NTFS Partition Recovery Concepts - I

by Sharan R

Partition Recovery Concepts

For the machine to be able to start booting properly, the following conditions should apply:
  • Master Boot Record (MBR) exists and is safe
  • Partition Table exists and contains at least one active partition
If so, executable code in MBR selects an active partition and passes control there, thus it can start loading proper files (COMMAND.COM, NTLDR, ... ) depending on the file system type on that partition.

However, if these files are missing or corrupted then OS will be unbootable - remember the famous error "NTLDR is missing ..." ? In this case recovery software accesses this drive on the low level bypassing system boot (for example, if you boot from another HDD or bootable floppy) and will help you to see all other files and directories on the drive and allow you to copy to the safe place onto another drive.
For the partition/drive to be visible to the Operating System the following conditions should apply:
  • Partition/Drive can be found via Partition Table
  • Partition/Drive boot sector is safe
If so, OS can read partition/drive parameters and display drive in the list of the available drives. However, if the file system itself is damaged (Root, FAT area on FAT12/FAT16/FAT32, or system MFT records on NTFS) drive's content might not be displayed  and we might see errors like "MFT is corrupted", "Drive is invalid" ... In this case you have less chances to restore your data in compare to the case where OS is not bootable due to the missing or corrupted system files, however recovery software usually uses some tricks to display may be not all but some of the entries that are still safe and allow you to save your data to another location.

Under "Partition recovery" we mean two things:
  1. "Physical partition recovery". The goal is to find out the problem and write some information to the proper place on HDD and after that partition becomes visible to OS again. You can do it manually using Disk Editors and some guidelines or use recovery software, designed for this purpose.
  2. "Virtual partition recovery". The goal is to determine the critical parameters of the deleted/damaged/overwritten partition and after that enable to scan it and display its content. This approach can be applied in some cases when physical partition recovery is not possible (for example, partition boot sector is dead) and is commonly used by recovery software. It's very hard (almost impossible) to implement it manually.
Lets consider the topics, related to the recovery of partitions in common, not specific to the particular file system. We have the following cases:

  • MBR is damaged
  • Partition is deleted or Partition Table is damaged
  • Partition Boot Sector is damaged
  • Missing or Corrupted System Files

source:ntfs.com
0 Response to 'NTFS Partition Recovery Concepts - I'

Post a Comment