In this article, we’ll discuss the different approaches to recover files from disks with missing partitions, messed up partition tables and/or MBR record.
Contents
The Missing Partition
How can you end up with a hard drive having no valid partitions? In fact, it’s easier than one might think. Experiments with alternative operating systems (Ubuntu is the current leader), worn or corrupted hard drives, (rarely) malware activities and (frequently) user actions can and do cause severe damage to the disk’s system structures.
Fortunately, due to the way the operating system is handling the data, your chance of ruining your entire disk or partition are pretty low – unless you spend time and effort deliberately destroying information. More often than not, you will be able to recover the missing data in one way or another. Let’s have a look at your options.
Option 1: File Carving
If you followed our blog, you may already know that today’s data recovery algorithms have gone a long way in recovering information from storage media with missing (or damaged) system structures. As a reminder, data recovery tools such as RS Partition Recovery will scan the disk surface in low level attempting to locate known types of files by detecting their characteristic signatures.
While this approach is great as a last resort, it’s not without its limitations. First, the file names will likely be lost. Second, fragmented files won’t be recovered (you’ll only get the first fragment). Third, while modern data recovery tools can carve for several hundred file formats, they still can’t recover all types of files. Many, but not all. As a result, you’ll be better off using the file system… if you can find one.
Option 2: Carving for Partitions
Fortunately, some of the better data recovery tools out there recognize the limitations imposed by signature-search recovery, and offer a more advanced option. However, the procedure is a bit complex, so let’s have a deeper look at what will be happening if you use RS Partition Recovery to recover your data.
Step 1: Adding the Physical Device
When recovering information from a storage device with missing partitions, you’ll need to specify that device first. Note that adding a physical device is different from adding a logical disk, volume or drive letter. As a rule of thumb, there will be NO DRIVE LETTERS AVAILABLE for hard drives with missing partitions. Use the following window to add a physical device:
Step 2: Carving Partitions
Correctly executing this step is extremely important for recovering your information. If the tool is able to correctly identify your original partitions and locate the original file system, you may be able to recover all or most of your data completely – even if your disk was fragmented.
In order to understand how the carving process works, let’s first have a look at what happens if you attempt to install Ubuntu onto a Windows hard drive.
A typical Windows hard drive is partitioned into several volumes. If we’re talking about a system disk that contains Windows itself, first comes system reserved space.
A “System Reserved” partition is created by Windows 7, 8 and later versions (including Windows Server 2008 R2 and newer) when they are installed on a clean disk. Earlier versions of Windows don’t use System Reserved partitions; however, many manufacturers used to have a Recovery Partition in its place containing a recovery image allowing users to perform a factory reset of their computer. Note that neither of these partitions has a drive letter assigned to them, so you can only see them if you use the Disk Management applet or a similar tool. Windows 7 reserves 100 MB, while Windows 8 uses 350 MB of system reserved space.
The content of System Reserved partitions is out of scope of this article. What you should know, however, is the fact that these partitions are created at the very beginning of the disk, and that they can serve as a buffer when your disk is repartitioned by an alternative OS.
When you install an alternative OS such as Ubuntu, the thing will create its own partitions. Normally there will be at least two new partitions, a root partition and a swap partition, and sometimes a separate /boot partition. In other words, your original Windows partition structure will be messed up, with new partitions replacing the old ones.
The new partitions will have their own file systems (ext3 or ext4 are common with Linux-based systems), and the new OS will store files in these partitions, thus irrecoverably overwriting some of your data. Fortunately, the new data will be stored at the beginning of a new partition, so System Reserved space will be overwritten first, and then most probably the original Windows system files will be overwritten. Why is this good news? Because your files are likely stored somewhere towards the middle of the disk, right after Windows system files, hibernation file, page file, and any applications you installed. As a results, most of your data will likely remain recoverable.
Getting back to recovering the original partitions, RS Partition Recovery will scan the disk and apply signature-search techniques, only this time it won’t be looking for your files. Instead, it’ll look for characteristic signatures identifying known file systems such as FAT32 and NTFS. The chance of finding a working copy of the file system is pretty high, as NTFS maintains a backup copy of its Master File Table (MFT) somewhere towards the middle of the disk. If Partition Recovery can locate a working copy of a file system, it will display the list of logical partitions, allowing you to add them into the list of recoverable partitions:
Step 3: Recovering Files
The rest is fairly easy. At this step, you’ll perform the actual recovery, as in looking for files and recovering them onto a new storage device. If RS Partition Recovery was able to discover a copy of the original file system, the tool will not need to resort to file carving in order to recover the files. Instead, you’ll be browsing through the file and folders structure of the deleted partition in an Explorer-like interface:
Please note that most likely you won’t be able to simply “restore” the original partition structure, as some data is irreversibly overwritten. As a result, even if you were able to return all the original system structures, you would end up with an unbootable, unusable system. Instead, we recommend extracting your files and settings such as documents, pictures, emails, browser bookmarks and similar data.
In Windows, user data is typically stored in the “C:\Users\” folder and its subfolders. This folder contains documents (“c:\Users\YourUserName\Documents”), your browser bookmarks (“c:\Users\YourUserName\Favorites”), your address book (“c:\Users\YourUserName\Contacts”), anything you place on the desktop (“c:\Users\YourUserName\Desktop”), as well as music, saved games, pictures, and application settings. In addition, this folder contains a copy of user-specific part of the Windows Registry, which may also contain some usable information.
When you are finished copying your files, spend some time checking the data you have saved. Do your pictures show up in the viewer? Can you open all of your documents? Are any important files missing or corrupted? If you can’t find some information, you can perform a thorough scan of the original disk, this time using signature search to detect and recover any remaining files.
Recover data and repair corrupted partitions
