Common Cases of Partition Recovery book v1.0

Ⅵ.Common Cases of Partition Recovery

1.MBR Recovery

On condition that there is no problem with hardware, the first step is MBR recovery. MBR

recovery is simple because it is system data. Though it may be created by different software and the code might be different, the method is the same. Even if multi-system boot, it is not hard. You can backup the data to be recovered after the system boot turn to be normal, and then restore the multi system boot.

Recover MBR by fdisk

The simplest way to recover MBR is Fdisk, whose command is simple too; you can use

“Fdisk/MBR”. Please note that, the hard disk to be operated should be connected on mater IDE interface as the master hard disk. As to other connection way, we need appoint the interface location of IDE device in form of “Fdisk/CMBR”.

The command syntax of Fdisk command line is “Fdisk/parameter switch”. Besides that obtained by “FDISK/？”, there are some hidden parameters information:

/ACTOK

Parameter Function: not to check bad sectors on disk surface

Details: It can speed up partition operation.

/CMBR

Parameter Function: to re-create MBR of appointed disk

Details: Equals to /MBR parameter, except that it can appoint certain disk

/EXT

Parameter Function: to create extend partition.

Details: Creates extend partition on the currency disk , which used to create logical partition.

/FPRMT

Parameter Function: to check the usage of FAT16 and FAT32 in interactive mode. Details: When /FPRMT parameter is added, there will be no query of that whether supports high-capacity hard disk; while there will be a query that it uses FAT16 or FAT32 when creating a new partition.

/LO

Parameter Function: to rebuild logical partition.

Details: Used to create logical disk, /LOG and /EXT should work together.

/LOGO

Parameter Function: to create logical partition with FAT16

/MBR

------------------------------------------------------------------------------------------------------------------------------------23 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved

Data Recovery Book V1.0  Parameter Function: to re-create MBR of master disk

Details: to clear the system booting choice recorded in MBR after uninstalling Windows NT or Windows 2000

/PRI

Parameter Function: to create primary partition and activate it.

Details: e to create primary partition, and the partition will be set active automatically.

/PRIO

Parameter Function: to create primary partition of FAT16 and activate it.

/Q

Parameter Function: not to restart computer when ending Fdisk

Details: unnecessary to restart computer after changing the partition table.

/STATUS

Parameter Function: to display details of current partition

Details: When there is no logical partition in extend partition, the extend partition will not be displayed.

/X

Parameter Function: no LBA attribute

Details: there would be no partition with LBA attribute.

It makes handier to use Fdisk with these parameters. However, to hide the parameter will be more dangerous, which calls for more caution.

Uses Fixmbr to restore MBR

Provided by Microsoft, Fixmbr is a MBR recovery tool, which determines hard disk partition and re-construct MBR through overall search.

Only when using Windows 2000 recovery console that we can use Fixmbr. Windows 2000 recovery console can boot from Windows install CD. Fixmbr only revises MBR; it does not write other sectors, which is safe. You can get help information of Fixmbr as following when using Fixmbr/？.

The parameter “DriveNo” is to write a new MBR (driver). The device name can be obtained from output of the map command. For example, device name:

/Device/HardDisk0

The following command is to write a new MBR to the appointed device:

------------------------------------------------------------------------------------------------------------------------------------24 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved Data Recovery Book V1.0
fixmar /Device/HardDisk0

Attention: If we do not assign DriverNo, the new MBR will be written in booting device, namely the driver that loads host system. If the system detects invalid or the non-standard partition mark, it will prompt that whether continue to execute this command or not. Only if there are some problems with the driver you visit; otherwise, please do not continue.

By default MBR structure will be checked. If it is abnormal, it will prompt that whether recover or not. If choose “Y”, it will search partitions. When it has found the partition, it will also prompt that whether to revise MBR or not. If choose “Y”, recovery will be finished. If the system is down now, please inactivate the anti-virus function in BIOS first and then continue.

By default, it will search all existing hard disk, and finish all mentioned operations above. If the result is not right, you may use “/Z” parameter to clear the result and restart; then it returns to the original condition.

2.Recovery of Partition

The partition recovery is generally the second step of the whole process. Because apart from some tools that directly reads and writes hard disk, most of tool software runs under operation system, working with the system calling. While operation system’s visiting disk is on the basis of MBR

and DBR; without MBR and DBR, operation system is unable to visit file system. Therefore, if the partition table is corrupted, we need rebuild partition table, which is usually fulfilled manually; in some special cases it can be done automatically by some working software.

