Recover data from a diskpart > clean command

jumanji · 24 Jun 2014

Hi Anshad

I shall come back to the above topic after a while. Not really earth-shaking now.:) Things may be changing.( I'm an old timer.

) I shall also look for any info on it.

I see lonewolfs here.

So here is an exercise for him.

Hi lonewolfs,

Run bootice, open your external drive with Sector Edit. Your drive has 3907029167 sectors.

Now how many GBs of data did you have on that drive?

With your mouse roller you can scroll through all the sectors and report whether you see those sectors populated.

Ignore anything in sectors listed by PW in the screenshot in post #48. There may or may not may not be something in those sectors. But we are not interested in it.

Concentrate in the rest of the sectors. Do you find those populated to the extent of your data?

Or do you find those all empty with oo?? If you find those all zeros , may be you zeroed your drive completely and there is no data in it.

Take your time and then report.

lonewolfs · 24 Jun 2014

Hi I am at work now but I am pretty sure other sectors have data on them. I ran only clean command and not clean all so... still ill check it in an hour or two and let you know. Regarding the data on disk, out of the usable space on a 2TB drive which i am not sure how much it is at this moment but before i ran the clean command only like 60GB was empty on it.

jumanji · 24 Jun 2014

No probs. Do it slowly after you get back from your work.

If you had only 60GB free in 2TB, then most of your sectors should be populated and show hexadecimals other than all oo. Check and then report.

jumanji · 24 Jun 2014

@Anshad,

You are right. Whether it is 63 or 2048 seems to depend upon the partitioning utility.This time I decided to format the external HDD in Windows Disk Management. It shows 2048 in bootice and sector 2048 is populated with NTFS. So its worth watching in future as to which one does what. At this point I am also not sure what it will be in a new factory formatted external HDD.( I have manipulated all my external HDDs zeroing them and formatting on receipt so the original is not there.:). And I generally do not format with Windows Disk Management)

Recover data from a diskpart > clean command-24-06-2014-13-30-51.jpg

In OP's case Partition Table is not present in Sector 0. Examination of other sectors will show whether the data is there or not. I shall also ask him to examine sector 2048.

lonewolfs · 24 Jun 2014

@jumanji I checked my entire disk and its filled with data just the starting LBA's that are 0'd

Kaktussoft · 24 Jun 2014

sector 2048 is first sector of first partition. At least if you partition within windows vista or win7 or win8. As told before win7 "diskpart clean" only zero's the MBR (so sector 0 so first 512 bytes only) according to documentation. Maybe someone can test that with a usb stick for example. Documentation is not 100% clear to me. Maybe first 1MB (sector 0-2047 are cleared)

All partitions should be recoverable very easily. You didn't do only the "disk clean" command! Something else should have happened.

Kaktussoft · 24 Jun 2014

lonewolfs said:

@jumanji I checked my entire disk and its filled with data just the starting LBA's that are 0'd

How may sectors are zeroed .... 2048? Or only sector 0?

jumanji · 24 Jun 2014

Kaktussoft, I shall check and report. I am halfway through. very slow. may take some more time.

OK, Lonewolfs

Your LBAs 0 to 2047 are zeroed.

Post a screenshot of sector 2048 from bootice. I want to check whether it is PBR or other data.

Quite possibly you had the PBR on sector 63 and diskpart clean cleaned upto sector 2047 and wiped the sector 63 PBR. Data on other sectors may be there ( except a little that could have been there from sector 64 to sector 2047).That's my guess now.

Post now.

Kaktussoft · 24 Jun 2014

jumanji said:

Kaktussoft, I shall check and report. I am halfway through. very slow. may take some more time.

OK, Lonewolfs

Your LBAs 0 to 2047 are zeroed.

Post a screenshot of sector 2048 from bootice. I want to check whether it is PBR or other data.

Quite possibly you had the PBR on sector 63 and diskpart clean cleaned upto sector 2047 and wiped the sector 63 PBR. Data on other sectors may be there ( except a little that could have been there from sector 64 to sector 2047).That's my guess now.

Post now.

Are you very very very sure LBA 0-2047 are zeroed on MBR disk after "diskpart clean"?

jumanji · 24 Jun 2014

Kaktussoft said:

jumanji said:

Kaktussoft, I shall check and report. I am halfway through. very slow. may take some more time.

OK, Lonewolfs

Your LBAs 0 to 2047 are zeroed.

Post a screenshot of sector 2048 from bootice. I want to check whether it is PBR or other data.

Quite possibly you had the PBR on sector 63 and diskpart clean cleaned upto sector 2047 and wiped the sector 63 PBR. Data on other sectors may be there ( except a little that could have been there from sector 64 to sector 2047).That's my guess now.

Post now.

Are you very very very sure LBA 0-2047 are zeroed on MBR disk after "diskpart clean"?

Whether Diskpart clean zeroed it or not I can't tell until I finish my experiment. But OP's mbrsect.txt when opened with HxD ( Thanks to Anshad) shows sector 1 to sector 2047 all 00 s.