Posted:2006-06-10 By hdd recovery Number of View:256881
RETRIEVE LOST PARTITION UNDELETE
UNFORMAT FILE RECOVERY
By :hdd recovery
Posted:2006-06-10
xtreview is your : Video card - cpu - memory - Hard drive - power supply unit source
The information about primary partitions and extended partition is
contained in the Partition Table, a 64-byte data structure, located in the same
sector as the Master Boot Record (cylinder 0, head 0, sector 1). The Partition
Table conforms to a standard layout, which is independent of the operating system.
The last two bytes in the sector are a signature word for the sector
and are always 0x55AA.
Each Partition Table entry is 16 bytes long, making a maximum of four entries
available. Each partition entry has fields for Boot Indicator (BYTE), Starting Head (BYTE), Starting Sector (6 bits),
Starting Cylinder (10 bits), System ID (BYTE), Ending Head (BYTE), Ending Sector (6 bits), Ending Cylinder (10 bits),
Relative Sector (DWORD), Total Sectors (DWORD).
Thus the MBR loader can assume the location and size of partitions.
MBR loader looks for the "active" partition, i.e. partition that has Boot Indicator equals 0x80
(the first one in our case) and passes control to the partition boot sector for further loading.
Lets consider the situations which cause computer to hang up while booting or data loss.
1. What will happen if no partition has been set to the Active state (Boot Indicator=0x80)?
Lets remove Boot Indicator from the first partition:
0000001B0 00 01 ................
0000001C0 01 00 07 FE 7F 3E 3F 00 00 00 40 32 4E 00 00 00 ...?>?...@2N...
When we try to boot now, we see an error message like "Operating System not found".
It means that the loader cannot determine which partition is system and active to pass control to.
2. What will happen if partition has been set to the Active state (Boot Indicator=0x80)
but there are no system files on that partition?
(it could happen if we had used for example FDISK and selected not the proper active partition).
Loader will try to boot from there, fails, try to boot again from other devices like floppy,
and if fails to boot again, we'll see an error message like "Non-System Disk or Disk Error".
3. What will happen if partition entry has been deleted? If it has been deleted, next two partitions will move one line up in the
partition table.
If we try to boot now, the previous second (FAT)
partition becomes the first and the loader will try to boot from it. And if it's not
a system partition, we'll get the same error messages.
4. What will happen if partition entry has been damaged? Let's write zeros to the location of the first partition entry.
If we try to boot now, the MBR loader will try to read and interpret zeros (or other garbage) as
partition parameters and we'll get an error message like "Missing Operating System".
Thus, the second step in partition recovery is to run Disk Viewer and to make sure that
the proper
partition exists in the partition table and has been set as active.
How can recovery software help you in the above-mentioned scenarios?
Discover and suggest you to choose the partition to
be active (even FDISK does so).
Discover and suggest you to choose the partition to
be active.
Perform a free disk space scan to look for partition
boot sector or remaining of the deleted partition information in order to try
to reconstruct Partition Table entry for the deleted partition.
Perform all disk space scan to look for partition boot sector or
remaining of the damaged partition information in order to try to
reconstruct Partition Table entry for the damaged partition entry.
Why partition boot sector is so important?
Because if recovery software finds it, all necessary parameters
to reconstruct partition entry in the Partition Table are there.
What would happen if partition entry had been
deleted then recreated with other parameters and re-formatted?
In this case, instead of the original partition entry we would have a new
one and everything would work fine except that later on we could recall that we
had some important data on the original partition. If you've created MBR, Partition Table,
Volume Sectors backup (for example, Active Partition Recovery and
Active UNERASER Unformat can
do it) before, you can virtually restore it back and look for your data (in
case if it has not been overwritten with new data yet). Some advanced recovery
tools also have an ability to scan disk surface and try to reconstruct the
previously deleted partition information from the pieces of left
For the machine to be able to start booting properly, the following conditions
should apply:
Master Boot Record (MBR) exists and is safe
Partition Table exists and contains at least one active partition
If so, executable code in MBR selects an active partition and passes
control there, thus it can start loading proper files (COMMAND.COM, NTLDR,
... ) depending on the file system type on that partition. However, if these files
are missing or corrupted then OS will be unbootable - remember the famous error
"NTLDR is missing ..." ? In this case recovery software accesses
this drive on the low level bypassing system boot (for example, if you boot
from another HDD or bootable floppy) and will help you to see all other files
and directories on the drive and allow you to copy to the safe place onto
another drive.
For the partition/drive to be visible to the Operating System the following
conditions should apply:
Partition/Drive can be found via Partition Table
Partition/Drive boot
sector is safe
If so, OS can read partition/drive parameters and display drive in
the list of the available drives. However, if the file system itself is damaged
(Root, FAT area on FAT12/FAT16/FAT32, or system MFT records on NTFS)
drive's content might not be displayed and we might see errors like "MFT is corrupted",
"Drive is invalid" ... In this case you have less chances to restore
your data in compare to the case where OS is not bootable due to the
missing or corrupted system files, however recovery software usually uses some
tricks to display may be not all but some of the entries that are still safe
and allow you to save your data to another location.