If partition table is corrupted, there are many tools to rebuild it automatically, if only the problem is not too serious. If it is too serious, or the partition table structure is too complex, it may possibly be out of the reach of their ability to rebuild. In this case, we need do it manually. Usually we use some tool software to recover the lost partition table, such as Norton Utilities 8.0, DiskMan, KV3000/Kavfix 和 PartitionMagic etc. Here we introduce Partition Table Doctor.

3.Partition Table Doctor

Partition Table Doctor is the only real software for hard disk partitions recovery. When you come up against a drive error (not hardware failure) this versatile tool would automatically check and repair the Master Boot Record, partition table, and the boot sector of the partition with an error, to recover the FAT16/FAT32/NTFS/NTFS5/EXT2/EXT3/SWAP partition on IDE/ATA/SATA/SCSI hard disk drives. It can create an emergency floppy disk or a bootable CD to recover the bad partition even if your operation system fails to boot. Partition Table Doctor manages for MS-DOS, Freedos, Windows 95/98/Me, Windows NT 4.0, Windows 2000, Windows XP and Windows 2003. There are two modes for partition recovery: “auto mode” and “interactive mode”.

------------------------------------------------------------------------------------------------------------------------------------25 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved
Data Recovery Book V1.0  Auto mode

If you can enter operation system, you can install and run Partition Table Doctor and choose

“Rebuild Partition Table”

In the procedure of rebuilding partition table, there are two ways to recover the lost partition:

Here we mainly refer to “Automatic”, so we choose “Automatic” (after this, in the whole process the users can not operate by themselves, the software will finish the work automatically.)

------------------------------------------------------------------------------------------------------------------------------------26 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved

Data Recovery Book V1.0
Automatic will automatically rebuild and recover partition according to your former partition information. Usually we suggest this mode if users do not know much about partition. Of course, if you are not satisfied with the result, you can choose “Interactive” mode.

Interactive

Run Partition Table Doctor and choose “Interactive” in “Rebuild Partition Table”.

By this mode, Partition Table Doctor will display all the partition found, you can choose the partition you want to recover.

------------------------------------------------------------------------------------------------------------------------------------27 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved

Data Recovery Book V1.0
In the partition interface that Interactive mode has recovered, we can see clearly all the partition information that existed as well as information on file system, volume label, CHS, size and logics of the corresponding partition. With the information, user can locate the partition they want to recover. Also, to verify that whether the partition can be recovered normally and the recovered partition is the partition user want, the software provides a “Browse” function, with which we can choose the right partition:

Click “Browse” and we can get file information of partition under root directory after recovery.

------------------------------------------------------------------------------------------------------------------------------------28 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved

Data Recovery Book V1.0
And then you can be surer about the accuracy and efficiency, thus know the final result.

If the partition where your operation system locates is damaged and you cannot enter it, you can install Partition Table Doctor in another operation system,

By “Create Emergency Disk”, we can create an application under DOS to recover your partition:

------------------------------------------------------------------------------------------------------------------------------------29 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved
Data Recovery Book V1.0

Afterwards you can set your BIOS and then start from floppy disk, thus recover MBR by operation mode of Partition Table Doctor in DOS:

DBR recovery

MBR is for the whole hard disk, while DBR is for individual partition. The first sector of each MBR is DBR. Just as MBR, DBR contains some information that the boot operation system need. If DBR is corrupted, you can neither visit the partition nor start up the operation system of the partition.

If boot sector is damaged, the possible symptoms are:

1. Invalid media type reading drive

------------------------------------------------------------------------------------------------------------------------------------30 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved Data Recovery Book V1.0  2. Abort Retry Fail?

3. File system is displayed as “RAW”

4. Windows may ask if you want to format the drive

5. File names contain “weird” characters

6.”Sector not found” messages

Etc.

Moreover, for partitions of NTFS, the functions of DBR are not all the same as that of FAT

partition. For FAT partition, DBR locates FDT and FAT (correspondingly as well as DATA), but not verifying the correctness and reasonableness of FDT and FAT. For partition of NTFS, we need more units to load the file system, which is more complex than FAT.

