Table of Contents
What is PartedMagic?
Parted Magic is a commercial Slackware-based Linux distribution that comes with partitioning and data recovery tools. The distribution's name is derived from the names of the GNU Parted and PartitionMagic software packages.
PartedMagic is used by booting from DVD or USB in live mode with no installation required. Its main purpose is to assist us in any setting and configuration of our hard drives.
This distribution also comes standard with everything you need to allow moving, deleting, restoring and cloning partitions. It has tools to clone entire hard drives, recover deleted or missing files, and even delete all data from a hard drive or partition and prevent it from being recovered.
Different tools to Recover Lost Files
This question has multiple answers, one of them is TestDisk. TestDisk is a free (GPL v2+ License) and open source data recovery tool that helps users recover lost partitions or repair corrupted file systems.
What you can do with TestDisk:
- Fix partition table, recover deleted partition
- Recover FAT32 boot sector from its backup
- Rebuild FAT12/FAT16/FAT32 boot sector
- Fix FAT tables
- Rebuild NTFS boot sector
- Recover NTFS boot sector from its backup
- Fix MFT using MFT mirror
- Locate ext2/ext3/ext4 Backup SuperBlock
- Undelete files from FAT, exFAT, NTFS and ext2 filesystem
- Copy files from deleted FAT, exFAT, NTFS and ext2/ext3/ext4 partitions.
In this article, we will describe how to recover files from deleted FAT, exFAT, NTFS and ext2/ext3/ext4 partitions. Like many applications, TestDisk comes pre-installed in PartedMagic.
Download PartedMagic ISO
PartedMagic is not a free Operating System so it may not be possible to use an updated version. You can find the free download addresses for 2 different versions below:
- Download 2013_08_01.iso. 1GB+ of ram required
- Download 2022_01_18.iso. 4GB+ of ram required
Download 2013 version, burn it as bootable to USB or DVD and start the server with this USB/DVD.
Why doesn’t PartegMagic Start with GUI?
PartegMagic offers multiple options to get started. 32/64 bit architecture is one of these options. If you have more than 1GB of memory, it starts with the CLI, if not with the GUI.
With the CLI, you can then start using the features that come with PartedMagic.
When starting with the GUI:
You may want to select a
Timezone or you can cancel it. Then you can start data recovery with System Tools > TestDisk.
Scan and Recover Lost Files
When TestDisk starts, either with the CLI or GUI, scan the disks and their data and create a log file:
Use arrow keys to select, then press Enter key: >[ Create ] Create a new log file [ Append ] Append information to log file [ No Log ] Don't record anything
The system must have a disk to copy the recovered data except the disk with the deleted data. This disk can be USB or external disk. Proceed by selecting the disk whose data will be recovered:
Select a media (use Arrow keys, then press Enter): >Disk /dev/sda - 1000 GB / 931 GiB - CT1000MX500SSD1 Disk /dev/nvme0n1 - 500 GB / 465 GiB >[Proceed ] [ Quit ]
Select the partition table type of the disk, then press Enter:
Disk /dev/sda - 1000 GB / 931 GiB - CT1000MX500SSD1 Please select the partition table type, press Enter when done. >[Intel ] Intel/PC partition [EFI GPT] EFI GPT partition map (Mac i386, some x86_64...) [Humax ] Humax partition table [Mac ] Apple partition map (legacy) [None ] Non partitioned media [Sun ] Sun Solaris partition [XBox ] XBox partition [Return ] Return to disk selection
Analyze current partition structure and search for lost partitions:
Disk /dev/sda - 1000 GB / 931 GiB - CT1000MX500SSD1 CHS 121601 255 63 - sector size=512 >[ Analyse ] Analyse current partition structure and search for lost partitions [ Advanced ] Filesystem Utils [ Geometry ] Change disk geometry [ Options ] Modify options [ MBR Code ] Write TestDisk MBR code to first sector [ Delete ] Delete all data in the partition table [ Quit ] Return to disk selection
Then press Enter with "Quick Search" selected. Select "Deeper Search" and press enter:
Partition Start End Size in sectors 1 * Linux 595 249 39 726 132 46 2097152 [ Quit ] [ Return ] >[Deeper Search] [ Write ]
Scanning may take a long time depending on the size of the disk and the data it contains.
