Home

At first glance recovering a disk with a missing or corrupted partition table can be a bit daughting. The steps below will assist.

It is very useful to know how the disk was partitioned - though obviously this information is not always available.

Typical setups are often as follows

• Single partition of complete drive in FAT32 or NTFS
• Dual partition of a drive, normally FAT or NTFS
• A drive that has a hidden recovery partition.  The recovery partition is often FAT16 or FAT32
• A drive with extended partitions, and more than 4 basic partitions
• A drive that has been re-partitioned with similar, or very different parameters
• A drive that 'crashed' when running a repartitiong program

The complexity increases as one goes down the list

Partitions can be located in a few different ways

• By Master Boot record
• By media BIOS
• By finding start of MFT for NTFS, or subdirectories for FAT disks
• By hand

On a good disk, the Master Boot Record (MBR) contains a table, starting at location 0x1BE. This will contain information on upto 4 partitions.  When more than 4 partitions are required, one or more of the pointers will be for an extended partition. In theory the number of partitions can be unlimited - CnW recovery handles the first 8 automatically.

Missing MBR (Master Boot Record)

When the boot sector (secvtor 0) is missing, or totally corrupted, the first approach to try is the Analyse Partitions function. Reconstruct current partitions will search for the first media bios record, and then try and scan through the disk from there.  Search for previous partitions will scan the whole disk, but will detect any possible media bios sectors.  If just the MBR has failed, then reconstruct current partitions will work.  If the disk has failed while being processed, such a repartition program, it may be best to use the Search for previous partitions.

After analyse is run, or if done manually, the partition table must have the following information, the partition type, eg NTFS, FAT16 and the Relative sector, which is the start sector of the media BIOS. The length of the partition is not critical, and if in doubt make the number too large rather than too small.

Once the valus for teh boot sector have been determined, it is possible to writethem back to the boot sector.  However, this is not actually required for the recovery process.  The program will remember the values and allow the user to do a recovery, or a trial recovery without making any physical changes to the disk. For forensic applications, this is extremely valuable.  For disks where sector zero has failed, it is not necessary to have a working sector zero.