What if when the DBR is destroyed? Usually, there are methods as following:

Recover DBR by Format

If there is no important data in this partition, or you have backed up the data, the best way to recover DBR is direct high-level format, fast format or complete format. If there is no limitation of partition form and capacity, there would be no difference between DOS format and Windows format except speed. Format is quite thorough, it can completely rearrange the data storage, even

“reset” former file fragmentation.

Although this method is simple, it cannot recover data actually especially if you choose some different parameters. If you choose different system reserved sectors, or use clusters of different size, or change the size of FAT table etc, data recovery will be more difficult.

Data recovery by Fixboot of Partition Table Doctor

If the boot sector of a Fat16/Fat32/Ntfs partition was corrupted, it will be marked with X by Partition Table Doctor. If you cannot access a Fat16/Ntfs partition and the partition was marked with X. Right click the partition and choose Fixboot. Partition Table Doctor will automatically check and restore the boot sector of the partition.

------------------------------------------------------------------------------------------------------------------------------------31 Copyright © 2005-2006 CHENGDU YIWO Tech Development Co.' Ltd. All Right Reserved

Data Recovery Book V1.0

If you cannot access the Fat32 partition and the partition was marked with X Right click the partition and choose Fixboot, there will be two choices:

'Auto' mode: Partition Table Doctor will automatically check and restore the boot sector of the partition. We recommend you choose this mode. If 'Auto' mode cannot help you, you can choose

'Interactive' mode. If so, you need input the volume label or a file name (under the root directory).

------------------------------------------------------------------------------------------------------------------------------------32  If you do not know what file name to input, follow the file name that is suggested: Boot partition:

io.sys msdos.sys ntldr bootlog.txt

Other partitions: _restore recycled

Note:

For Fat16/Fat32 partition, fixboot can effectively restore damaged boot sector of partition. For NTFS partition, even if boot sector is correct but MFT (Main File Table) is corrupted, symptoms are the same. We recommend you download the demo version of Partition Table Doctor to determine whether boot sector of partition was corrupted.

Mostly, scandisk that originally in operation system will destroy more than they retrieve. Please stop scandisk after logging on.

In addition, you may use WinHex to recover DBR

WinHex is powerful in disk editor. With backup DBR in WinHex to recover the DBR sector is convenient and fast. But for its strong specialization of WinHex we recommend that you choose easy-to-use software tool for integrity and correctness of the data.

4.The FAT table recovery

CIH destroys data backwards from partitions. In this case, system data in the former part may be destroyed and lost. If FAT2 is still intact, we may make FAT2 to cover FAT1. Usually we use DiskEdit and WinHex. Regarding to other forms of destruction such as format and so on, we usually make use of tool software to scan the whole disk, seldom manual recovery; because there are even dozens of trillions sectors a partition has several trillions. Depending on the manual analysis is impossible. For some extremely important data file, we can also recover manually.

Recover FAT by DiskEdit

After recovering DBR of FAT, if part of FAT1 is damaged while FAT2 remains intact (It is the most situation when destroyed by CIH), we may use FAT2 to cover FAT1. The specific method is to find the start sector of FAT2 and then start searching the start sector of DATA (if it is FAT16, search FDT). By this way, we can figure out the length of FAT table. According to length and the start sector of FAT2, we may know the start sector of FAT1. Copy FAT2 to the damaged FAT1, we can finally recover the whole partition.

Recover FAT by WinHex

Principle of recovering FAT by WinHex is the same as that by DiskEdit. After recovering DBR, we can make FAT2 to cover FAT1. After finding FAT2, we begin searching the start sector of DATA (if it is FAT16, search FDT). The division is distinct, because the conclusion part of FAT

must be 0 regions, otherwise there is not any free space (even so, in ordinary circumstances, there is still a bit of space in FAT after scanning DATA area. So the end of the last sector must be 0 too.). While at the beginning of DATA region or FDT region it mustn’t be 0. No matter there is fixed

------------------------------------------------------------------------------------------------------------------------------------33  for more information) FDT, the system always begins from second cluster. If there is FDT, it follows closely FAT2, and its file registration must exist; if there is not, then begins from data area where some data must

exists. Thus we may figure out the length of the FAT table, and then the start sector of FAT1 according to the length and the start sector of FAT2. Copy FAT2 to the damaged FAT1 we can finally recover this partition.