Recover data from a diskpart > clean command

Anshad Edavana · 24 Jun 2014

As told before Windows 7 "diskpart clean" only zero's the MBR (so sector 0 so first 512 bytes only) according to documentation

Actually the documentation says "On master boot record (MBR) disks, only the MBR partitioning information and hidden sector information are overwritten".

If a legacy partition tool like XP installer or other tool creates a partition starting at LBA 63, then LBA 1 to LBA 62 are considered as hidden. The same goes to NT 6.x aligned partitioning - LBA 1 to LBA 2047 will be considered as hidden and DISKPART will wipe those sectors.

@lonewolfs

Don't confused by all of this. Just focus on Jumanji's instructions.

Kaktussoft · 24 Jun 2014

I did find articals about external disk on the web a few days ago. They all told me the starting sector is 63.
In #73 is a definition of hidden sectors.... if that's really the definition.... they were not used at all!! Zero them has no side effects.

If MBR has been zeroed and the "hidden sectors"... all partitions are still intact and easily recoverable. I did let him make mbrsect.txt ... indeed all zero's (except "end of mbr marker" and "windows disk signature"0

Anshad Edavana · 24 Jun 2014

If MBR has been zeroed and the "hidden sectors"... all partitions are still intact and easily recoverable. I did let him make mbrsect.txt ... indeed all zero's (except "end of mbr marker" and "windows disk signature"0

That is what also confusing me. "Partition Wizard" or "TestDIsk" is supposed to detect the partition withing a few minutes ( in my tests, less than a minute ). May be the partition was actually started at LBA 63 but for some unknown reason DISKPART decided to wipe the first MB ?.

jumanji · 24 Jun 2014

Experiment completed. Data I put on sector 2047 wiped out when I ran the clean Command.So clean command wipes from sector 0 to 2047.

( I had PBR on 2048 as in post#66. 2047 got wiped out and also sector 0.) PBR on 2048 in tact.( I can restore sector 0 from the backup I had taken with bootice. No problem.. This is what I have been advising everyone should back up the important sectors shown on bootice - whether MBR or GPT - and when problems arise,they can simply restore those sectors and bring the drive back into life without any necessity of data recovery. In all my experiments with HDDs I do that.)

Kaktussoft · 24 Jun 2014

jumanji said:

Experiment completed. Data I put on sector 2047 wiped out when I ran the clean Command.So clean command wipes from sector 0 to 2047.

( I had PBR on 2048 as in post#66. 2047 got wiped out and also sector 0.) PBR on 2048 in tact.( I can restore sector 0 from the backup I had taken with bootice. No problem.. This is what I have been advising everyone should back up the important sectors shown on bootice - whether MBR or GPT - and when problems arise,they can simply restore those sectors and bring the drive back into life without any necessity of data recovery. In all my experiments with HDDs I do that.)

What if partition start sector is 63 and you do the diskpart clean? It only zeroes sector 0-62 I assume

jumanji · 24 Jun 2014

I have carried out that experiment also subsequently and found that diskpart clean zeros from LBA 0 to LBA 2047 wiping out the NTFS at LBA 63. diskpart clean zeros LBA 0 to LBA 2047

So most probably the OP here lost the drive because of it.Most data will still be there in other sectors from LBA 2048 to the end LBA of the drive. Now the question is how to retrieve the data.

Neither PW nor TestDisk can read the start of the partition at LBA 63 when it is zeroed. When zeroed all data in it is lost.

Kaktussoft · 24 Jun 2014

jumanji said:

I have carried out that experiment also subsequently and found that diskpart clean zeros from LBA 0 to LBA 2047 wiping out the NTFS at LBA 63. diskpart clean zeros LBA 0 to LBA 2047

So most probably the OP here lost the drive because of it.Most data will still be there in other sectors from LBA 2048 to the end LBA of the drive. Now the question is how to retrieve the data.

Neither PW nor TestDisk can read the start of the partition at LBA 63 when it is zeroed. When zeroed all data in it is lost.

so the documentation is wrong?

On master boot record (MBR) disks, only the MBR partitioning information and hidden sector information are overwritten. On GUID partition table (GPT) disks, the GPT partitioning information, including the Protective MBR, is overwritten. If the ALL parameter is not used, the first 1MB and the last 1MB of the disk are zeroed.

Where can I find information about "hidden sector information"? I don't understand what is meant with it

jumanji · 24 Jun 2014

You may do the experiment yourself and find out.:)

gregrocker · 24 Jun 2014

Would you want to theorize why Clean command works to overcome about half or more of all installation failures? I assume it's because it wipes boot sector and the partition table, one or both of which interferes with attempts to install Win7.

Likewise on multiple occasions we've had drives which failed to boot that traced to a hard drive where the solution was to wipe the drive with Clean command.

Kaktussoft · 25 Jun 2014

gregrocker said:

Would you want to theorize why Clean command works to overcome about half or more of all installation failures? I assume it's because it wipes boot sector and the partition table, one or both of which interferes with attempts to install Win7.

Likewise on multiple occasions we've had drives which failed to boot that traced to a hard drive where the solution was to wipe the drive with Clean command.

After the diskpart->clean command the MBR, so master bootcode and partition table, is zeroed. Both are in sector 0. So "logically" the disk is totally empty. It doesn't have boot code and no partitions at all afterwards.