Home

Some times a disk is lost because a new operating system is loaded.  This is normally accidental, but malicious cases are also known. The major problem with data recovery is that the disk is probably working OK, and looks OK, but has not got any relevant user data.

The procedure to overcome ths situation invloves reconfiguring the partition table to look for the older type of operating system, and probably reconfigure the media partition data parameters.  This is not as complex as it sounds, and with CnW Software, each attempt can be tried and tested, so some element of trial and error can be used.

If a case such as this is considered possible, it is more important than ever that the disk is worked on as a data disk, and not try to run any programs on the disk.

An example could be if somebody has installed Linux over an NTFS partition. If the partition data is displayed, then a  valid Linux disk will be seen, and no sign of the existing NTFS disk. As long as the Linux has not overwritten actual files, there is a good chance of data recovery.

There are two basic stages to be performed

• Set the partition to correct operating system
• Set the operating system details

Set partition for operating system

From the main data screen, select Partitions.  For the purpose of this example we will assume that the original disk just had a single partition with NTFS.  This is a very typical configuration, but certain manufacturers, such as Dell actually partition the main drive into 3 partitions to allow for certain data recovery procedures.  (This means that the main data partition does not start at the start of the disk.)

For the first partition, select the operating system to be NTFS, and the relative sector should be 63 or 0x3f. The value 63 is true in over 95% of cases, for the first partition.  The total number of sectors should be taken from the highest total number of sectors displayed in the list.  The value is not too critical, but setting it too high will slow down possible recovery, and too low may miss some files.

The Cly, head, and sect values are only displayed, and not actually used. They need not be set to any particular value.

It should be noted that these new values will be remembered by the program, even though they are not written to the disk

Operating system details

When Recover is selected, the NTFS Recovery screen is displayed.  Often in cases with the operating system overwritten, there will be no meaningful information on this screen, and it will be necessary to locate the MFTs and media partition sector. One bit of useful information is that many NTFS disks use the same basic parameters and the following paramters can be tried - the values are in Hex

• Start Scan                0
• End Scan                        Size of drive, a fairly large number
• MFT Start Cluster                0xc0000
• MFT Start Sector                0x60003f
• MFT entries                0x20000
• Cluster size                0x8

There is a function button, Search for MFTs.  This will scan the disk for first run of MFTs. It will try and verify that the MFT is part of a main directory, and not as often happens, just an MFT sector that has been moved somewhere.  This value can then be entered into the main screen.