Home | Products | Download | Purchase | Support

DIY DataRecovery.nl

About partition recovery and partition table repair

IMPORTANT: Never try to recreate lost or deleted partitions using Windows Fdisk or Disk Management!

Before a Windows operating system can store data on a disk, 2 things need to be done: (1) Partitioning the disk and (2) formatting the partition. Partitioning a hard disk defines specific areas (the partitions) within the disk. Partitions can be created with standard operating system utilities such as Fdisk, Disk Management or Diskpart, or third party tools like PartitionMagic (previously PowerQuest, now Symantec Norton PartitionMagic). Even if a disk is not divided into multiple areas (there's only the c: drive), one partition is present.

Information about partitions is stored in structures called partition tables, also called partition records. The first or primary partition table is stored in the Master Boot Record, or MBR for short, which is located in the very first sector of the hard disk. 

The same tools that can be used to create partitions can be used to delete them. On systems with multiple physical hard disks it is relatively easy to make mistakes during partition deletion; always double-check before deleting a partition! Unlike with file removal, there is no Recycle bin feature that helps you to undo mistakes. Delete the wrong partition and you will be needing data recovery software to restore it.

Apart from mistakenly deleting the wrong partition, partitions can be lost due to viruses (not very common nowadays), BIOS bugs, operating system bugs or crashes of third party partition manipulation tools like the aforementioned PartitionMagic. The MBR and partition tables offer no redundancy or fault tolerance. Once a partition table structure has become corrupt you will need special software to recover data from these damaged or deleted partitions.

There are two methods available for 'partition recovery':

- in-place repairs: try to repair the corrupt structure so data on the lost partition can be accessed again

- copy data from the damaged partition(s): use a utility that creates a virtual representation of the lost partition's file system, allowing you to salvage data by copying it from the lost partition to a safe location. The partition remains deleted and can be re-created after the data was rescued.

Our product DiskPatch performs in-place repairs by scanning for lost and deleted partitions and fixing partition tables.

iRecover also offers functionality to scan for lost or deleted partitions but employs the 2nd method: once the lost partition is located, it is analyzed and a file / directory tree is built in memory so folders and files can be copied from the lost partition to a safe place.

There are advantages and disadvantages to both methods:
In-place repairs are relatively quick and you do not need additional disk storage to copy data. As DiskPatch runs from a bootable diskette or CD/DVD it can be used even if Windows fails to boot (because of MBR damage). The fact that DiskPatch writes to the (damaged) disk could be considered a disadvantage: if the repair fails things have been changed on the disk (and not for the better) and that may impede further repairs or recovery. This is a valid objection against in-place repairs, but in practice this is not that big a problem. DiskPatch has an extensive undo feature that completely reverses any automated repair operation, if needed. In addition, DiskPatch contains intelligent analysis and repair procedures, so the chance that the repair actually makes matters worse is close to non-existent.

So, if trying to repair the partition tables (performing in-place repairs) can theoretically be considered risky, the advantages of the second method become obvious. By reading data from damaged partitions and copying it to a safe place, nothing is changed on the problem disk. If things don't work out you can simply retry with different parameters. But this method has drawbacks too: first of all you need additional storage space to copy the data, and secondly, analyzing the damaged partitions can take a lot of time. Depending on the disk's size and the amount of files on it, this can take from a few minutes to several hours.

Lastly, the choice of recovery procedure also depends on the type of damage. If a partition was simply deleted and nothing was done to the disk after that, in-place repairs are the way to go (DiskPatch). Also, certain partition elements can be rebuilt by using in-place repairs: boot sectors, if damaged or deleted, can be recreated by DiskPatch.
If a partition is damaged internally, or if files are deleted or damaged, repairing is usually not an option and file recovery should be employed (iRecover).

DIY DataRecovery. All rights reserved | about