Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Recover data from a diskpart > clean command

11 Jul 2014   #101
Anshad Edavana

Windows 7 Ultimate x64
 
 

Quote:

It did find the $MFT mirror. NTFS bootsector and backup boot sector can be reconstructed with that information.
Actually not. MFT mirror is not a copy of MFT. Typically it is 4096 bytes in size and will only contain the first four entries of MFT table. Since MFT is the main structure defining NTFS, it is not possible to keep a full backup copy.

In this case, original MFT is not lost but rather partition table, "boot sector" and backup boot sectors are lost. To rebuilt the boot sectors, a valid partition entry with correct offset information should be present. Fortunately we can rebuilt the partition table with the info found by DMDE.

Quote:
1985 sectors are overwritten.... less than 1MB.

I MB is very important than you think. I actually did some exercises which replicates OP's condition. Every time when i recovered the partition, Windows refused to identify the file system because of the zeroed out first sectors. Fortunately CHKDSK managed to recover those sectors as well as entire data.


My System SpecsSystem Spec
.
11 Jul 2014   #102
lonewolfs

Windows 10 Pro (64-bit)
 
 

Sure walk me through it and Ill do it.
My System SpecsSystem Spec
11 Jul 2014   #103
Kaktussoft

Microsoft Community Contributor Award Recipient

Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
 
 

Quote   Quote: Originally Posted by Anshad Edavana View Post
Quote:

It did find the $MFT mirror. NTFS bootsector and backup boot sector can be reconstructed with that information.
Actually not. MFT mirror is not a copy of MFT. Typically it is 4096 bytes in size and will only contain the first four entries of MFT table. Since MFT is the main structure defining NTFS, it is not possible to keep a full backup copy.

In this case, original MFT is not lost but rather partition table, "boot sector" and backup boot sectors are lost. To rebuilt the boot sectors, a valid partition entry with correct offset information should be present. Fortunately we can rebuilt the partition table with the info found by DMDE.

Quote:
1985 sectors are overwritten.... less than 1MB.

I MB is very important than you think. I actually did some exercises which replicates OP's condition. Every time when i recovered the partition, Windows refused to identify the file system because of the zeroed out first sectors. Fortunately CHKDSK managed to recover those sectors as well as entire data.
I did write it wrong indeed, sorry for that. $MFT and $MFTMirr are still intact. NTFS bootsector can be rebuilt with that information.

Indeed sector 63 to 2047 are cleared.
My System SpecsSystem Spec
.

11 Jul 2014   #104
Anshad Edavana

Windows 7 Ultimate x64
 
 

Hi

This steps should be performed in a row. We are going to do this in three phases. Please follow the below steps.

1. Download and install "PartitionGuru" from Recover deleted files, Partition manager and Windows backup - PartitionGuru

2. Open the tool and select your external HDD from the left pane. You will see the free disk space is illustrated like a cylindrical structure.

Recover data from a diskpart > clean command-1-pg.png


3. Right click on the unallocated space and choose "Create Ne Partition". You will see the new volume creation wizard. Make sure to uncheck the default tick mark at "Align to Integral Multiple of Sectors".

Recover data from a diskpart > clean command-2-pg.png


4. Press the "Advanced" button and change the beginning sector to 63 if it is not already so. Leave all other settings intact. Take a screenshot for later reference and then press OK.


Recover data from a diskpart > clean command-3-pg.png


5. Press the "Save All" button and then press Yes to the dialogue box.

Recover data from a diskpart > clean command-4-pg.png


6. Press No to the format dialogue. This is very important as choosing "Yes" may cause data loss. The format process will destroy original MFT and create an empty one. As long as the MFT is there untouched, we will be able to restore the lost partition.

Recover data from a diskpart > clean command-5-pg.png


Then close "PartitionGuru" and post a snapshot of LBA 0 using "BOOTICE".


My System SpecsSystem Spec
12 Jul 2014   #105
lonewolfs

Windows 10 Pro (64-bit)
 
 

OK I did exactly that and this is the screen of LBA 0 now

Recover data from a diskpart > clean command-2.png


My System SpecsSystem Spec
12 Jul 2014   #106
Kaktussoft

Microsoft Community Contributor Award Recipient

Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
 
 

In elevated command prompt:

Code:
diskpart
list disks  (pick the correct disk number)
select disk # (replace # with the correct number)
list part (pick the correct parition number)
select part # (replace # with the correct number)
detail part
exit
post output
My System SpecsSystem Spec
12 Jul 2014   #107
Anshad Edavana

Windows 7 Ultimate x64
 
 

So far is good. Now the MBR is updated with partition info. A single NTFS partition starting at LBA63 and it consist of 3907024002 sectors or 1907726 MB in size. Now please follow the below steps.

