Recover data from a diskpart > clean command

Page 11 of 13 FirstFirst ... 910111213 LastLast

  1. Posts : 562
    Windows 7 Ultimate x64
       #101


    It did find the $MFT mirror. NTFS bootsector and backup boot sector can be reconstructed with that information.
    Actually not. MFT mirror is not a copy of MFT. Typically it is 4096 bytes in size and will only contain the first four entries of MFT table. Since MFT is the main structure defining NTFS, it is not possible to keep a full backup copy.

    In this case, original MFT is not lost but rather partition table, "boot sector" and backup boot sectors are lost. To rebuilt the boot sectors, a valid partition entry with correct offset information should be present. Fortunately we can rebuilt the partition table with the info found by DMDE.

    1985 sectors are overwritten.... less than 1MB.

    I MB is very important than you think. I actually did some exercises which replicates OP's condition. Every time when i recovered the partition, Windows refused to identify the file system because of the zeroed out first sectors. Fortunately CHKDSK managed to recover those sectors as well as entire data.
      My Computer


  2. Posts : 42
    Windows 10 Pro (64-bit)
    Thread Starter
       #102

    Sure walk me through it and Ill do it.
      My Computer


  3. Posts : 10,796
    Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
       #103

    Anshad Edavana said:

    It did find the $MFT mirror. NTFS bootsector and backup boot sector can be reconstructed with that information.
    Actually not. MFT mirror is not a copy of MFT. Typically it is 4096 bytes in size and will only contain the first four entries of MFT table. Since MFT is the main structure defining NTFS, it is not possible to keep a full backup copy.

    In this case, original MFT is not lost but rather partition table, "boot sector" and backup boot sectors are lost. To rebuilt the boot sectors, a valid partition entry with correct offset information should be present. Fortunately we can rebuilt the partition table with the info found by DMDE.

    1985 sectors are overwritten.... less than 1MB.

    I MB is very important than you think. I actually did some exercises which replicates OP's condition. Every time when i recovered the partition, Windows refused to identify the file system because of the zeroed out first sectors. Fortunately CHKDSK managed to recover those sectors as well as entire data.
    I did write it wrong indeed, sorry for that. $MFT and $MFTMirr are still intact. NTFS bootsector can be rebuilt with that information.

    Indeed sector 63 to 2047 are cleared.
      My Computer


  4. Posts : 562
    Windows 7 Ultimate x64
       #104

    Hi

    This steps should be performed in a row. We are going to do this in three phases. Please follow the below steps.

    1. Download and install "PartitionGuru" from Recover deleted files, Partition manager and Windows backup - PartitionGuru

    2. Open the tool and select your external HDD from the left pane. You will see the free disk space is illustrated like a cylindrical structure.

    Recover data from a diskpart > clean command-1-pg.png


    3. Right click on the unallocated space and choose "Create Ne Partition". You will see the new volume creation wizard. Make sure to uncheck the default tick mark at "Align to Integral Multiple of Sectors".

    Recover data from a diskpart > clean command-2-pg.png


    4. Press the "Advanced" button and change the beginning sector to 63 if it is not already so. Leave all other settings intact. Take a screenshot for later reference and then press OK.


    Recover data from a diskpart > clean command-3-pg.png


    5. Press the "Save All" button and then press Yes to the dialogue box.

    Recover data from a diskpart > clean command-4-pg.png


    6. Press No to the format dialogue. This is very important as choosing "Yes" may cause data loss. The format process will destroy original MFT and create an empty one. As long as the MFT is there untouched, we will be able to restore the lost partition.

    Recover data from a diskpart > clean command-5-pg.png


    Then close "PartitionGuru" and post a snapshot of LBA 0 using "BOOTICE".
    Last edited by Anshad Edavana; 11 Jul 2014 at 14:27.
      My Computer


  5. Posts : 42
    Windows 10 Pro (64-bit)
    Thread Starter
       #105

    OK I did exactly that and this is the screen of LBA 0 now

    Recover data from a diskpart > clean command-2.png
      My Computer


  6. Posts : 10,796
    Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
       #106

    In elevated command prompt:

    Code:
    diskpart
    list disks  (pick the correct disk number)
    select disk # (replace # with the correct number)
    list part (pick the correct parition number)
    select part # (replace # with the correct number)
    detail part
    exit
    post output
      My Computer


  7. Posts : 562
    Windows 7 Ultimate x64
       #107

    So far is good. Now the MBR is updated with partition info. A single NTFS partition starting at LBA63 and it consist of 3907024002 sectors or 1907726 MB in size. Now please follow the below steps.

    1. Download latest version of "TestDisk" from http://www.cgsecurity.org/testdisk-7.0-WIP.win.zip

    2. Run "TestDisk" and choose "Create" to create a new log file.




    3. On the second screen, choose your "External Disk" (confirm by size and model number ).




    4.Choose "Intel" as the partition type.




    5. Select "[Advanced] Filesystem Utils".

    Recover data from a diskpart > clean command-9-testdisk.png


    6. A single NTFS partition will be displayed. Make sure Boot is selected at the bottom and press Enter.

    Recover data from a diskpart > clean command-10-testdisk.png


    7.On the next window, select "Rebuild BS".

    Recover data from a diskpart > clean command-11-testdisk.png


    8.Now "TestDisk" will search for MFT and after sometime it will (hopefully) display a screen similar to the below one.

    Recover data from a diskpart > clean command-13-testdisk.png


    Now take a screenshot of that window (to post with next reply ).


    9.Then use "Tab" key to select "Write" and press Enter. Confirm "Y" to the confirmation dialogue.

    Recover data from a diskpart > clean command-14-testdisk.png


    10. You should see a window similar to the below one with both "Boot sector" and "Backup Boot sector" status are displayed as OK.




    11. Now close "TestDisk" and open "BOOTICE". Navigate to "LBA 63" and press "Backup to file" button. This will allow you to save LBA63 as "bin" file. Zip this file and attach with next reply along with the "TestDisk" screenshot.


    Make sure not to power down or reboot the system and not to try opening or running CHKDSK against the disk until i confirm.
      My Computer


  8. Posts : 42
    Windows 10 Pro (64-bit)
    Thread Starter
       #108

    Here it is

    Recover data from a diskpart > clean command-3.png
      My Computer


  9. Posts : 42
    Windows 10 Pro (64-bit)
    Thread Starter
       #109

    Did... its searching MFT. Will it take a lot of time? I think its scanning the whole disk again?
      My Computer


  10. Posts : 10,796
    Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
       #110

    lonewolfs said:
    Did... its searching MFT. Will it take a lot of time? I think its scanning the whole disk again?
    It will take a lot of time! Follow Anshad Edavana advice. After that the volume bootsector and $MFT are fine again. I think you will get 99.9% percent of data back.

    If Anshad Edavana advises you to do a chkdsk please watch carefully which files are damaged!
      My Computer


 
Page 11 of 13 FirstFirst ... 910111213 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 01:26.
Find Us