This page has been robot translated, sorry for typos if any. Original content here.

Hard Disk Recovery Guide

On this topic:


Список программ и утилит используемых для восстановления данных с жестких дисков и других носителей

This guide will tell you how to recover information on your hard disk, even if the file system partition is damaged (including NTFS).

We will show you how to recover it and not lose your data and how to solve other possible problems associated with the loss of information on your hard disk.

Hard Disk Recovery Guide

This guide will tell you how to recover information on your hard disk, even if the file system partition is damaged (including NTFS). We will show you how to recover it and not lose your data and how to solve other possible problems associated with the loss of information on your hard disk.

If you have been working with a computer for a long time, it is not a secret for you that the hard disk cannot be considered a reliable place to store data. Unlike compact discs and other means of data storage, a hard disk is a mechanical device that wears out like any mechanism in the process. In addition to mechanical failure, there are many ways to lose data on a disk, where it is very easy and quick to change them.

Solving most problems with hard disks with Windows 98 and earlier systems was about using fdisk and a number of other utilities that allow you to partition and restore disks. Now the use of such tools even by an experienced user sometimes leads to irreversible consequences ...

Imagine this situation: While working on the article on updating computers, when more than 10,000 characters were already written and there were a few sentences and screenshots, all you had to do was run fdisk on a computer with two Windows 98 / XP Pro operating systems and save multiple screenshots. In my article, several paragraphs described working with fdisk, warning readers not to use this program if there is no complete confidence in their actions ...

So, I needed to get only a few screenshots, but I forgot that fdisk, at startup, writes data to some areas of the disk so that it doesn’t appear in them. I remembered this only when I received the copies of the screen I needed and rebooted the computer in Windows XP mode, or rather, I wanted to restart ... After quite a long wait, the system did not boot.

Disappeared main disk partition?

The affected disk we are dealing with was Fujitsu 17 GB with two NTFS partitions of 5 GB each (XP Home and Professional) and 6 GB of unused space. After the incident described above, the system in both sections of XP stopped loading.

After connecting the drive to a computer with Windows 2000, I launched "disk management". To do this in XP or in 2000, right-click on "my computer", select "management", and in the appeared window - "disk management".

Список программ и утилит используемых для восстановления данных с жестких дисков и других носителейСписок программ и утилит используемых для восстановления данных с жестких дисков и других носителей

The main section, on which my article was located, was displayed as not formatted, and the operating system could not read it. The system located in the second section could not boot, but at least it was recognized as formatted and it was possible to copy the necessary files from it. Unfortunately, all the data I needed was in the first section.

What to do? There are several ways to extract data, but before we look at it, we need to focus on what the file system is and how it stores your data.

File systems

The file system defines a method that is used to store data on a hard disk or on any other device that is used to store information. The free space on the hard disk is divided into sections, in which logical disks are created (C :, D:, ...).

Windows can work with multiple file systems called NTFS (NT File System) and FAT (File Allocation Table). FAT is an earlier file system used in DOS under the name FAT-16 and in Windows 9x / Me under the name FAT-32. The main difference between FAT-16 and 32 is the maximum amount of disks and files with which they can work. FAT-16 can use disks up to 2 GB. The Windows 2000 and XP operating systems are fully compatible with FAT, even though they use a different data storage method as standard.

Windows NT, 2000 and XP work with the NTFS file system, providing better security and reliable data storage. In addition, NTFS allows you to define permissions for each file. All of these file systems use a partition table and boot records (MBR) that are stored in the first sector of each disk, determining which partition is the boot partition.

If the information in the MBR is damaged, the operating system stops loading from it, and the disk partitions may be determined to be empty.

NTFS partitions

The first sector of the NTFS partition is reserved as boot. It contains information that allows the system to work with this section, without this information the section will be inaccessible.

A copy of the boot sector is stored in the last sector of the partition. The equivalent of such a sector in the FAT is also called the boot sector and is stored in the first sector of the partition. The difference with FAT is that FAT does not store copies of this information, making recovery a more difficult process ...

The first file that is stored on the disk is called the Master File Table (MFT) - this is a table that contains information about the location of all files, their properties and access rights. NTFS stores a copy of this information. FAT has a similar file allocation table for the File Allocation Table (FAT), a backup copy of which is also on the disk.

