0
The first sector of NTFS partitions is reserved for the partition boot sector. This contains the information that allows the OS to read the partition. Without it, the partition cannot be accessed.
By its nature, NTFS keeps a backup copy of the boot sector on the last sector of the partition which can allow recovery programs to restore it. The FAT equivalent of this is also called the boot sector, and resides on the first sector of the partition. The difference is that FAT does not keep a backup copy of this information, making recovery much more difficult...
The first file stored on an NTFS partition is the Master File Table(MFT) which is essentially a listing of the names, properties and locations of all the other files in the partition. This is referenced by the operating system to access individual files.
NTFS stores a backup copy of this file. Data restoration software will attempt to access or restore a copy of the MFT in order to access files on the partition.
PCSTATS FAT partitions use something similar, called predictably enough the File Allocation Table (FAT). The FAT is also backed up on the disk, and can be restored by software. The major disadvantage of the FAT as compared to the MFT is that it needs to be located on a specific area of the partition to function, so if that area of the disk is damaged, recovery can be difficult.
When a file is deleted (removed from the recycle bin within Windows), both file systems simply mark the file as deleted. The data is not actually removed from the drive, but rather the space it takes up on the disk is now considered to be free. Consequently, if you delete a file accidentally, you have an excellent chance of being able to restore it provided you do not write more information to the disk.
In my situation, I had two NTFS partitions on the effected disk. When I ran FDISK, it wrote garbage information over certain areas of this disk, including areas of both partitions. As a result, the first partition (the one with my article on it) had lost its partition boot sector, meaning it could not be accessed normally by an operating system. The second partition had merely had crucial system files overwritten, and was unbootable, but still fully accessible once I transferred the disk to another computer.
Thankfully there is a way to fix all of this, and get the data back!
First, a small disclaimer: All the processes described from here on are strictly for resolving software issues with your data, like accidentally deleting partitions or files. If your hard drive has a physical problem, if it is making strange noises, shaking, rattling or smoking, nothing here will apply. Turn your computer off, unplug the drive and call a data recovery service if your files are vital.
Attempting to self-service your hard drive it may only make things worse.
Posted on 10:10 AM by Mr Peraduan and filed under
Tech Guide
NTFS PartitionsThe first sector of NTFS partitions is reserved for the partition boot sector. This contains the information that allows the OS to read the partition. Without it, the partition cannot be accessed.
By its nature, NTFS keeps a backup copy of the boot sector on the last sector of the partition which can allow recovery programs to restore it. The FAT equivalent of this is also called the boot sector, and resides on the first sector of the partition. The difference is that FAT does not keep a backup copy of this information, making recovery much more difficult...
The first file stored on an NTFS partition is the Master File Table(MFT) which is essentially a listing of the names, properties and locations of all the other files in the partition. This is referenced by the operating system to access individual files.
NTFS stores a backup copy of this file. Data restoration software will attempt to access or restore a copy of the MFT in order to access files on the partition.
PCSTATS FAT partitions use something similar, called predictably enough the File Allocation Table (FAT). The FAT is also backed up on the disk, and can be restored by software. The major disadvantage of the FAT as compared to the MFT is that it needs to be located on a specific area of the partition to function, so if that area of the disk is damaged, recovery can be difficult.
When a file is deleted (removed from the recycle bin within Windows), both file systems simply mark the file as deleted. The data is not actually removed from the drive, but rather the space it takes up on the disk is now considered to be free. Consequently, if you delete a file accidentally, you have an excellent chance of being able to restore it provided you do not write more information to the disk.
In my situation, I had two NTFS partitions on the effected disk. When I ran FDISK, it wrote garbage information over certain areas of this disk, including areas of both partitions. As a result, the first partition (the one with my article on it) had lost its partition boot sector, meaning it could not be accessed normally by an operating system. The second partition had merely had crucial system files overwritten, and was unbootable, but still fully accessible once I transferred the disk to another computer.
Thankfully there is a way to fix all of this, and get the data back!
First, a small disclaimer: All the processes described from here on are strictly for resolving software issues with your data, like accidentally deleting partitions or files. If your hard drive has a physical problem, if it is making strange noises, shaking, rattling or smoking, nothing here will apply. Turn your computer off, unplug the drive and call a data recovery service if your files are vital.
Attempting to self-service your hard drive it may only make things worse.
Post a Comment