TestDisk & PhotoRec: How Do You Use Open-Source Data Recovery?

What Are TestDisk and PhotoRec?

TestDisk and PhotoRec are two free open-source data recovery tools developed and maintained by French developer Christophe Grenier under the GPLv2 license. Both belong to the CGSecurity software package and have been continuously developed since 1998.

Although distributed together, the two tools have fundamentally different purposes:

• TestDisk is a partition recovery tool. It repairs damaged partition tables, recovers deleted partitions, reconstructs boot sectors, and fixes file system errors.
• PhotoRec is a file carving tool. It searches a storage device sector by sector for known file signatures and extracts files directly from raw data, independent of the file system.

Both tools are distinguished by special characteristics:

• No installation required: They can be started directly from a USB stick or live CD
• Cross-platform: Available for Windows, Linux, macOS, and FreeBSD
• Open source: The source code is publicly viewable and verifiable
• Free: No hidden costs, no restrictions, no premium version
• No write access to the source drive: Both tools work in read-only mode (PhotoRec) or write only upon explicit confirmation (TestDisk)

A general assessment of whether free data recovery software is safe can be found at Are Free Data Recovery Programs Safe?.

How Do You Recover Partitions With TestDisk Step by Step?

TestDisk is the right tool when partitions have disappeared, the boot sector is damaged, or the partition table has become faulty. This can happen after accidental formatting, a failed operating system update (e.g., data loss after a Windows update), or a software error.

Preparation

Important: Never run TestDisk on a physically damaged storage device. If your hard drive makes clicking noises or is not detected, contact a professional data recovery service.

1. Download TestDisk from the official website www.cgsecurity.org
2. Extract the archive to a different drive than the affected one
3. On Windows: Start testdisk_win.exe as administrator
4. On Linux: Start testdisk with root privileges (sudo ./testdisk)

Step 1: Select the Drive

After starting, TestDisk displays all detected drives. Select the affected drive. TestDisk shows the capacity and model, which helps with identification.

Select a media (use Arrow keys, then press Enter):
Disk /dev/sda - 500 GB / 465 GiB - Samsung SSD 860
Disk /dev/sdb - 2000 GB / 1863 GiB - WD Elements

Step 2: Choose the Partition Table Type

TestDisk asks for the partition table type:

In most cases, TestDisk automatically detects the correct type.

Step 3: Start the Analysis

Select Analyse and then Quick Search. TestDisk searches the hard drive for partition boundaries by looking for known file system signatures (superblocks, boot sectors, backup superblocks).

If the quick search does not find all partitions, perform a Deeper Search. This searches the entire drive and takes correspondingly longer.

Professional data recovery needed?

Request a data recovery quote now.

Request professional data recoveryProf. data recovery needed?0800/073 88 36

Step 4: Recover Partitions

TestDisk displays the found partitions with color coding:

• Green: Partitions that should be written to the partition table
• Gray: Partitions that will not be recovered (e.g., duplicates)

Check the found partitions using the P key (list files). If the expected files are visible, confirm with Write to update the partition table.

Caution: Writing the partition table is the only moment when TestDisk writes to the drive. Review the selection carefully before confirming.

Additional TestDisk Functions

Beyond partition recovery, TestDisk offers additional useful functions:

• Boot sector repair: Restore damaged NTFS and FAT32 boot sectors from backup copies
• MFT repair: Fix faulty Master File Table (NTFS)
• File copy: Copy files from a damaged partition without restoring the partition itself
• ext2/ext3/ext4 superblock repair: Recovery from backup superblocks

How Does PhotoRec Recover Deleted Files Through File Carving?

PhotoRec is the right tool when individual files have been deleted and need to be recovered. Unlike TestDisk, PhotoRec works independently of the file system and can recover files even when the file system itself is damaged or unknown.

How Does File Carving Work?

File carving is based on a simple principle: every file type has a characteristic signature (magic bytes) at the beginning of the file. A JPEG file, for example, always starts with FF D8 FF, a PDF file with %PDF. PhotoRec searches the drive sector by sector for these signatures and extracts the found files.

PhotoRec recognizes over 480 different file formats, including:

• Images: JPEG, PNG, GIF, TIFF, RAW (CR2, NEF, ARW), BMP, SVG
• Documents: PDF, DOC/DOCX, XLS/XLSX, PPT/PPTX, ODT, RTF
• Multimedia: MP3, MP4, AVI, MKV, MOV, WAV, FLAC
• Archives: ZIP, RAR, 7Z, TAR, GZ
• Databases: SQLite, MySQL, PostgreSQL dumps
• System files: Registry files, event logs, configuration files

Step-by-Step Guide for PhotoRec

Step 1: Start PhotoRec

Start photorec_win.exe (Windows) or photorec (Linux/macOS) with administrator privileges. Select the affected drive.

Step 2: Choose Partition or Entire Drive

You can search a specific partition or the entire drive. For a deleted partition, select "Whole disk"; for deleted files on an intact partition, select the corresponding partition.

Step 3: Specify the File System Type

PhotoRec asks for the file system type:

• ext2/ext3/ext4: For Linux partitions
• Other: For all other file systems (NTFS, FAT, exFAT, HFS+, etc.)

This information helps PhotoRec correctly determine block boundaries.

Step 4: Set the Search Area

• Free space only: Searches only free space (faster, for deleted files)
• Whole partition: Searches the entire partition (slower, but suitable for formatted or damaged partitions). This is also relevant for data recovery after formatting.

Step 5: Choose the Destination Directory

Select a directory on a different drive as the destination for recovered files. PhotoRec automatically creates subdirectories (recup_dir.1, recup_dir.2, etc.) and saves the files there.

