The first
sector of NTFS partitions is reserved
for the partition boot sector. This contains the information that allows the OS to read
the partition. Without it, the partition cannot be accessed.
By its nature, NTFS keeps a backup copy of the boot sector on the
last sector of the partition which can allow recovery programs to restore it.
The FAT equivalent of this is also called the boot sector, and resides on the
first sector of the partition. The difference is that FAT does not keep a backup
copy of this information, making recovery much more difficult...
The first
file stored on an NTFS partition is the Master
File Table(MFT)
which is essentially a listing of the names, properties and locations of all the other files in
the partition. This is referenced by the operating system to access individual files.
NTFS
stores a backup copy of this file. Data restoration software will attempt to access or restore
a copy of the MFT in order to access files on the partition.
FAT
partitions use something similar, called predictably enough the File
Allocation Table (FAT). The FAT is also backed up on the disk, and can be
restored by software. The major disadvantage of the FAT as compared to the MFT
is that it needs to be located on a specific area of the partition to function,
so if that area of the disk is damaged, recovery can be difficult.
When a
file is deleted (removed from the recycle bin within Windows), both file systems
simply mark the file as deleted. The data is not actually removed from the
drive, but rather the space it
takes up on the disk is now considered to be free. Consequently, if you delete a
file accidentally, you have an excellent chance of being able to restore it
provided you do not write more information to the disk.
In my situation, I had two NTFS partitions on the
effected disk. When I ran FDISK, it wrote garbage information over
certain areas of this disk, including areas of both partitions. As a result,
the first partition (the one with my article on it) had lost
its partition boot sector, meaning it could not be accessed normally by an
operating system. The second partition had merely had crucial system files overwritten,
and was unbootable, but still fully accessible once I transferred the disk to
another computer.
Thankfully there is a way to fix all of this, and get the
data back!
First, a
small disclaimer: All the processes described from here on are strictly for resolving software issues with your data, like accidentally deleting partitions or files. If your hard drive has a physical problem, if it is making strange noises, shaking, rattling or smoking, nothing here will apply. Turn your computer off, unplug the drive and call a data recovery service if your files are vital.
|
Who to turn to for Professional Data Recovery Services? |
- PCSTATS has paid Actionfront.com to do critical data recovery for us in the past. The company works with Seagate hard drives only and has since changed ownership to become Seagate Recovery Services. Multiple GBs of data was recovered for a cost
of around $1,600. - Another reputable company is OnTrackDataRecovery.com. It has a piece of software called Ontrack EasyRecovery 6.X Standard Edition that works well in most data-loss situations. We've used this
program to recover lost partitions and deleted files but have never contracted OnTrack for physical hard drive data recovery services. The software retails for $200. Cost of OnTrack's professional hard drive data recovery is based on how damaged the disk is.
|
| Comments and Feedback? |
Disclaimer: Attempting to self-service your hard drive may only make things worse. If you wish to accept the risks and attempt data recovery yourself, PCSTATS lays out the step to data recovery next...
RSS Newsletter
