TestDisk

TestDisk can recover deleted partitions, rebuild partition tables or rewrite the master boot record (MBR). Partition recovery TestDisk retrieves the LBA size and CHS geometry of attached data storage devices (i.e. hard disks, memory cards, USB flash drives, and virtual disk images) from the BIOS or the operating system. The geometry information is required for a successful recovery. TestDisk reads sectors on the storage device to determine if the partition table or filesystem on it requires repair (see next section). TestDisk is able to recognize the following partition table formats: File recovery When a file is deleted, the list of disk clusters occupied by the file is erased, marking those sectors available for use by other files created or modified thereafter. TestDisk can recover deleted files especially if the file was not fragmented and the clusters have not been reused. There are two file recovery mechanisms in the TestDisk package: • TestDisk proper uses knowledge of the filesystem structure to perform "undelete". • PhotoRec is a "file carver". It does not need any knowledge of the file system, but instead looks for patterns of known file formats in the partition or disk image. It works best on unfragmented files and cannot recover the file name. ==Digital forensics==

TestDisk can be used in digital forensics to retrieve partitions that were deleted long ago. Binary disk images, such as those created with ddrescue, can be read by TestDisk as though they were storage devices. In TestDisk versions prior to version 7, a malformed disk or its image can be used to inject malicious code into a running TestDisk application on Cygwin. ==File system support==

File system support for TestDisk is shown in the table: Some features, such as partition table editing and PhotoRec "carving", do not depend on the file system at all. ==See also==