File Recovery and Deleted Partition recovery

Partition is deleted or Partition Table is damaged

The information about primary partitions and an extended partition is contained in the Partition Table, a 64-byte data structure, located in the same sector as the Master Boot Record (cylinder 0, head 0, sector 1). The Partition Table conforms to a standard layout, which is independent of the operating system. The last two bytes in the sector are a signature word for the sector and are always 0x55AA.

Here is a Partition Table which will be used as an example:

There are three existing and one empty entry:

Each Partition Table entry is 16 bytes long, making a maximum of four entries available. Each partition entry has fields for Boot Indicator (BYTE), Starting Head (BYTE), Starting Sector (6 bits), Starting Cylinder (10 bits), System ID (BYTE), Ending Head (BYTE), Ending Sector (6 bits), Ending Cylinder (10 bits), Relative Sector (DWORD), Total Sectors (DWORD).

Thus, the MBR loader can assume the location and size of partitions. The MBR loader looks for the "active" partition, i.e. the partition that has a Boot Indicator equal to 0x80 (the first one in this case) and passes control over to the partition boot sector for further loading.

Consider the situations which cause a computer to hang up while booting or hang up due to data loss.

1. What will happen if no partition has been set to the Active state (Boot Indicator=0x80)?

2. What will happen if the partition has been set to an Active state (Boot Indicator=0x80) but there are no system files on that partition?

3. What will happen if a partition entry has been deleted?

4. What will happen if a partition entry has been damaged?

How can recovery software help you in the above-mentioned scenarios?

  1. Discover and suggest which partition is to be set as active (FDISK also does this).
  2. Perform a disk scan of the free space to look for a partition boot sector or remnants of deleted partition information in order to try to reconstruct the Partition Table entry for the deleted partition.
  3. Perform disk scan on all space to look for partition boot sector or remnants of deleted partition information in order to try to reconstruct the Partition Table entry for the deleted partition.

Why is the partition boot sector so important?

It contains all the necessary information about the partition so that if recovery software finds it, it can reconstruct the partition entry in the Partition Table. (see Partition Boot Sector topic for details).

What would happen if a partition entry had been deleted then recreated with other parameters and re-formatted?

In this case, a new partition would exist instead of the original one.

Everything would work properly with the exception that you could not go back to the original partition if important data is still there.

If you've created a MBR, a Partition Table, or a Volume Sectors backup beforehand (as can be done with Active@ Partition Recovery and Active@ UNERASER for example), you can virtually restore it and look for your data (in the case it has not yet been overwritten by new data).

Some advanced recovery tools also have an ability to scan disk surfaces and try to reconstruct previously deleted partition information from the pieces of left over information (i.e. perform virtual partition recovery). However it is not guaranteed that you can recover something.