I think I love you TestDisk

This morning I had a horrible fright.

Background To The Scare

I recently backed up my entire life onto a new 1TB external HDD, and I mean everything. All the poems, lyrics, music, artwork that I've created since my school days, all the photos of friends and family going back to the year dot, all my certificates and numerous other things. You get the drift, it was shit loads of data and a lot of it had great personal meaning. I imagine that a lot of us nowadays keep our life on the computer, so this could happen to anyone.

My PC has recently done a bit of travelling, it's been from Auckland to Whangarei and back sitting in my 4x4 that Mum & Dad kindly babysat whilst I was gallavanting round the UK. I arrived back a few weeks ago but have been using the laptop.

Last weekend I decided to set the PC back up. Nothing untoward happened. The PC booted up. I plugged in the external HDD, again, all good, everything showing up. Now I fully deserve what happened to me next. A friend sent me a file, and it's a friend I trust so not some dodgy email spam file, and it was sent via an online file sending service. I didn't virus check the .rar file when it'd finished downloading. And I'm still not sure if this is the culprit, but it will be very coincidental if it isnt'.

I double clicked on the .rar file to open it and everything froze, the music file that was playing sounded like a stuck record, the hard drive was thrashing. Thinking that it was just my PC being a bit slow, I left it for a few minutes. After a while I got hacked off with this so tried to get the task manager up, no joy. In the end I had to force a shutdown.

Now anyone out there who can see where this is going is probably asking themselves, why the hell didn't you pull the external HDD out of the port as soon as the shit started to hit the fan - I blame jet lag and 7 weeks off work for the reduction in brain processing power.

So, the PC has now been shut down, and now I remove the external HDD. I hit the button to boot up again and lo and behold, a vital boot file is missing from the PC - WinXP will not start. Arse!

After much rummaging through the house the WinXP installation disc is located. The PC is turned on and the boot options changed to boot from CD. CD is inserted, PC is restarted - nothing happens. HDD doesn't even spin up. Crappity crap crap! So, the PC is currently sitting in the office waiting to be repaired because I really couldn't be arsed last weekend and have been too busy since then. I've acquired a new HDD to replace the potentially dead one, just need to get round to fitting it.

The Scare Itself

This morning I plugged in the portable HDD.

Words cannot describe the sinking feeling you get when a lifetime of data is suddenly MIA.

It appears that when the main PC went belly up it took the external HDD down with it.

After having a little panic I turned the internal logic filter back on and realised that the HDD wasn't damaged in any way as only one partition was missing, so I googled 'data recovery'. A whole wealth of information was returned, all of it seeming to point to the fact that the partition seemed to have been deleted.

The Fix

A deleted partition is not in itself that major of a problem, unless you do something insane like try to recreate the partition, or format or any of these other things. This fix is for a portable HDD, so I'm assuming you are able to plug it in somewhere and access the Internet from the PC you've plugged into.

Step 1:

Do nothing. Don't format. Don't create a partition. Don't write or save or read files on any other part of the disk. Anything you do may overwrite your files, which may still be on the disk, you just can't see them. Read Step 2 before you do anything and you will hopefully recover all your missing files.

Step 2:

Download the relevant version of TestDisk. Their online step-by-step guide is really useful and very detailed. Thankfully I didn't need to worry about all the 'what to do if things go wrong' scenarios, so below are the steps I took to recover the partition and all my lovely files. The step-by-step guide on the website also has lots of images if you are the sort of person who needs to see piccies of stuff.

Step 3:

After downloading the app, open the folder and navigate to the 'win' folder. Double click on testdisk_win. You don't need to install it, this will run the app immediately.

Step 4:

It asks you to create a log file. Hit enter to create.

Step 5:

TestDisk will show you all the hard drives that it has detected on your PC. You select the hard drive that is having an issue - obviously. Wouldn't really be much point selecting one that is working just fine now would it?

After selecting the relevant hard drive, press Enter to proceed.

Step 6:

Select the relevant partition type. Mine was Intel/PC. Press Enter to proceed.

Step 7:

This is where the magic starts. The menu defaults to the Analyse option. This option checks your current partition structure and also searches for lost partitions.

Select Analyse and hit Enter to proceed.

Step 8:

Once it finishes analysing it will display the partition structure for the hard disk you selected. It may show the first partition twice, this points to it being a corrupted partition or invalid table entry, it hasn't yet found your data though, so you need to keep going.

Quick Search should be highlighted at the bottom of the app screen, if it isn't, select it, then click Enter to proceed.

Step 9:

The app now asks you if you created the partition using Vista. Answer Y or N to proceed.

Step 10:

You will now see a screen with some green text displaying the partitions that have been found. Highlight the first partition and click the 'p' button. This will list the files on that partition. Click q to return to the previous display.

If the partition you just checked is the one you wish to recover, make sure that partition is selected and click Enter to proceed,

OR,

if on this screen you cannot see the partition that is missing, click Enter to proceed.

Step 11:

If like me you did not find your partition on the previous step, select 'Deeper Search' and hit Enter to proceed. This takes some time, you may need to go get lunch whilst waiting for it to complete.

If you did find your partition on the previous step, select Write, and hit Enter to proceed. I would then also run the Deeper Search option to ensure nothing else has been missed.

Step 12 (Deeper search):

So, you had to keep looking for your data using the deeper search option. When the deeper search completes it will present you with a screen listing all partitions that it found on the drive being searched. This will include deleted partitions.

Use the 'p' option to check which partition has your files on it.

Mine was the first in the list that had the * next to it. The * means Primary Bootabe, but as this is an external HDD and not the bootable partition, you can change this. Highlight the partition you are interested in using the up/down arrow keys, then use the right/left arrow keys to select the partition type. I selected P for mine as it was the primary partition.

When you have done this, click Enter to proceed.

Step 13:

Your recovered partition should now be showing on the list of partitions for your disk. Select Write and then hit Enter to proceed. Select Y and OK to confirm your selection.

Step 14:

Re-boot.

When you restart and open explorer, you should be able to see your recovered partition and all your previously missing files.

This was me after step 14:

Moving forward

I will now be backing up to two separate external HDDs, one of which will only be plugged in to the PC to create a back up and won't be used for anything else. I may even back up to DVD for extra security. Not a fun scare.