If a file is deleted, including from the recycle bin, both file systems simply mark it as deleted. The data is not really deleted from the disk, but the space that they occupy on the disk is considered free. So all files can be recovered, if only you did not write to the disk after deleting them.

In my case, a disk with two NTFS partitions was used. When running fdisk, the program recorded something in important areas of the disk in both partitions. As a result, the first partition has a bad boot sector. The second section simply has a damaged area with system files, and the system also does not boot from it, but the files on it are accessible. I moved the disk to another computer. It was at this point that we broke off.

Warning: everything described from this point on may, if not used carefully, lead to the deletion of disk partitions and files. If your hard drive has a physical problem, for example, it makes strange sounds or smokes, nothing described below will help, turn off the computer, remove the hard drive and carry it to a service workshop. Attempts to repair yourself are likely to lead to significantly more expensive consequences.

Information recovery

The first rule that can not be violated if you are going to recover information on a damaged hard disk - do not write anything over. If you accidentally delete a partition, do not create a new one in its place, leave everything as it is.

If you deleted files from the recycle bin, and then realized that you need the deleted information, do not write anything to disk.

The same applies to disk partitions. If you do not create a new section in place of the lost one, the information about the old one will still be saved.

In my case, the disk contains copies of information about partitions and critical files. One partition is not available due to the overwritten boot sector, and the second has ceased to be bootable, but the information is still read from it. Looking ahead, I will say that everything (or almost all) was able to recover. And now we will focus on how to do this.

The most inconvenient option is when you have one partition on the disk, and it’s exactly that. Then it is best to transfer the hard drive to another computer. Working on a second computer has many advantages. No need to make the disk bootable, you can simply achieve readability of files and rewrite the necessary information using Windows Explorer.

If the system files are damaged and the system does not boot, but the partition is available, the files can be easily read on another computer, and the problem will be solved.

File Recovery Software

If you are not able to physically transfer the hard drive, do not be tempted to reinstall the system. There are several software tools that allow you to boot a computer running an alternative operating system and help you recover your files.

The easiest way to access files on your hard disk is to boot your computer using a DOS boot floppy and use a data recovery program like testdisk, discussed below.

Keep in mind that when working with a single partition, which is also not visible, data recovery becomes much more difficult. Many recovery programs need space to copy recovered data. In this case, you have no guarantees that you will not destroy more than restore. If you can not transfer the hard drive to another computer, consider connecting another hard drive to which you can install the system and the recovery program.

There are several programs, for example, 'Winternals Disk Commander' and 'ERD Commander', which will boot your computer running DOS or another operating system and begin the recovery process. Unfortunately, none of these programs is free.

If you have connected your disk to another computer or have connected a disk with an installed operating system to your computer, you can try to load the computer and copy the necessary data. You will fail if the section information is lost. In this case, the system simply "does not see" logical drives.

Free software for data recovery

Existing free programs are usually less functional than paid ones. This is due to the fact that developers understand that if the lost data is really important, then people will be ready to pay for the program to restore it.

Before doing anything further, read everything carefully.

FINDNTFS

FindNTFS ( http://inet.uni2.dk/~svolaf/ utilities.htm) is a free program that can find and repair a damaged NTFS partition. There are several different versions, among which are those designed to work after loading in DOS mode. It can be used if Windows does not boot. FindNTFS, in addition to finding and restoring NTFS partitions, has some other useful functions that we do not need now, and we will not dwell on them.

Список программ и утилит используемых для восстановления данных с жестких дисков и других носителейСписок программ и утилит используемых для восстановления данных с жестких дисков и других носителей

To use findntfs, boot the computer using a DOS boot diskette with the findntfs.exe file written to it. You can get the list of files and folders on the disk being restored by typing 'FINDNTFS # 1 1 1 c: \ recoverlog.txt files' on the command line. The # symbol must be replaced by the disk number. If you have only one hard disk, then its number will be 1, and if there are several disks, then number 1 will receive a physical disk, on which the logical disk 'C:' is located.

