If you are using computers for a decent amount of time you have probably realized that storing the data on any device, including Hard Drive, is not absolutely safe. The danger comes from the possibility of the Hard Drive breakdown or from accidental user-imposed errors causing disappearance of the most valuable data. In this basic guide, we will deal with the most common problems, when there are no mechanical or electronic problems in the Hard Disk, but the data was accidentally removed, damaged, or corrupted by the user, or when the damage occurred due to the software crash on the computer.
Statistics about leading causes of data loss
- Hardware Malfunction - 44 Percent of all Data Loss
- User Error - 32 Percent of all Data Loss
- Software Corruption - 14 Percent of all Data Loss
- Computer Viruses - 7 Percent of all Data Loss
- Natural Disasters - 3 Percent of all Data Loss
Basically, we may define the two major categories of the problems we will have to deal for the matter of the data recovery. One is related to the deleted or damaged partition, and the second - to the stand-alone individual files to be recovered. Before address partition repair or recovery, we have to understand the file systems basics utilized on your PC.
A
file system is a method an operating system uses to arrange data and free space on a hard drive or other storage device so it can be written to and read from. File systems create partitions which are areas of free space than can be addressed by the file system and seen as a logical drives (C: D: etc.) to be written to and read from.
The two file systems used by the various Windows operating systems are NTFS (NT File System) and FAT (File Allocation Table). FAT is an earlier file system, used first in DOS as FAT-16, then later in Windows 9x/ME as FAT-32.
The only major difference between FAT-16 and -32 is in the amount of data they can address. FAT-16 can only use up to 2GB of space on each logical drive, and FAT-32 has no such limitation. Later Microsoft operating systems like Windows 2000 and XP are fully compatible with FAT, even if it is not the default method they use to store files.
NTFS is used in Windows NT, 2000 and XP and provides a more secure and efficient method of file storage. In addition to allowing security to be implemented on individual files, NTFS also stores backup copies of essential disk information to aid in recovering from disaster.
Both file systems use the
Master Boot Record (MBR) and partition table, found in the first sector of each hard drive or storage device. The MBR and partition table determine which partition(s) on the disk are bootable, and locate and pass control to that partition to boot the operating system.
If the MBR or partition table is damaged, the drive will become unbootable, and may appear to be blank if the partition information has been erased.
NTFS Partitions
The first
sector of NTFS partitions is reserved for the partition boot sector. This contains the information that allows the OS to read the partition. Without it, the partition cannot be accessed.
By its nature, NTFS keeps a backup copy of the boot sector on the last sector of the partition which can allow recovery programs to restore it. The FAT equivalent of this is also called the boot sector, and resides on the first sector of the partition. The difference is that FAT does not keep a backup copy of this information, making recovery much more difficult...
The first
file stored on an NTFS partition is the
Master File Table (MFT) which is essentially a listing of the names, properties and locations of all the other files in the partition. This is referenced by the operating system to access individual files.
NTFS stores a backup copy of this file. Data restoration software will attempt to access or restore a copy of the MFT in order to access files on the partition.
FAT partitions use something similar, called predictably enough the
File Allocation Table (FAT). The FAT is also backed up on the disk, and can be restored by software. The major disadvantage of the FAT as compared to the MFT is that it needs to be located on a specific area of the partition to function, so if that area of the disk is damaged, recovery can be difficult.
When a file is deleted (removed from the recycle bin within Windows), both file systems simply mark the file as deleted. The data is
not actually removed from the drive, but rather the space it takes up on the disk is now considered to be free. Consequently, if you delete a file accidentally, you have an excellent chance of being able to restore it provided you do not write more information to the disk.
Steps to recovery
The number one rule to follow when you have lost data is to not write anything more to the affected hard drive! This rule stands true for any situation...
If you have deleted a partition by accident, do not create another partition, just leave it blank.
If you have deleted files from the recycling bin that you realize you need, do not (if possible) save anything to the drive. The reason for this is that hard drives do not actually erase anything, not data or partitions. When you erase a file from the operating system, it is just marked on the drive as
having been deleted. When the system needs to store more data on the drive, it will consider files on the drive marked ’deleted’ as being empty space, and cheerfully copy over them. If that happens then you’re in big trouble.
The same rule applies twice over for partitions; since partition information just presents the operating system with a way of addressing the space available on the drive. If you wipe out a partition everything from it will seem to be gone.
So if there is no partition information, no data can be read by the operating system. This
does not mean that your data it is not there however, only that you can’t see it. Data-recovery programs have no such handicap. So, the easiest way to access your data is move the corrupted drive with inaccessible partition to a different computer and install it as slave. A good chance it that now you will be able to access your files with no problem. Backup your data and you can attempt any other recovery steps, being confident that at least data is safe.
If you do not have the means to physically transfer the hard disk, resist the temptation to re-install your OS. There are several software tools available which will enable you to boot your computer with an alternative operating system and then help you try to recover the files.
The simplest way to gain access to the files on your hard drive with a toasted OS is boot your computer with a DOS boot disk and then use a DOS compatible file recovery program.
Note that if you have a single hard drive with a single partition that is no longer bootable, file recovery becomes instantly more difficult. Most recovery programs will need a place to copy recovered data, and if you are using the same drive which has the lost data on it you have no guarantee that you will not be destroying more data than you save. It’s a far better idea to either install a new hard drive onto the current system and put a new OS on that, or find another computer to transfer the lost hard drive to.
If you have installed your hard drive into another computer, or if you have put a new drive with a separate OS into your current machine in order to boot, you now have a couple of advantages: Firstly, You can attempt to access your lost data normally through Windows File Explorer. This will not work if the partition information has been changed, since the OS will not ’see’ the logical drives.
Secondly, you can safely play with recovering your files, since you now have a completely separate hard drive on which to put recovered data without compromising the source (lost) drive.
When your data is safe (hopefully you were able to back it up) you can attempt to repair the lost partition with the free utilities, presented in the software section of this site. The same will be relevant for the second category of the problem - files restoration (undelete) utilities as well.
Posts
