|
A list of terms used in this page and their explanation can be found here.
A step-by-step example of how to use this function can be found here.
Repairing the MBR and the partition Tables.
|
Important! If there are indications that the disk is physically failing or if
bad sectors
are preventing repairs, you're advised to clone the disk
prior to making any repairs. For example, if the MBR is bad and can not accessed
it is
impossible to repair the primary partition tables (whose description is located in the
MBR). After you have cloned the disk, partition table repair can be performed on
the clone. |
Performing a recovery by repairing damaged
MBR and Partition Tables is a straightforward, 4 step process:
- Select the problem disk (more
information on how to do this here)
- Run an analyze disk procedure by
selecting [Rebuild partition tables] from the [Perform repairs] menu
- Select all partitions that must
be present when the recovery is finished [*]
- Start the repair phase
[*] - on most disks many partitions are
found of which some could overlap. DiskPatch (or any recovery tool for that
matter) would have no way to know which partitions are the ones you want back.
As a result you must create the correct and complete partition list, because a
completely new chain of partition tables has to be created during a recovery.
That's the reason you must always select all partitions that you want
back from the list, even the ones that you may have already had access to prior to the
recovery.
Selecting how the partitions
were created:
Just before starting the analysis of the disk, DiskPatch will ask you
how the partitions that you are looking for were created. You can find more
information on this here. The following menu is
displayed:
If the partitions you are looking
for were created with Windows Vista (or later versions), select 'Megabyte aligned'.
If the partitions were created using an earlier version of Windows,
select 'Cylinder aligned'.
|
The Quick scan and the Full
scan:
DiskPatch allows you to analyze the disk (search for partitions) in 1 of
2 ways: a quick scan or a full scan.
The quick scan starts at the beginning of the disk and will only
look in the areas that connect the partitions. For example: the first
partition on the disk is 20 Gb in size. DiskPatch will locate the
necessary information for that partition and will then skip to the area
that immediately follows this partition, about 20 Gb further. The
process is repeated and in this way DiskPatch 'skips' across the disk
locating the most likely candidates for the recovery. This is a very
fast way to analyze the disk, and will usually find all partitions that
are supposed to be recovered (if the partition layout was fairly
conventional). In addition the partition list is usually very 'clean',
no false positives or remnants of other partitions are found.
There are however situations where the quick scan will fail: if no
traces are found of the first partition on the disk (and more partitions
exist), DiskPatch will not know how far to jump and no further
partitions will be located. In such cases the full scan is needed. Also,
when partitions have been moved and/or resized, the partition list may
contain the wrong partitions.
When the partition list is displayed after the quick scan has completed,
all likely candidate partitions are automatically selected for repair.
Review the list and proceed with the repair if you believe the list to
be correct.
The full scan analyzes the entire disk. All locations that could contain
partition information are analyzed. This scan will take longer than the
quick scan but the results will be as accurate as possible. In many
cases the partition list will contain more partitions than the ones that
are expected, especially if partition moving/resizing has been
performed.
When the partition list is displayed after the full scan has completed,
no partitions are selected for repair; you must select the correct
partitions yourself. Review the list and select all partitions
that you want to have present after the repair. A detailed explanation
of the procedures and screens will follow.
When to select a quick or a full scan?
You would need to have an idea about the problem at hand to make this
decision:
- if the problem is relatively simple (1 partition was deleted, the MBR
was damaged, an extended partition has disappeared), use the quick scan
- if the problem is more complex (problems after resizing partitions,
boot sectors damaged, part of the disk was wiped), use the full scan
If you have no idea which one to choose, try the quick scan first. If
the list of partitions does not appear to be complete, then use the full
scan. Also keep in mind that the full scan will always offer the best
accuracy (so it's always a good choice), but the partition list might be
a bit more polluted (and the scan takes a bit longer).
|
Disk Analysis
During the disk analysis DiskPatch will scan the disk for 'significant sectors';
sectors containing information or patterns that can be used to detect partitions, and that
can be used to
rebuild damaged disk structures during the repair phase. Intelligent search techniques and heuristics
are applied to scan the disk in the fastest and most effective manner possible.
To start scanning the disk select [Rebuild partition tables] from the [Perform
repairs] menu. Select the correct option when DiskPatch asks you how the
partitions were created. Then select [Quick scan] or [Full scan].