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63 Partition Start End Size in sectors >P ext4 0 0 1 121601 80 63 1953525168 Structure: Ok. Keys T: change type, P: list files, Enter: to continue
When the scan is complete, press
P to list the files:
TestDisk 7.1, Data Recovery Utility, July 2019 Christophe GRENIER <email@example.com> https://www.cgsecurity.org P ext4 0 0 1 121601 80 63 1953525168 Directory / >drwxr-xr-x 0 0 4096 7-Jan-2023 22:02 . drwxr-xr-x 0 0 4096 7-Jan-2023 22:02 .. drwxr-xr-x 1000 1000 4096 18-Jan-2023 22:10 faruk Next Use Right to change directory, h to hide deleted files q to quit, : to select the current file, a to select all files C to copy the selected files, c to copy the current file
Here are the keyboard shortcuts and explanations that can be used:
- Use Left arrow to go back
- Right to change directory
- h to hide deleted files
- q to quit
- : to select the current file
- a to select all files
- C to copy the selected files
- c to copy the current file
Directory /faruk Previous -rw-r--r-- 501 18 42307530 13-Mar-2015 22:04 data.tar.gz -rw-r--r-- 1000 1000 9 12-Feb-2021 22:52 tosunnet drwxr-xr-x 1000 1000 4096 17-Jul-2022 01:33 .vscode-oss drwxr-xr-x 1000 1000 4096 6-Aug-2021 22:45 optic -rw-r--r-- 1000 1000 32 12-Feb-2021 22:52 token -rw-r--r-- 1000 1000 265 2-Nov-2021 20:46 .wget-hsts drwxr-xr-x 1000 1000 4096 12-Jun-2022 21:43 .audacity-data drwxr-xr-x 1000 1000 4096 2-Apr-2021 20:58 .PlayOnLinux -rw-r--r-- 501 18 4 29-Dec-2014 12:38 debian-binary -rwxr-xr-x 1000 1000 204677 12-Feb-2021 22:52 live-build-config-master.zi drwx------ 1000 1000 4096 24-Mar-2021 09:51 .moonchild productions >drwxr-xr-x 1000 1000 4096 23-May-2022 11:42 Documents drwxr-xr-x 1000 1000 4096 31-Jul-2022 20:53 .cargo Next Use Left arrow to go back, Right to change directory, h to hide deleted files q to quit, : to select the current file, a to select all files C to copy the selected files, c to copy the current file
If you selected a single file/directory, copying can be started with c. If you have selected multiple files/directories with the a parameter, you should use the C parameter. select a single file with c. Next, select the directory (the USB or external disk mentioned at the beginning) where the recovered file will be copied to:
Please select a destination where /faruk/Documents/Openstack/kvm.png will be copied. Keys: Arrow keys to select another directory C when the destination is correct Q to quit Directory /opt >drwxr-xr-x 0 0 284 7-Jan-2023 22:33 . dr-xr-xr-x 0 0 152 10-Sep-2022 21:45 .. drwxr-xr-x 0 0 486 21-Apr-2022 00:38 8814au drwxr-xr-x 0 0 856 17-Oct-2022 16:46 Upwork ...
Copying time may vary depending on the size of the file. Copying is complete.
Directory /faruk/Documents/Openstack/kvm.png Copy done! 1 ok, 0 failed drwxr-xr-x 1000 1000 4096 3-May-2021 13:28 . drwxr-xr-x 1000 1000 4096 23-May-2022 11:42 .. -rw-r--r-- 1000 1000 1010890 23-Mar-2021 11:55 Base-Bilesenler.png -rw-r--r-- 1000 1000 1046814 23-Mar-2021 11:55 Diger-Bilesenler.png -rw-r--r-- 1000 1000 786437 23-Mar-2021 11:56 horizon.png -rw-r--r-- 1000 1000 781035 23-Mar-2021 11:57 nova.png >-rw-r--r-- 1000 1000 751117 23-Mar-2021 11:58 kvm.png
When multiple files are selected with a, the screen appears in a different color:
C, the directory screen to be copied is displayed. The selected files are recovered.
PartedMagic contains multiple applications. We explained how to recover data using TestDisk. Later, we will be explaining the methods of recovering deleted data with different applications. Since PartedMagic is booted without installing, you can examine the applications inside. But refrain from performing actions that may delete data.
We hope that your data will not be deleted, but if you encounter such a situation, this article will help you.