If you ever accidentally formatted an external drive on a PC with several plugged-in USB devices, you probably remember seeing them listed in the formatting tool’s selection box. The (C:) and (D:) drives may be listed, which are usually the boot drive and the backup drive. If an (E:) is displayed, it’s probably the optical drive. However, distinguishing between the other drives or devices may not be as apparent, especially when information beyond the drive letter assignment isn’t shown. This is particularly true for drives or other USB  devices that don’t have identifying information on them. Under these conditions, it’s easy to become careless or impatient and select the wrong drive; especially if its letter assignment appears to be correct. If you are unlucky, you may notice a flashing light on the device confirming that the wrong drive is being formatted.

mystica_USB_Flash_Drive (public domain clip art www.clker.com)

I did this recently when in a hurry and chose the wrong drive letter. Instead of formatting the flash drive, the external 250GB backup drive was formatting. Panicking, I immediately realized the error and stopped the formatting process – but it was too late. Checking the hard drive, I found it couldn’t be accessed. The drive letter was still visible in Windows, but no files or folders were displayed and nothing could be written to or read from the drive.

Fearful of losing the data, I tried several file recovery tools with no success until using TestDisk. TestDisk is a free (open source) data recovery tool available from CGSecurity. With TestDisk, I was able to successfully restore the drive’s partition and it worked normally.

Luckily, all of the data was still intact. That’s because during a high-level format (quick format), only the external drive’s partition table information or boot sector are erased. According to Windows Help Central, even a full format can be recovered pretty easily as long as the original files are not overwritten with new data. That’s because the spaces containing file information on the disk drive are not really wiped clean, but instead, the areas where files are stored are marked as available for new data. As long as no new data is written to the drive, chances are excellent that the data is 100% recoverable using simple freeware data recovery tools. That’s because if you hosed the partition table or MBR (Master Boot Record) during the format process, the drive isn’t likely to be writable anyway.

TestDisk is a utility that can be used to restore corrupted and missing MBRs, partition tables, and data. TestDisk works on most operating systems including Windows, Linux, BSD, SunOS, and Mac OSX and it’s included with many Linux LiveCD distros such as PartedMagic and many others. It’s a very useful and sophisticated tool in the hands of experienced users. Unfortunately, because data recovery can be a complex issue, inexperienced users may find it “user unfriendly”. However, documentation for the program is thorough and one can find many examples, technical notes, and step by step instructions in the documentation section on TestDisk’s Wiki. Also, the TestDisk Step by Step guide contains plenty of screen-shots which greatly helps in the data recovery process.

The following screen-shots show what to expect after starting TestDisk for recovering a deleted partition (note: the screens below show the results for a working hard drive that doesn’t have any problems).


Above is the first screen. For most cases,  select the default option – Create a new log file.


Next, select your media device with the problem. In the screen above, the main hard drive is selected.


Select Intel if using a Windows or Linux machine.


In most cases “analyse” should be selected.

FYI, “Advanced” provides options to restore the boot sector or to create images for partitions.

analyse
Analyses displays a preliminary list of the current partitions for the drive selected. Next, select Quick Search to continue searching for additional partitions.

quicksearch
“Yes” should be selected for most situations.

selectpartition
TestDisk displays the structure analysis results and displays the partitions. Healthy partitions will be highlighted in green. Here, you can use the up/down arrow keys to select a partition to further analyze or recover, then hit ENTER. 

Pressing “P” will list the files in the partition, which can provide some assurance that the data is still intact. Do not use the left/right keys – they are used to change the partition’s characteristics!

deepersearch

If the partition you want to restore is listed, select “Write” and then Enter to restore it and that should be it. If TestDisk didn’t find your partition, you have the option to perform a deeper search by selecting “Deeper Search”. In the screenshot above, the results show that no problems were found (the screenshots are for a working hard drive).

For more information, the TestDisk Wiki’s Step by Step instructions explain the recovery procedure well enough so that even novices shouldn’t have a problem.

—————————————————————————————————————————————————————————

Other TestDisk how-tos:

The How-to-Geek explains recovering partitions with TestDisk using an Ubuntu LiveCD (ver 9.10):

Recover Data Like a Forensics Expert Using an Ubuntu Live CD

A MakeTechEasier how-to for data and partition recovery using TestDisk:

How to Recover Data and Partitions for Free with TestDisk

Other Data Recovery Utilities

If the drive is still accessible or if only a few files are missing, you may want to try one of the easier-to-use file recovery programs listed below before trying TestDisk. Some that I’ve successfully used in the past to recover lost data are:

Recuva

Restoration

PhotoRec

Install or Recover MBR or Boot Sector

If you know the problem is a damaged or missing MBR (Master Boot Record), a number of tools can be used to repair or restore it – including TestDisk.

MBR Recovery:

Write a new MBR with TestDisk:
  1. Start TestDisk
  2. Create a new logfile
  3. Select a media
  4. Select partition table type (Intel, Mac, Sun, etc)
  5. MBR code (this writes a new MBR)

Below are are other tools and resources that can be used to install, repair or restore the MBR. Note that some of the tools listed require that a backup of the MBR was previously saved:

Bootice (restores a saved MBR only)

How to fix MBR in Windows XP and Vista

5 Free Tools to Backup and Restore Master Boot Record (MBR)

MBR, Partition Table and Boot Record Tools

Boot Sector Recovery:

A Sourceforge article describes the procedure for recovering a Boot sector using TestDisk to successfully fix a dual-boot PC (WinXP & Ubuntu) that wouldn’t boot. The procedure is as follows:

Boot Problems:Boot Sector (follow the steps in the either case section for TestDisk as shown below)

  • 1st screen: select No Log and then press ENTER
  • 2nd screen: select the drive to restore and select Proceed
  • 3rd screen: select Intel
  • 4th screen: select Advanced
  • 5th screen: select the partition and select Boot
  • 6th screen: select Rebuild BS
  • 7th screen: type “Y” to confirm

If using the Grub bootloader for a dual-boot system, make sure to update Grub (it may be necessary to use a LiveCD of your Linux distribution to do this).

Summary

If the easier-to-use tools above don’t work for whatever reason, give TestDisk a try to recover the partition, MBR or boot sector, but follow the directions carefully. Although fairly simple, it’s still possible to mess things up so thoroughly that the only way to recover the data would be to send the drive to a very expensive professional data recovery service.

Remember, if you accidentally format or erase files from your external USB drive, don’t panic. Get to work on recovering your data because chances are that it can be accomplished more easily than you think.

 

Share

2 Comments

  1. meral says:

    Thank you for the article. I did the same and the Testdisk made a testdisk.log for me. the log file is 181 GB. I don’t know how to open it. please help me if you know something..

  2. Chris Galli says:

    Thank you for this article! It was a Godsend to find this great tool! I too partially reformatted my drive on accident after troubleshooting my computer when my video card died out. I used this seemingly rough program but it took it seconds to fix my previously unreadable drive. I can’t tell you how relieved I am to have all my hard work and memories back!

Bear

Bad Behavior has blocked 614 access attempts in the last 7 days.