1. Download latest version of "TestDisk" from http://www.cgsecurity.org/testdisk-7.0-WIP.win.zip

2. Run "TestDisk" and choose "Create" to create a new log file.




3. On the second screen, choose your "External Disk" (confirm by size and model number ).




4.Choose "Intel" as the partition type.




5. Select "[Advanced] Filesystem Utils".

Recover data from a diskpart > clean command-9-testdisk.png


6. A single NTFS partition will be displayed. Make sure Boot is selected at the bottom and press Enter.

Recover data from a diskpart > clean command-10-testdisk.png


7.On the next window, select "Rebuild BS".

Recover data from a diskpart > clean command-11-testdisk.png


8.Now "TestDisk" will search for MFT and after sometime it will (hopefully) display a screen similar to the below one.

Recover data from a diskpart > clean command-13-testdisk.png


Now take a screenshot of that window (to post with next reply ).


9.Then use "Tab" key to select "Write" and press Enter. Confirm "Y" to the confirmation dialogue.

Recover data from a diskpart > clean command-14-testdisk.png


10. You should see a window similar to the below one with both "Boot sector" and "Backup Boot sector" status are displayed as OK.




11. Now close "TestDisk" and open "BOOTICE". Navigate to "LBA 63" and press "Backup to file" button. This will allow you to save LBA63 as "bin" file. Zip this file and attach with next reply along with the "TestDisk" screenshot.


Make sure not to power down or reboot the system and not to try opening or running CHKDSK against the disk until i confirm.


My System SpecsSystem Spec
12 Jul 2014   #108
lonewolfs

Windows 10 Pro (64-bit)
 
 

Here it is

Recover data from a diskpart > clean command-3.png


My System SpecsSystem Spec
12 Jul 2014   #109
lonewolfs

Windows 10 Pro (64-bit)
 
 

Did... its searching MFT. Will it take a lot of time? I think its scanning the whole disk again?
My System SpecsSystem Spec
12 Jul 2014   #110
Kaktussoft

Microsoft Community Contributor Award Recipient

Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
 
 

Quote   Quote: Originally Posted by lonewolfs View Post
Did... its searching MFT. Will it take a lot of time? I think its scanning the whole disk again?
It will take a lot of time! Follow Anshad Edavana advice. After that the volume bootsector and $MFT are fine again. I think you will get 99.9% percent of data back.

If Anshad Edavana advises you to do a chkdsk please watch carefully which files are damaged!
My System SpecsSystem Spec
Reply

 Recover data from a diskpart > clean command




Thread Tools




Similar help and support threads
Thread Forum
Recover partition after aborted diskpart clean all command
Hi, I've used diskpart clean all command on my 640GB hdd by mistake. But I aborted (Ctrl+C) it after about 15 minutes of beginning. There was 4 partitions on it: 1. Windows partition (about 90GB). 2. Unallocated space (about 25GB). 3. Another partition (about 50GB). 4. Data partition (The...
Backup and Restore
Recover Partitions from diskpart -> clean command
Hi Guys, I was trying to install windows 7 on my windows 8 laptop (UEFI) and when it didnt allow me to install win7 on partitioned drive I followed YouTube video foolishly and fired diskpart - clean command. everything gone after that. Luckily I didnt do anything after that and referred one of...
Backup and Restore
Recover data from diskpart > clean command
Hi everyone, with my luck I have accidentally executed diskpart > clean command on my 1tb external hard drive. I stopped right after though, realizing what i have done. Is it at all possible to recover the data from the hard drive? It had the personal data of my family - pictures, videos,...
Backup and Restore
CLEAN Diskpart´s victim ,how to recover data?
Hi everyone I wanted clear the 1st partition (of 3) of my notebook , and ..was the Disaster :cry: whole 250 Gb was gone in one click. All my documents and photos..my life, since i was a child is there .. and i havent backed up it .. so i really need your help guys. I´ve seen some...
Backup and Restore
Recover data from an accidental diskpart / clean command
Hey folks, What I did: Within CMD>diskpart>Select disk, i ran the clean (not clean all) command on a different drive than intended, (the goal was to recover a partition of a USB thumb drive), and ended up cleaning an external data drive (3TB), and would love to find out that my data is not lost....
Backup and Restore


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 10:43.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App