Under "Partition recovery" we mean two things:
"Physical partition recovery". The goal is to find
out the problem and write some information to the proper place on HDD and
after that partition becomes visible to OS again. You can do it manually using
Disk Editors and some guidelines or use recovery software, designed for this
purpose.
"Virtual partition recovery". The goal is to
determine the
critical parameters of the deleted/damaged/overwritten partition and after that enable to scan it and display its
content. This approach can be applied in some cases when physical partition recovery
is not possible (for example, partition boot sector is dead) and is commonly used by
recovery software. It's very hard (almost impossible) to implement it manually.
Lets consider the topics, related to the recovery of partitions in common,
not specific to the particular file system. We have the following
cases:
MBR is damaged
Partition is deleted or Partition Table is damaged
Partition Boot Sector is damaged
Missing or Corrupted System Files
As an example we'll use the following disk layout:
Here we have two primary partitions (C:
and H:) and one Extended having two logical drives (D: and
E:)
Partition Boot Sector is damaged
The Partition Boot Sector contains information, which the file system uses to
access the volume. On personal computers, the Master Boot Record uses the
Partition Boot Sector on the system partition to load the operating system
kernel files. Partition Boot Sector is the first sector of the Partition.
Bytes 0x00– 0x0A are the jump instruction and the OEM ID (shown in bold
print).
Bytes 0x0B–0x53 are the BIOS Parameter Block (BPB) and the extended BPB.
This block contains such essential parameters as
Bytes Per Sector (WORD, offset 0x0B),
Sectors Per Cluster (BYTE, offset 0x0D),
Media Descriptor (BYTE, offset 0x15),
Sectors Per Track (WORD, offset 0x18),
Number of Heads (WORD, offset 0x1A),
Hidden Sectors (DWORD, offset 0x1C),
Total Sectors (LONGLONG, offset 0x28), etc...
The remaining code is the bootstrap code (that is necessary for the proper system boot)
and the end of sector marker (shown in bold print).
This sector is so important on NTFS, for example, duplicate of the boot sector is located
on the disk.
Boot Sector for FAT looks different, however its BPB contains parameters
similar to the above mentioned. There is no extra copy of this sector stored
anywhere, so recovery on FAT is as half as less successful than on NTFS.
What will happen if Partition Boot Sector is damaged or bad/unreadable?
Lets fill up with zeros several lines of Partition Boot Sector:
If we try to boot, we'll see "Non System Disk” or “Disk Error..". After we fail to load
from it and from floppy, partition becomes unbootable.
Because a normally functioning system relies on the boot sector to access a
volume, it is highly recommended that you run disk-scanning tools such as Chkdsk
regularly, as well as back up all of your data files to protect against data
loss in case you lose access to the volume.
Tools like Active@ Partition Recovery and Active@ UNERASER allow you
to create backup of MBR, Partition Table and Volume Boot Sectors so
that if for some reason it fails to boot, you can always restore your
partition information and
have an access to files/folders on that partition.
What to do if this sector is damaged?
If we do have backup of the whole disk or MBR/Boot Sectors we can try to restore it from there.
If we do not have backup, in case of NTFS we could try to locate a duplicate of
Partition Boot Sector and get information from there.
If duplicate boot sector is not found, only virtual partition recovery might be possible
if we can determine critical partition parameters such as Sectors per Cluster, etc..
How can we fix NTFS boot sector using standard Windows NT/2000/XP tools?
On NTFS copy of boot sector is stored at the middle or at the end of the Volume.
You can boot from startup floppy disks or CD-ROM, choose repair option during setup,
and run Recovery Console. When you are logged on, you can run FIXBOOT
command to try to fix boot sector.
How can recovery software help you in this situation?
It can backup MBR, Partition Table and Boot Sectors and restore them in case of damage
Some advanced techniques allow assuming drive parameters even if duplicate boot sector
is not found (i.e. perform virtual partition recovery)
and give the user virtual access to the data on the drive to be able to copy them to
the safer location.It can try to find out duplicate boot sector on the drive and
re-create the original one or perform virtual data recovery based on
found partition parameters
MBR is damaged
The Master Boot Record (MBR) will be created when you create the first partition
on the hard disk. It is very important data structure on the disk. The Master
Boot Record contains the Partition Table for the disk and a small amount of
executable code for the boot start. The location is always the first sector on the disk.
The first 446 (0x1BE) bytes are MBR itself, the next 64 bytes are the Partition Table,
the last two bytes in the sector are a signature word for the sector and are always 0x55AA.