The disk scan can be aborted at any time by pressing the <escape> key.
Aborting the scan will abort the repair procedure.
A status display is shown during the scan containing information on the number
of read errors encountered, the number of items found (sectors that contain
information that will facilitate the recovery), and an estimation of the time
needed to complete the scan.
When the scan has completed a state file is saved (if the corresponding option
is enabled) and the partition list is displayed.
A state file will not be created if the quick scan was selected.
Partition Selection
Important!
If the disk is a Windows Dynamic disk continue here.
DiskPatch will now display a list of partitions
that were found. To identify the
partitions you want to recover it is important that you have some idea of the file
system, the starting position and the size of the partition(s). In many cases only the
partitions you expect to be present will be listed, but it is possible that
more partitions than expected are displayed. If blanked out entries appear in
the partition list, partitions were filtered out. The use of filters
is explained further down.
For each partition the following
information is listed:
| Seq |
Type |
Label |
Start |
Length |
Rating |
| Sequence. |
File System Type of the partition. |
The volume label for the
partition. |
The LBA start location
(sector number) for the partition. |
The length of the
partition in sectors, and the size in Gb. |
An indication of the
quality of the partition |
About volume labels:
Labels can help you identify partitions. Also, if DiskPatch is able
to display the Volume Label for a NTFS partition than this is a good indication
that the file system is intact: to determine the volume label for a NTFS
partition, DiskPatch must interpret the boot sector and the part of the MFT that
holds the volume label. Being able to display the volume label indicates
that the boot sector and the location and start of the MFT are correct and
intact.
About the rating:
This gives you an indication of the recoverability of the partition.
A means that all objects that DiskPatch needs are found for that
partition, the chances for recovery are fair to good. In general, valid partitions that were already on the disk (and were
accessible before the
recovery) will show up with rating A.
B means that not all objects were found, but the missing objects
may not have a negative influence on the recoverability of the
partition. The partition should be regarded as incomplete.
No rating means that only a few objects were found. The partition
is far from complete. A partition without a rating is not likely to be
recovered intact. Sometimes partition management actions leave partition
remnants on the disk, which can show up without a rating.
Important: the rating is not to be
used as an absolute indication of the state of the partition! DiskPatch
uses the rating to show the difference in recoverability for the
partitions, which should help you select the most likely candidates for
the recovery. In other words, the rating is a weighing system to help
you determine which partitions are garbage and which are likely
candidates.
Also, an A rating does not guarantee a successful recovery for that
partition. There are many more factors that determine whether the
partition is accessible after the recovery, not all of them can be
controlled or detected by DiskPatch.
Finally, there's always the chance that the one partition you're looking
for has a bad rating. In that case the rating should be ignored and you
should attempt to recover the partition. Even if the recovery does not
lead to an accessible partition right away, a follow up recovery using a
file recovery tool (like iRecover) is much easier if the partition
tables are already in place. |
Use the <up> and <down> cursor keys to move through
the partition list.
Press <enter> to display the partition submenu:
The following options are available:
[Show information]
Will display a screen with details about the selected partition:
This screen may help you determine the
validity of the partition. It will also display the general location of the
partition on the disk.
[Select or Un-select a Partition]
Will select or un-select the partition for recovery. When selected, a checkmark will appear next to the
sequence number for the partition.
If selected partitions are conflicting (for instance because they overlap) this
will be indicated by an exclamation mark in the 'Seq' column. All affected
partitions will be marked. Select a marked partition and select [Show
information] from
the partition submenu to see what type of conflict you're dealing with.
You can not continue to the repair phase with conflicting partitions; make sure
to unselect the appropriate partition.
If you need to recover data from
the partitions that are overlapping, first recover only one partition. Then access it and salvage
data by copying it to another drive. During a next repair session skip the previously
selected partition and recover the other (overlapping) partition.
Suggested partition markers:
When a partition is selected, DiskPatch will attempt to map out the rest
of the disk and indicate potential partitions that fit the scheme. These
partitions will be marked with a small black arrow next to the sequence
number:
Only the partitions after the selected partition will be
marked. Use the marked partitions as a reference to help you determine
the total list of partitions that should make up the disk. Please note
that the black arrows are suggestions. If you wish to follow the
suggestion you must still select the marked partition(s). You can
auto-select the suggested partitions by selecting [Select all suggested]
from the partition sub-menu.
|
[Select all suggested]
This option will select all partitions that have a suggestion marker (as is
explained above). If no partition has been selected yet (the markers only appear
when at least one partition has been selected) nothing is selected.
