1. Start TestDisk
  • 8.1.2. Log creation
  • 8.1.3. Disk selection
  • 8.1.4. Partition table type selection
  • 8.1.5. Start the undelete process
  • 8.1.6. File undelete
  • 8.1.7. Select where recovered files should be written
  • 8.1.8. File recovery is completed
• 8.2. TestDisk: undelete file for NTFS
  • 8.2.1. Start TestDisk
  • 8.2.2. Log creation
  • 8.2.3. Disk selection
  • 8.2.4. Partition table type selection
  • 8.2.5. Start the undelete process
  • 8.2.6. NTFS file undelete
  • 8.2.7. Select where recovered files should be written
  • 8.2.8. File recovery is completed