Step 6: Start the Scan and Wait

PhotoRec begins the scan and displays progress in real time. Depending on the drive size, the scan can take several hours to days.

Advanced PhotoRec Options

• File format filter: Under "File Opt," you can search specifically for certain file types, which significantly speeds up the scan
• Expert mode: Offers additional options such as manual block size settings and search algorithm selection
• QPhotoRec: A graphical interface for PhotoRec that makes operation easier for less experienced users

Which File Systems Are Supported?

A key advantage of TestDisk and PhotoRec is their broad file system support that extends well beyond Windows:

The particular advantage of PhotoRec: since it works independently of the file system, it can recover files even from unknown or proprietary file systems. This makes it the ideal tool for Linux data recovery as well as for more exotic systems.

Why Are TestDisk and PhotoRec Often the Best Choice?

TestDisk and PhotoRec have some unique advantages over commercial alternatives:

No Installation Required

Both tools can be started directly from a USB stick. This is a decisive advantage since installing data recovery software on the affected drive can overwrite deleted files. Especially in combination with a Linux live USB stick (e.g., Ubuntu, SystemRescue, Knoppix), this is the safest method:

1. Create a Linux live USB (on another computer)
2. Boot from the USB stick
3. TestDisk/PhotoRec are already included in many live distributions
4. The affected drive is not automatically mounted

Fully Open Source

The source code is available on GitHub. There are no hidden tracking mechanisms, no adware, and no restrictions in the free version. Unlike some commercial tools that only find data in the "free" version but do not recover it, TestDisk and PhotoRec have no such limitation.

Cross-Platform

Whether Windows, Linux, macOS, or FreeBSD -- TestDisk and PhotoRec run on all major operating systems. This is particularly relevant when the affected drive uses a file system that is not natively supported on your own system.

Proven and Reliable

With over 25 years of development history, TestDisk and PhotoRec are extremely mature. The tools are used worldwide by data recovery professionals, IT forensic experts, and system administrators. In IT forensics, they are part of the standard toolkit.

When Are TestDisk and PhotoRec Not Enough?

Despite their strengths, there are clear scenarios where TestDisk and PhotoRec reach their limits:

Physical Hard Drive Damage

Like all software tools, TestDisk and PhotoRec cannot recover data from physically damaged storage devices. For a head crash, a dropped hard drive, water damage, or fire damage, professional help with a cleanroom lab is required.

SSD TRIM Limitation

As with Recuva: once the TRIM command has been executed on an SSD, the deleted data is physically destroyed. PhotoRec cannot recover files that have been deleted through TRIM. More on SSD issues at Can a Damaged SSD Be Repaired?.

No RAID Support

TestDisk and PhotoRec cannot directly access RAID arrays. For RAID 5 data recovery, RAID 6 issues, or NAS systems, specialized tools or professional help are required. However, the tools can be used on already reconstructed RAID images.

PhotoRec File Carving Limitations

• File names are lost: PhotoRec names files generically (f0001234.jpg, f0001235.doc). The original file names and folder structure are not restored.
• Fragmented files: Large files that are stored in fragments on the hard drive cannot always be correctly reassembled. Videos and large databases are particularly affected.
• Encrypted files: File carving does not work on encrypted drives since file signatures are not recognizable.

How Do TestDisk and PhotoRec Compare With Commercial Tools?

How do the open-source tools compare with popular commercial alternatives?

For a detailed comparison with Recuva, see Recuva Data Recovery: Guide. For the safety of EaseUS, there is a separate article: Is EaseUS Data Recovery Safe?. An overview of the best USB stick recovery software provides additional comparison options.

What Practical Tips Help Achieve Optimal Results?

The following tips will help you get the most out of TestDisk and PhotoRec:

• Use a Linux live USB: Boot from a Linux live stick. The affected drive will not be automatically mounted, preventing accidental overwrites. Many distributions come with TestDisk/PhotoRec pre-installed.
• Create an image first: Create a sector-by-sector image of the affected drive using ddrescue (Linux). Then work with the image instead of the original. This way, the original is protected even if something goes wrong.
• Try TestDisk before PhotoRec: If the partition is missing, try TestDisk first. A recovered partition is better than file carving because file names and folder structure are preserved.
• Restrict PhotoRec file types: If you are only looking for certain files (e.g., photos), restrict the search to relevant formats under "File Opt." This significantly speeds up the scan.
• Plan enough storage space: PhotoRec needs at least as much free space on the destination drive as the scanned drive is large.
• Be patient: A deep scan of a 2 TB hard drive can take 8 to 12 hours. Do not interrupt the scan.
• QPhotoRec for beginners: If the command line is not your preference, use QPhotoRec -- the graphical interface with identical functionality.
• Review results systematically: PhotoRec creates numerous subdirectories with thousands of files. Use search functions and sorting to find the relevant files.

When Should You Stop and Seek Professional Help?

Stop using TestDisk and PhotoRec immediately and contact a data recovery service if:

• The hard drive makes unusual noises (clicking, grinding, beeping). Information about clicking hard drives can be found in the linked article.
• The storage device is not recognized or reacts suddenly extremely slowly
• It involves a RAID array or a NAS system
• The data is business-critical and no risk can be taken
• TestDisk finds the partitions but the files appear corrupt
• PhotoRec does not find the desired files after the complete scan
• The storage device is an SSD or NVMe SSD and TRIM was active
• It involves encrypted data or a ransomware attack

Principle: TestDisk and PhotoRec are powerful tools for logical data recovery on intact storage devices. For physical damage, complex storage configurations, or business-critical data, engaging a professional data recovery service is the right decision. Information on selecting a reputable provider can be found in the article How to Identify a Trustworthy Data Recovery Service.

Request a data recovery quote