Volume Recovery Concepts
System Boot Process
In most cases, the first indication of a problem with a hard drives data is a refusal of the machine to boot properly. For the computer to be able to find its start-up partition and to start booting, the following conditions must apply:
- Master Boot Record (MBR) or GIUD Partition Table (GPT) exists and is uncorrupted
- Partition Table exists and contains at least one Active partition
- Active partition contains all of the required system files in a healthy (uncorrupted) state
If all of the conditions mentioned above are met, the executable code in the MBR selects the active partition and passes control to it, so it can start loading the standard files (COMMAND.COM, NTLDR, BOOTMGR...), depending on the OS and the file system type on that partition. If these files are missing or corrupted it will be impossible for the OS to boot. You understand the situation if you have ever seen the infamous "NTLDR is missing ..." error message.
A more serious situation exists if your computer will start and cannot see a drive partition*. For the partition to be visible to the Operating System the following conditions must apply:
- Partition/Drive can be found via Partition Table
- Partition/Drive/Volume boot sector is safe
- Volume system areas (MFT, Root) are safe and accessible
If the above conditions are true, the Operating System can read the partition or physical drive parameters and display the drive in the list of the available drives.
If the file system is damaged (Root areas on FAT12/FAT16/FAT32/exFAT, or Master File Table (MFT) records on NTFS) the drive's content might not be displayed and we might see errors like "MFT is corrupted", or "Drive is invalid" ... If this is the case it is less likely that you will be able to restore your data in full. Do not despair, as there may be some tricks or tips to display some of the residual entries that are still safe, allowing you to recover your data to another location.
Partition Recovery Includes
- Physical partition recovery. The goal is to identify the problem and write information to the proper place on the hard drive (to MBR and Boot Sectors) so that the partition becomes visible to the Operating System again. This can be done using manual Disk Editors along with proper guidelines or using partition recovery software, designed specifically for this purpose.
- Virtual partition recovery. The goal is to determine the critical parameters of the deleted/damaged/overwritten partition and render it open to scanning in order to display its content to copy important data to the safe place. This approach can be applied in some cases when physical partition recovery is not possible (for example the partition boot sector is dead and physically unreadable) and is commonly used by file recovery software. This process is almost impossible to implement manually, but can be accomplished using Active@ File Recovery software.
Other Hard Drive Partition Recovery Topics
These topics are related to the recovery of partitions and apply to any supported file system:
- Master Boot Record (MBR) is damaged
- Partition is deleted or Partition Table is damaged
- Partition Boot Sector is damaged
- Missing or Corrupted System Files
For these topics the following disk layout will be used in the examples:
The figure shows a system with two primary partitions - C: (NTFS) and H:(FAT) and one extended partition having two logical drives - D: (FAT) and E: (NTFS)
*Note that if your computer has two operating systems and you choose to start in Windows 95/98/ME or Linux, these operating systems cannot see partitions that are formatted for NTFS. This is normal operation for these operating systems. To view NTFS partitions, you must be in a Windows NT/2000/XP/2003/2008/Vista/7/8 environment.