[Unselect all]
Unselects all partitions.
From the 'select partitions for repair' view, press <escape> to
view the follow-up actions menu:
[Abort]
End the repair operation, no changes will be saved to disk.
[Set display filters]
Opens a menu that allows you to hide certain partition types on the 'repair
partition list' from view. This can help you tidy up the list somewhat, and make
it easier to select the correct partition(s) if the list is very long.
Partitions that are filtered out can not be selected and will not be marked by
the suggested partitions markers.
Partitions that are filtered out are not
removed from the list, but instead will appear as blanked out entries.
The following filters can be set (the default value is shown in blue):
| display FAT
partitions - |
show all FAT type partitions (yes/no) |
| display
NTFS partitions - |
show NTFS type partitions (yes/no) |
| display
OTHER partitions - |
show non FAT/NTFS partitions (yes/no) |
| display
A-rated partitions - |
show partitions with an A rating (yes/no) |
| display
B-rated partitions - |
show partitions with a B rating (yes/no) |
| display
un-rated partitions - |
show partitions with no rating (yes/no) |
| display
FAT12 partitions - |
show FAT12 partitions (yes/no) |
| display
illegal partitions - |
show partitions that are past
end-of-disk or otherwise 'illegal' (yes/no) |
Select [Reset] from the filter menu to
reset all filters to the default values. Press <escape> when finished
setting the filters.
Once you have selected your partitions, select [Continue to Repair]. DiskPatch will now start the repairs. Before
the repairs are performed, DiskPatch will show the 'create undo archive'
dialogue. Enter a description or leave the suggested text and press <enter>
to create the new undo file. Press <escape> at this point to skip
creating the undo file (not recommended).
Repair Phase
During the actual repairs no user intervention is required. DiskPatch will
now create and fix:
-
A primary partition table in sector 0 (the MBR). A primary partition table
is always created during the repair.
-
Extended Partition Boot Records
(EPBR). The location varies and depends on
the locations of logical partitions. EPBRs are only created when logical
partitions were selected for recovery.
-
Boot Sectors. Every partition's first sector contains important meta
information that describes file system structures within the partition.
DiskPatch only attempts to fix boot sectors if there are indications that an
original boot sector is damaged.
After the repair
The first thing you should always do after DiskPatch has repaired a disk, is
to verify the disk's contents using read-only methods. Under no circumstances should
you write or allow other software (for example XP's chkdsk or versions of Scandisk) to write to the
disk!
| You can not boot from the repaired disk because DiskPatch (purposely) does
not set an active partition. |
Using a boot diskette to boot the PC is a good way to ensure that no
software will automatically repair the disk. Please note that while you may be
able to access both FAT(32) type and NTFS partitions from a Linux boot diskette
or bootable CD/DVD (For example the Knoppix
CD), DOS is limited to accessing FAT(32) partitions only. To verify the
contents of a NTFS partition from DOS, we recommend the read/write driver NTFS4DOS from
Avira
(free for personal use).
If you are accessing the disk from another Windows installation, prevent Windows
from executing Scandisk or Checkdisk (if you are prompted during startup).
Verify that a normal directory structure is present. If you do not see the
directories or files you expected to see, or if you see the filenames displayed
as 'funny' ASCII characters, than this means that the internal file system structures
are damaged. The fact that you don't see the correct filenames could be a result
of you picking the wrong partitions, so verify your choices and if necessary undo
the last repairs and try again.
Additional steps
After you have verified the disk and found it to be okay, you can use DiskPatch to set
an active partition so you can attempt to boot from the repaired disk. Select [MBR
related tasks], [Change Partition Attributes], Select the
partition you want to boot from, Select [Activate].
There is a chance that apart from the partition tables, the boot code in the MBR
was damaged. You can use DiskPatch to write a standard boot loader to the
MBR that is capable of
booting any Windows or DOS based operating system for the PC platform. To do so select [MBR
related tasks], [Refresh Bootcode].
|
