Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Recover data from a diskpart > clean command

11 Jul 2014   #101
Anshad Edavana

Windows 7 Ultimate x64
 
 

Quote:

It did find the $MFT mirror. NTFS bootsector and backup boot sector can be reconstructed with that information.
Actually not. MFT mirror is not a copy of MFT. Typically it is 4096 bytes in size and will only contain the first four entries of MFT table. Since MFT is the main structure defining NTFS, it is not possible to keep a full backup copy.

In this case, original MFT is not lost but rather partition table, "boot sector" and backup boot sectors are lost. To rebuilt the boot sectors, a valid partition entry with correct offset information should be present. Fortunately we can rebuilt the partition table with the info found by DMDE.

Quote:
1985 sectors are overwritten.... less than 1MB.

I MB is very important than you think. I actually did some exercises which replicates OP's condition. Every time when i recovered the partition, Windows refused to identify the file system because of the zeroed out first sectors. Fortunately CHKDSK managed to recover those sectors as well as entire data.


My System SpecsSystem Spec
.
11 Jul 2014   #102
lonewolfs

Windows 10 Pro (64-bit)
 
 

Sure walk me through it and Ill do it.
My System SpecsSystem Spec
11 Jul 2014   #103
Kaktussoft

Microsoft Community Contributor Award Recipient

Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
 
 

Quote   Quote: Originally Posted by Anshad Edavana View Post
Quote:

It did find the $MFT mirror. NTFS bootsector and backup boot sector can be reconstructed with that information.
Actually not. MFT mirror is not a copy of MFT. Typically it is 4096 bytes in size and will only contain the first four entries of MFT table. Since MFT is the main structure defining NTFS, it is not possible to keep a full backup copy.

In this case, original MFT is not lost but rather partition table, "boot sector" and backup boot sectors are lost. To rebuilt the boot sectors, a valid partition entry with correct offset information should be present. Fortunately we can rebuilt the partition table with the info found by DMDE.

Quote:
1985 sectors are overwritten.... less than 1MB.

I MB is very important than you think. I actually did some exercises which replicates OP's condition. Every time when i recovered the partition, Windows refused to identify the file system because of the zeroed out first sectors. Fortunately CHKDSK managed to recover those sectors as well as entire data.
I did write it wrong indeed, sorry for that. $MFT and $MFTMirr are still intact. NTFS bootsector can be rebuilt with that information.

Indeed sector 63 to 2047 are cleared.
My System SpecsSystem Spec
.

11 Jul 2014   #104
Anshad Edavana

Windows 7 Ultimate x64
 
 

Hi

This steps should be performed in a row. We are going to do this in three phases. Please follow the below steps.

1. Download and install "PartitionGuru" from Recover deleted files, Partition manager and Windows backup - PartitionGuru

2. Open the tool and select your external HDD from the left pane. You will see the free disk space is illustrated like a cylindrical structure.

Recover data from a diskpart > clean command-1-pg.png


3. Right click on the unallocated space and choose "Create Ne Partition". You will see the new volume creation wizard. Make sure to uncheck the default tick mark at "Align to Integral Multiple of Sectors".

Recover data from a diskpart > clean command-2-pg.png


4. Press the "Advanced" button and change the beginning sector to 63 if it is not already so. Leave all other settings intact. Take a screenshot for later reference and then press OK.


Recover data from a diskpart > clean command-3-pg.png


5. Press the "Save All" button and then press Yes to the dialogue box.

Recover data from a diskpart > clean command-4-pg.png


6. Press No to the format dialogue. This is very important as choosing "Yes" may cause data loss. The format process will destroy original MFT and create an empty one. As long as the MFT is there untouched, we will be able to restore the lost partition.

Recover data from a diskpart > clean command-5-pg.png


Then close "PartitionGuru" and post a snapshot of LBA 0 using "BOOTICE".


My System SpecsSystem Spec
12 Jul 2014   #105
lonewolfs

Windows 10 Pro (64-bit)
 
 

OK I did exactly that and this is the screen of LBA 0 now

Recover data from a diskpart > clean command-2.png


My System SpecsSystem Spec
12 Jul 2014   #106
Kaktussoft

Microsoft Community Contributor Award Recipient

Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
 
 

In elevated command prompt:

Code:
diskpart
list disks  (pick the correct disk number)
select disk # (replace # with the correct number)
list part (pick the correct parition number)
select part # (replace # with the correct number)
detail part
exit
post output
My System SpecsSystem Spec
12 Jul 2014   #107
Anshad Edavana

Windows 7 Ultimate x64
 
 

So far is good. Now the MBR is updated with partition info. A single NTFS partition starting at LBA63 and it consist of 3907024002 sectors or 1907726 MB in size. Now please follow the below steps.

