|
IMPORTANT: Never
try to recreate lost or deleted partitions using Windows Fdisk or
Disk Management!
Before a Windows operating system can store data
on a disk, 2 things need to be done: (1) Partitioning the disk and
(2) formatting the partition.
Partitioning a hard disk defines specific areas (the partitions)
within the disk. Partitions can be created with standard operating
system utilities such as Fdisk, Disk Management or Diskpart, or
third party tools like PartitionMagic (previously PowerQuest, now
Symantec Norton PartitionMagic). Even if a disk is not divided
into multiple areas (there's only the c: drive), one partition is
present.
Information about partitions is stored in structures called
partition tables, also called partition records. The first or
primary partition table is stored in the Master Boot Record, or
MBR for short, which is located in the very first sector of the hard
disk.
The same tools that can be used to create partitions can be used
to delete them. On systems with multiple physical hard disks it is
relatively easy to make mistakes during partition deletion; always
double-check before deleting a partition! Unlike with file
removal, there is no Recycle bin feature that helps you to
undo mistakes. Delete the wrong partition and you will be
needing data recovery software to restore it.
Apart from mistakenly deleting the wrong partition, partitions can
be lost due to viruses (not very common nowadays), BIOS bugs,
operating system bugs or crashes of third party partition
manipulation tools like the aforementioned PartitionMagic. The MBR
and partition tables offer no redundancy or fault tolerance. Once
a partition table structure has become corrupt you will need
special software to recover data from these damaged or deleted
partitions.
There are two methods available for 'partition recovery':
- in-place repairs: try to repair the corrupt structure so data
on
the lost partition can be accessed again
- copy data from the damaged partition(s): use a utility that
creates a virtual representation of the lost partition's
file system, allowing you to salvage data by copying it from the
lost partition to a safe location. The partition remains deleted
and can be re-created after the data was rescued.
Our product DiskPatch
performs in-place repairs by scanning for lost and deleted
partitions and fixing partition tables.
iRecover
and iUndelete also offer functionality
to scan for lost or deleted partitions but they employ the 2nd
method: once the lost partition is located, it is analyzed and a
file / directory tree is built in memory so folders and files can
be copied from the lost partition to a safe place.
There are advantages and disadvantages to both methods:
In-place
repairs are relatively quick and you do not need additional disk
storage to copy data. As DiskPatch runs from a bootable
diskette or CD/DVD it can be used even if Windows fails to boot
(because of MBR damage). The fact
that DiskPatch writes to the (damaged) disk could be considered the
disadvantage: if the repair fails things have been changed on the
disk (and not for the better) and that may impede further repairs or
recovery. This is a valid objection against in-place repairs, but in
practice this is not that big a problem. DiskPatch has an extensive
undo feature that completely reverses any automated repair
operation, if needed. In addition, DiskPatch contains intelligent
analysis and repair procedures, so the chance that the repair
actually makes matters worse is close to non-existent.
So, if trying to repair the partition tables (performing in-place
repairs) can theoretically be
considered risky, the advantages of the second method become
obvious. By reading data from damaged partitions and copying it to a
safe place, nothing is changed on the problem disk. If things don't
work out you can simply retry with different parameters. But this
method has drawbacks too: first of all you need additional storage
space to copy the data, and secondly, analyzing the damaged
partitions can take a lot of time. Depending on the disk's size and
the amount of files on it, this can take from a few minutes to
several hours.
Lastly, the choice of recovery procedure also depends on the type of
damage. If a partition was simply deleted and nothing was done to
the disk after that, in-place repairs are the way to go (DiskPatch).
Also, certain partition elements can be rebuilt by using in-place
repairs: boot sectors, if damaged or deleted, can be recreated by
DiskPatch.
If a partition is damaged internally, or files are deleted or
damaged, repairing is usually not an option and file recovery should
be employed (iUndelete and iRecover).
|