Analyzes a drive's current partition structure and searches partition making it possible to recover lost partitions.
TestDisk's Analyse does a quick check of the partition structure (MBR table and extended partitions). The MBR is limited to four entries. One of the entries can be an extended partition allowing several logical partitions. Each logical partition is contained by an extended partition/container. The MBR and each extended partition must end with the two bytes 0x55 and 0xAA, in that order; which make up the Hex Word 0xAA55 (since x86 CPU systems are 'little-endian'). A partition entry is composed of:
Only one primary partition can have the boot flag set. CHS information storage is limited to a maximum of 1024 cylinders (0-1023), that's why we have the famous 8 GB limitation (1024*255*63 = 16450560 sectors = 8422686720 bytes).
Modern operating systems and BIOS chips use LBA mode to access the data, but FAT12/16/32 boot sectors still make reference to CHS geometry. TestDisk checks that each value is in the authorized range: i.e., no sector value less than 1 nor higher than the number of sectors per head. The partition entries are read using logical start and size in sectors, then TestDisk checks if the logical values match the CHS values. TestDisk also checks that no partition data shows a partition as ending after the end of the disk, and that none of them are overlapping each other.
Following the filesystem type, TestDisk runs some basic checks on the boot sector/superblock of each filesystem. As ext2/ext3/reiserfs/jfs share the same filesystem type: 0x83, TestDisk has to check for each filesystem. The checks are the same as those used when TestDisk is searching for partitions:
This phase is very quick as the checks are minimal.
In a second step, TestDisk searches for 'lost partitions' without making use of any results from the previous step. This is the heart of TestDisk's powerful capabilities! TestDisk assumes the existence of partitions and scans all relevant drive cylinders for them. A primary partition starts at the beginning of a cylinder (head=0, sector=1), while a logical partition starts a little further along (head=1, sector=1). For each possible partition starting location, TestDisk can search for the presence of a filesystem header (FAT or NTFS boot sector, EXT2/EXT3 superblock, BSD disklabel...), which confirms the presence of a known partition type. Thus, the size of a partition is determined directly from its structure on the disk. Each partition that TestDisk discovers is added to a list of found partitions.
To detect a FAT32 partition, TestDisk searchs for a 0xAA55 endmark and the signature "FAT32", it also runs the corresponding FAT filesystem checks:
where "0xXX" could be any byte, and...
0xeb: A Short Jump, displacement relative to next instruction (only 8 bit).
0x90: NOP (do nothing).
0xe9: A Near Jump, displacement relative to next instruction (32 or 16 bit).
Some specific checks for FAT32 are done:
To detect an NTFS partition, TestDisk searchs for an 0xAA55 endmark and the signature "NTFS", it also checks that some FAT specific values are all set to zero (0): The number of reserved sectors, number of FATs, number of directory entries, 16-bit size of filesystem, 32-bit size of filesystem, Sectors per FAT. The number of Sectors per Cluster must be greater than zero.
For FAT and NTFS filesystem, the size of the partition will be read in the bootsector itself.
Once the analysis is complete, TestDisk generates a report of found partitions.
You can list files of FAT/EXT2/EXT3/RFS partition by pressing P (FAT directory listing is limited to 5 clusters, some files may not appears).
Using the list of found partitions, you can edit the partition table.
There are three kinds of edits:
As you make edits, watch the status of the partition table's structure. It will be either "Ok" or "Bad".
Structure: Ok should appear if everything is ok, i.e., no primary partition between two extended partitions, only one or no bootable partitions, no partitions using the same disk space.
When you are satisfied with the edited partition table, press Enter. If you've made any edits, TestDisk gives you a choice of writing that data to the drive's Partition Table, or of running a more detailed analysis.
Quit
Quits (exits) from the TestDisk program without making any changes (unless you pressed the ENTER key while Write was 'highlighted').
Search!
TestDisk is an intuitive program. When you ask it to search for the existence of any possible partitions on the drive, it will automatically set the options to the most effective settings.
Write
Writes the changes that have been made in TestDisk's memory buffer to the hard drive. If you are unsure of the changes (often to the MBR's Partition Table), then don't use this function!
Here TestDisk asks you to confirm the Write operation; so you have the final choice over what TestDisk will actually do.
Back to Running the TestDisk Program