Recover data from a diskpart > clean command

Anshad Edavana said:

It did find the $MFT mirror. NTFS bootsector and backup boot sector can be reconstructed with that information.

Actually not. MFT mirror is not a copy of MFT. Typically it is 4096 bytes in size and will only contain the first four entries of MFT table. Since MFT is the main structure defining NTFS, it is not possible to keep a full backup copy.

In this case, original MFT is not lost but rather partition table, "boot sector" and backup boot sectors are lost. To rebuilt the boot sectors, a valid partition entry with correct offset information should be present. Fortunately we can rebuilt the partition table with the info found by DMDE.

1985 sectors are overwritten.... less than 1MB.

I MB is very important than you think. I actually did some exercises which replicates OP's condition. Every time when i recovered the partition, Windows refused to identify the file system because of the zeroed out first sectors. Fortunately CHKDSK managed to recover those sectors as well as entire data.

I did write it wrong indeed, sorry for that. $MFT and $MFTMirr are still intact. NTFS bootsector can be rebuilt with that information.

Indeed sector 63 to 2047 are cleared.

Hi

This steps should be performed in a row. We are going to do this in three phases. Please follow the below steps.

1. Download and install "PartitionGuru" from Recover deleted files, Partition manager and Windows backup - PartitionGuru

2. Open the tool and select your external HDD from the left pane. You will see the free disk space is illustrated like a cylindrical structure.




3. Right click on the unallocated space and choose "Create Ne Partition". You will see the new volume creation wizard. Make sure to uncheck the default tick mark at "Align to Integral Multiple of Sectors".




4. Press the "Advanced" button and change the beginning sector to 63 if it is not already so. Leave all other settings intact. Take a screenshot for later reference and then press OK.





5. Press the "Save All" button and then press Yes to the dialogue box.




6. Press No to the format dialogue. This is very important as choosing "Yes" may cause data loss. The format process will destroy original MFT and create an empty one. As long as the MFT is there untouched, we will be able to restore the lost partition.




Then close "PartitionGuru" and post a snapshot of LBA 0 using "BOOTICE".

In elevated command prompt:

Code:

diskpart
list disks  (pick the correct disk number)
select disk # (replace # with the correct number)
list part (pick the correct parition number)
select part # (replace # with the correct number)
detail part
exit

post output

lonewolfs said:

Did... its searching MFT. Will it take a lot of time? I think its scanning the whole disk again?

It will take a lot of time! Follow Anshad Edavana advice. After that the volume bootsector and $MFT are fine again. I think you will get 99.9% percent of data back.

If Anshad Edavana advises you to do a chkdsk please watch carefully which files are damaged!