TestDisk: undelete file for FAT

From CGSecurity

Jump to: navigation, search

This Recovery example guides you through TestDisk step by step to undelete files from FAT filesystem. It's possible to recover your deleted files: when a file is deleted, the filename is marked as deleted and the data as unallocated/free, but TestDisk can read the deleted directory entry and find where the file was beginning. If the data space hasn't been overwritten by a new file, the file is recoverable.

Start the undelete process

  • Select Advanced
Image:fat_select_advanced.png
  • Select the partition that was holding the lost files and choose Undelete
Image:fat_select_undelete.png

FAT file undelete

Deleted files and directories are displayed in red.

  • To undelete a file, select the file to recover and press 'c' to copy the file.
  • To recover a deleted directory, select the directory and press 'c' to undelete the directory and its content.
Image:fat_undelete_select_file.png

Select where recovered files should be written

Select the destination

Image:fat_undelete_copy.png

FAT file recovery is completed

When you get your files back, use Quit to exit.

Image:fat_undelete_done.png

For a maximum of security, TestDisk doesn't try to unerase files but let you copy the deleted files on another partition or disk. Remember you must avoid to write anything on the filesystem that was holding the data, otherwise deleted files may be overwritten by new ones.

TestDisk can undelete

If a lost file is still missing, give PhotoRec a try. PhotoRec is a signature based file recovery utility and may be able to recover your data where other methods failed.

Data Recovery
Security