When we try to boot after hardware testing
procedures, we see just blank screen without any messages. It means the piece of code at the beginning of the MBR could not be
executed properly. That’s why even error messages could not be displayed.
However, if we boot from the floppy, we can see FAT partition, files on it and
we are able to perform standard operations like file copy, program execution...
It happens because in our example only part of the MBR has been damaged which does
not allow the system to boot properly. However, the partition table is safe and
we can access our drives when we boot from the operating system installed on
the other drive.
What will happen if sector signature (last word 0x55AA) has been removed or damaged?
Lets write zeros to the location of sector signature.
When we try to boot now, we see an error message like "Operating System not found".
Thus the first thing if computer does not boot is to run Disk Viewer and check the first
physical sector on HDD, whether it looks like valid MBR or not:
check, may be it's filled up with zeros or any other
single character
check whether error messages (like you can see above
"Invalid partition table"...) are present or not
check whether disk signature (0x55AA) is present or not
The simplest way to repair or re-create MBR is to run Microsoft's standard utility called FDISK
with a parameter /MBR, like
A:\> FDISK.EXE /MBR
FDISK is a standard utility included in MS-DOS,
Windows 95, 98, ME.
If you have Windows NT / 2000 / XP, you can boot from startup
floppy disks or CD-ROM, choose repair option during setup, and run
Recovery Console. When you are logged on, you can run FIXMBR
command to fix MBR.
Also you can use third party MBR recovery software or if you've created MBR
backup, restore it from there (Active@ Partition Recovery has such capabilities).
What will happen if the first sector is bad/unreadable?
Most likely we'll get the same black screen, which we got when
trying to boot. When you try to read it using Disk Viewer/Editor you
should get an error message saying that sector is unreadable. In this
case recovery software is unable to help you
to bring HDD back to the working condition, i.e. physical partition
recovery is not possible. The only thing that can be done is to scan
and search for partitions (i.e. perform virtual partition recovery),
and in case if something is found - display them and give the user an
opportunity to save important data to another location. Third party
software, like Active@ UNERASER, will help you here.
Missing or Corrupted System Files
For Operating System to boot
properly, system files required to be safe.
In case of Windows 95 / 98 / ME, these files are msdos.sys,
config.sys, autoexec.bat, system.ini, system.dat,
user.dat, etc.
In case of Windows NT / 2000 /
XP these files are: NTLDR, ntdetect.com, boot.ini, located at the root folder of the bootable volume, Registry
files (i.e., SAM, SECURITY, SYSTEM and
SOFTWARE),
etc.
If these files have been deleted, corrupted, damaged by virus, Windows will
be unable to boot. You'll see error message "NTLDR is missing".
So, the next step in recovery process is to check the existence and safety of system files
(for sure, you won't able to check them all, but you must check at least NTLDR,
ntdetect.com, boot.ini which cause most of
problems).
To do it in Windows 95 / 98 / ME - you can boot in
Command Prompt Mode, or from the bootable floppy and
check system files in the command line or with a help of third
party recovery software.
To do it in Windows NT / 2000 / XP, you can use Emergency Repair Process, Recovery Console or third
party recovery software.
Emergency Repair Process
To proceed with Emergency Repair Process,
you need Emergency Repair Disk (ERD). This disk is recommended to create
after you install and customize Windows. To create it, use the "Backup" utility
from System Tools. You can use the ERD to repair damaged boot sector,
damaged MBR, repair or replace missing or damaged NT Loader (NTLDR) and
ntdetect.com files.
If you do not have an ERD, the emergency repair process can attempt to locate
your Windows installation and start repairing your system, but it may not
be able to do so.
To run the process, boot from Windows bootable disks or CD, and choose
Repair option when system suggests you to proceed with installation or repairing.
Then press R to run Emergency Repair Process and choose Fast or
Manual Repair option. Fast Repair is recommended for most users, Manual Repair -
for Administrators and advanced users only.
If the emergency repair process is successful, your computer will
automatically restart and you should have a working system
Recovery Console
Recovery Console is a command line utility similar to MS-DOS command line.
You can list and display folder content, copy, delete, replace files,
format drives and perform many other administrative tasks.
To run Recovery Console, boot from Windows bootable disks or CD and choose Repair
option, when system suggests you to proceed with installation or repairing and
then press C
to run Recovery Console. You will be asked to which system
you want to log on to and then for Administrator's
password, and after you logged on - you can display drive's contents, check the
existence and safety of critical files and, for example, copy them back if they have
been accidentally deleted.
Recovery Console
Recovery Software
Third party recovery software in most cases does not allow you to
deal with system files due to the risk of further damage to the system, however
you can use it to check for the existence and safety of these files.
xtreview is your : Video card - cpu - memory - Hard drive - power supply unit source
we would be happy to answer for your question . if you have suggestion or comment
regarding this review our support would be glad to help just join our forum and ask u will get the best answer
to discuss check our forum section :-)