recover an NTFS volume or partition
It is possible that if you format an NTFS drive that the data still exists and can be recovered. While nothing is guaranteed here, it is a way to possibly get back what you think you have lost for eternity.
When you delete a dynamic volume, the OS erases the volume's file-system boot sector (sector-0) and removes the volume entry from the Microsoft Management Console (MMC) Disk Management snap-in private region database. However, as part of this process, the OS leaves the rest of the drive intact, including the data.
Since a backup copy of the boot sector is kept, you can copy this boot sector back to sector-0 and restore the volume as long as you know the original volume size.
- Recreate the original volume
- open the MMC snap-in
- Start
- Programs
- Administrative Tools
- Computer Management
- select Storage
- specify the partition parameters
- right-click on the unpartitioned space
- select "new partition" from the context menu
- specify the exact size of the original volume
Note 1: don't format the volume
Note 2: you must know the original volume size to recreate the volume because the MMC Disk Management snap-in rounds partition sizes.
- Find the backup boot sector
use DMDIAG.EXE
- recover the backup boot sector for the NTFS volume from the end of the deleted dynamic volume
use DSKPROBE.EXE
- mount the volume for immediate use
This is not necessary if you will do a reboot immediately
- open the MMC snap-in
- Start
- Programs
- Administrative Tools
- Computer Management
select RESCAN
When you delete a dynamic volume, the OS erases the volume's file-system boot sector (sector-0) and removes the volume entry from the Microsoft Management Console (MMC) Disk Management snap-in private region database. However, as part of this process, the OS leaves the rest of the drive intact, including the data. Both FAT32 and NTFS store a backup copy of the boot sector. You can copy this boot sector back to sector-0 and restore the volume as long as you know the original volume size.
This article is based on Microsoft article #153973
"Recovering NTFS boot sector on NTFS partitions"
- Recreate the original volume
- open the MMC snap-in
- Start
- Programs
- Administrative Tools
- Computer Management
- select Storage
- specify the partition parameters
- right-click on the unpartitioned space
- select "new partition" from the context menu
- specify the exact size of the original volume
Note 1: don't format the volume
Note 2: you must know the original volume size to recreate the volume because the MMC Disk Management snap-in rounds partition sizes.
- Find the backup boot sector
use DMDIAG.EXE
- recover the backup boot sector for the NTFS volume from the end of the deleted dynamic volume
use DSKPROBE.EXE
- mount the volume for immediate use
This is not necessary if you will do a reboot immediately
- open the MMC snap-in
- Start
- Programs
- Administrative Tools
- Computer Management
select RESCAN
Comments
No it isn't a simple unerase-like utility which may be good or bad. But according to some of the reviews that is why it is so slow and why it can't do a 100% recovery. But I can make three statements here:
1) The reviews were mixed enough that I trust both the reviews and DiskInternals. Actually I was a little skeptical of them since it sounded like their marketing people were biggybacking off of SysInternals good name-- not a good thing. But the descriptions of technical details sounded reasonable (I'm not an expert here).
2) The claims that is was slow and it didn't find 100% were reasonable if it truly is scanning the surface of the drive. This makes me skeptical again since this is something that I don't think 2000/XP/VISTA allows. You have to go through their abstraction layers instead of reading the file directly. I believe that was put in place to discourage root kits.
Post new comment