Hard disk partitions

A physical hard disk is a sequential series of sectors, typically 512 bytes long, though new disks with sectors of 4096 bytes are starting to appear. Logically, the disk can be split into multiple areas, or partitions. Each partition looks to the operator like a separate file. There are several reasons for multiple partitions such as below

• House keeping - to keep disk sizes small
• To prevent a logical drive getting bigger than 2TB
• To separate data and programs
• To have multiple boot mode with different operating systems
• Hidden partitions for system recovery

Most drives still use a partition table in sector 0 to define upto 4 partitions, with the option of an extended partition that in effects chains to a new 'boot' sector and allows for an unlimited number of partitions. The maximum sensible number is probably less than 10.

A very common disk failure is for the boot sector to fail, or be corrupted / overwritten. In order to recover the disk data it is necessary to reconstruct the information that was stored in the partition table, and the critical values are the start sector, sector count in partition (the partition length) and the type of file system, eg NTFS, ReiserFS. Fortunately, thsi information can be discovered by scanning the disk and detecting certain elements such as a Bios Parameter Block, or a series of MFT entries. Thisa feature that CnW Recovery software performs as part of it's Partition function.

Recovery from a formatted disk

I occasionally receive disks that are perfectly valid, with intact files and file system. However, the history of them is that they have been reformatted,and the original files lost. To make things slightly worse, the file system may have been changed. Thus an original FAT32 disk couldnow be a NTFS or the other way around.

To help detect this, CnW Recovery software has a function on the partition scan that will count the number of MFTs (for NTFS) or directory clusters for FAT disks. It will often be clear at the end of the scan if there was a different file system on the disk at a previous time. It is then possible, using the partition manager to force the disk to act as a certain format, eg FAT32 or NTFS before recovering the files.

Often in instances where the file system has been changed, most of the critical file information will have been overwritten, but fortunately all file systems tend to use different areas of the disk so it possible that a complete MFT (NTFS directory sectors) may still be intact as may be many FAT32 directories. By analysing this remaining fragmenst, it is possible to determine the critical parameters before attempting a recovery.

Often a very complete recovery will be possible, as long as the disk has not been used too much after reformatting.