1. Download latest version of "TestDisk" from http://www.cgsecurity.org/testdisk-7.0-WIP.win.zip

2. Run "TestDisk" and choose "Create" to create a new log file.




3. On the second screen, choose your "External Disk" (confirm by size and model number ).




4.Choose "Intel" as the partition type.




5. Select "[Advanced] Filesystem Utils".

Recover data from a diskpart > clean command-9-testdisk.png


6. A single NTFS partition will be displayed. Make sure Boot is selected at the bottom and press Enter.

Recover data from a diskpart > clean command-10-testdisk.png


7.On the next window, select "Rebuild BS".

Recover data from a diskpart > clean command-11-testdisk.png


8.Now "TestDisk" will search for MFT and after sometime it will (hopefully) display a screen similar to the below one.

Recover data from a diskpart > clean command-13-testdisk.png


Now take a screenshot of that window (to post with next reply ).


9.Then use "Tab" key to select "Write" and press Enter. Confirm "Y" to the confirmation dialogue.

Recover data from a diskpart > clean command-14-testdisk.png


10. You should see a window similar to the below one with both "Boot sector" and "Backup Boot sector" status are displayed as OK.




11. Now close "TestDisk" and open "BOOTICE". Navigate to "LBA 63" and press "Backup to file" button. This will allow you to save LBA63 as "bin" file. Zip this file and attach with next reply along with the "TestDisk" screenshot.


Make sure not to power down or reboot the system and not to try opening or running CHKDSK against the disk until i confirm.


My System SpecsSystem Spec
12 Jul 2014   #108
lonewolfs

Windows 10 Pro (64-bit)
 
 

Here it is

Recover data from a diskpart > clean command-3.png


My System SpecsSystem Spec
12 Jul 2014   #109
lonewolfs

Windows 10 Pro (64-bit)
 
 

Did... its searching MFT. Will it take a lot of time? I think its scanning the whole disk again?
My System SpecsSystem Spec
12 Jul 2014   #110
Kaktussoft

Microsoft Community Contributor Award Recipient

Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
 
 

Quote   Quote: Originally Posted by lonewolfs View Post
Did... its searching MFT. Will it take a lot of time? I think its scanning the whole disk again?
It will take a lot of time! Follow Anshad Edavana advice. After that the volume bootsector and $MFT are fine again. I think you will get 99.9% percent of data back.

If Anshad Edavana advises you to do a chkdsk please watch carefully which files are damaged!
My System SpecsSystem Spec
Reply

 Recover data from a diskpart > clean command




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Disk - Clean and Clean All with Diskpart Command
How to "Clean" or "Clean All" a Disk with the Diskpart Command This will show you how to use the clean or clean all command on a selected disk to delete all of it's MBR or GPT partitions, volumes, and any hidden sector information on MBR disks is overwritten. The data on the HDD is not...
Tutorials
Recover Partitions from diskpart -> clean command
Hi Guys, I was trying to install windows 7 on my windows 8 laptop (UEFI) and when it didnt allow me to install win7 on partitioned drive I followed YouTube video foolishly and fired diskpart - clean command. everything gone after that. Luckily I didnt do anything after that and referred one of...
Backup and Restore
DISKPART clean performed accidently. how to recover data?
Hello everyone, I had major partition problems and tried fixmbr,fixboot,etc and even rebuilding bcd was not working. I was misguided by one of the other Forums and entered: DISKPART Select Volume 1 DISKPART Clean Volume 1 The Volume has been cleaned where volume 1 was my C...
General Discussion
diskpart / clean, format by accident , need to recover data
Hello, I know it's stupid but i diskpart/clean and formatted while installing windows from cmd, it's a new laptop so i had no other data just (i don't remember exactly) 100GB not more. i installed windows on that formatted disk. I had all data on D Disk (500GB) and now i have only one disk which...
Backup and Restore
Should I clean my HDD with Parted Magic or Diskpart clean all command?
Hi everyone i have a question about HDD Clean and also question about Win 7 64 bit :) I want to wiped out my all HDD data inside i want to delete all information like a brand new HDD. I heard that there is a program called Parted Magic can do this and also Diskpart clean all command too. ...
General Discussion


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 18:49.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App