Windows ‘File Recovery’ series : Part 3 Recover A Deleted Partition with Testdisk

Windows ‘File Recovery’ series
Part 3 Recover A Deleted Partition with Testdisk

DISCLAIMER: These examples use techniques that I actually employ in the real world to deal with real problems. They might be wrong or dangerous. They might be inefficient. If you try them yourself, it might cause damage or irreparable loss. I take no responsibility for anything you do based on my examples or the information that I provide here.

In this series we’ll look at some real world examples of disastrous situations salvaged and made better again.

We will be looking at Windows (FAT and NTFS) filesystems.

How partitions are deleted

This post is not about partitions disappearing due to damage or corruption of the file system. That kind of recovery will be covered later in this series. Here we will discuss solutions for recovering from accidental removal of a partition.

From personal experience, there are three ways that I have seen partitions accidentally deleted.

I’m sure that there are other ways that it happens too. Computers are always full of new surprises when it comes to breaking them.

Deleted Partition Recovery with TestDisk

We’ll do this in Windows XP Professional Service Pack 3

Let’s delete the E: drive partition. It has some files and folders on it.

Goodbye E:

TestDisk does an excellent job of recovering deleted partitions.

Always create a log unless you are running from a read only location like a Live Boot CD.

Choose the Drive that the partition was deleted from.
Select Intel/PC partition
Select Analyze
Select Quick Search

Even on XP I always answer ‘yes’ to this question

Found it!

Let’s select P to see if our files are there.

Looks great, let’s recover it press ‘q’ then press enter and select ‘write’ to write the partition’s location to the partition table of our MBR.

It will write the new partition table and tell you to reboot so quit out of TestDisk and reboot.
It worked!

Deleted Boot Partition Recovery with TestDisk

Oops, I accidentally deleted the C: drive partition using a third party partition manager.

Now when I boot up the machine it says…
“Operating system not found”

Lets get Parted Magic and make a boot CD
http://partedmagic.com/doku.php?id=downloads

Boot to the Parted Magic CD on your broken computer. Choose ‘Default Settings’ to Run from RAM.

Run TestDisk

Proceed as in the previous example and find the missing partition. There it is!

Recover C: partition like we did for E: above.
Reboot
SUCCESS!