It is possible that if you format an NTFS drive that the data still exists and can be recovered. While nothing is guaranteed here, it is a way to possibly get back what you think you have lost for eternity.
When you delete a dynamic volume, the OS erases the volume's file-system boot sector (sector-0) and removes the volume entry from the Microsoft Management Console (MMC) Disk Management snap-in private region database. However, as part of this process, the OS leaves the rest of the drive intact, including the data.
Since a backup copy of the boot sector is kept, you can copy this boot sector back to sector-0 and restore the volume as long as you know the original volume size.
- Recreate the original volume
open the MMC snap-in
- Start
- Programs
- Administrative Tools
- Computer Management
- select Storage
specify the partition parameters
- right-click on the unpartitioned space
- select "new partition" from the context menu
- specify the exact size of the original volume
Note 1: don't format the volume
Note 2: you must know the original volume size to recreate the volume because the MMC Disk Management snap-in rounds partition sizes.
- Find the backup boot sector
use DMDIAG.EXE
- recover the backup boot sector for the NTFS volume from the end of the deleted dynamic volume
use DSKPROBE.EXE
- mount the volume for immediate use
This is not necessary if you will do a reboot immediately
open the MMC snap-in
- Start
- Programs
- Administrative Tools
- Computer Management
select RESCAN
When you delete a dynamic volume, the OS erases the volume's file-system boot sector (sector-0) and removes the volume entry from the Microsoft Management Console (MMC) Disk Management snap-in private region database. However, as part of this process, the OS leaves the rest of the drive intact, including the data. Both FAT32 and NTFS store a backup copy of the boot sector. You can copy this boot sector back to sector-0 and restore the volume as long as you know the original volume size.
This article is based on Microsoft article #153973
"Recovering NTFS boot sector on NTFS partitions"
- Recreate the original volume
open the MMC snap-in
- Start
- Programs
- Administrative Tools
- Computer Management
- select Storage
specify the partition parameters
- right-click on the unpartitioned space
- select "new partition" from the context menu
- specify the exact size of the original volume
Note 1: don't format the volume
Note 2: you must know the original volume size to recreate the volume because the MMC Disk Management snap-in rounds partition sizes.
- Find the backup boot sector
use DMDIAG.EXE
- recover the backup boot sector for the NTFS volume from the end of the deleted dynamic volume
use DSKPROBE.EXE
- mount the volume for immediate use
This is not necessary if you will do a reboot immediately
open the MMC snap-in
- Start
- Programs
- Administrative Tools
- Computer Management
select RESCAN
Comments
to clarify
It seems I didn't make it clear that this isn't a way to recover files but the file system itself. If you think the directory structure has been corrupted, either because of a natural disaster or a virus then you this may help you.
This is another reason to keep your computer completely inventoried; all software (vendor and any numbers) and all hardware (vendor, any numbers, and all characteristics like the size of drive, the type of interface, etc).
Post new comment