This command tells findntfs to search NTFS files over the entire specified disk and list them in a text file on the C: drive. You can specify any file name and on any disk. Just do not create it on the same disk, the information on which you want to recover. Once the file is created, you can view it. It should look something like this:

Список программ и утилит используемых для восстановления данных с жестких дисков и других носителейСписок программ и утилит используемых для восстановления данных с жестких дисков и других носителей

If everything went well, you can find the necessary files in the list. The folders in which findntfs found them may not coincide with where they were located. Before proceeding to the next steps, write down the folder numbers with the necessary files.

To restore files using findntfs, you need to use the 'copy' command. The limitation of the program is that it writes files to the folder in which it itself is located. So before the next step, make sure that there is enough space.

Run the command 'findntfs # 1 1 1 copy #' (the first symbol # must be replaced with the disk number, as in the previous command, and the second one with the number of the desired folder). You can specify up to 10 folder numbers. If you do not specify the folder number, the program will try to copy all the files from the specified disk.

Список программ и утилит используемых для восстановления данных с жестких дисков и других носителейСписок программ и утилит используемых для восстановления данных с жестких дисков и других носителей

Check the recovered files to make sure they are not damaged.

The program findntfs has another significant limitation, it can not copy files to the partition with the FAT file system. This makes recovery impossible without an NTFS partition and support by its operating system (Windows NT / 2000 / XP). In this case, recovering files by booting the computer using a DOS disk will fail. Another free NTFS reader utility can solve the problem.

NTFS reader for DOS

NTFS reader for DOS ( http://www.ntfs.com/products.htm ) Is a freeware program that allows you to copy NTFS files to DOS partitions (FAT). If booting from your NTFS partition is not possible, you can copy this program to a bootable diskette and rewrite all the necessary files with it.

The limitation of this program is that it cannot read data from partitions with damaged boot sectors or from disks with damaged partition tables. So before using it, you need to make the NTFS partition "readable" and after that copy the necessary files from it.

This limitation is not provided by the commercial utility 'Active @ Partition Recovery' ( http://www.ntfs.com/ ), which can find the lost partition and copy data from it.

Список программ и утилит используемых для восстановления данных с жестких дисков и других носителейСписок программ и утилит используемых для восстановления данных с жестких дисков и других носителей

These programs are designed to work under DOS, and you can work with them under Windows 9x / ME, but not under Windows 2000 or XP due to restrictions on access to the disks operating in these operating systems.

TESTDISK

TestDisk ( http://www.cgsecurity.org/wiki/TestDisk ) Is a program that exists in versions for DOS and Linux, which can be used to find and recover FAT and NTFS partitions. With it, you can restore the boot sectors from their copies.

With the help of this particular program, I restored my first NTFS partition, which was not “visible” at all. Working with testdisk is not very difficult, the main thing is to be careful and read the documentation (in the 'doc' folder).

After starting the program, you will see a list of available physical disks:

Список программ и утилит используемых для восстановления данных с жестких дисков и других носителейСписок программ и утилит используемых для восстановления данных с жестких дисков и других носителей

Specify the disk, the sections of which you want to restore, and select the 'analyze'.

Список программ и утилит используемых для восстановления данных с жестких дисков и других носителейСписок программ и утилит используемых для восстановления данных с жестких дисков и других носителей

The program will display a list of currently existing partitions and, after pressing 'enter', will start its own partition search process.

After the search, press 'enter' again. Next, it is advisable to select the 'search!' Item to perform a more thorough search. If suddenly you did not see any partitions at the beginning due to damage to the partition table, testdisk should find them.

Список программ и утилит используемых для восстановления данных с жестких дисков и других носителейСписок программ и утилит используемых для восстановления данных с жестких дисков и других носителей

Check this information and select 'write' to write new partition information to disk. If the loss of the partition was the only damage, then the recovery process for you is complete. You will get a fully restored system. But, if the boot sector of the partition is damaged (as in my case), you will have to select the 'advanced' option, and after it - the 'boot' option.

Список программ и утилит используемых для восстановления данных с жестких дисков и других носителейСписок программ и утилит используемых для восстановления данных с жестких дисков и других носителей

Testdisk compares the boot sector with its copy. If they are different, the program will ask you a question if you want to copy a copy of it into the boot sector.

This operation made my “lost” article section available again. Testdisk is one of the most useful programs for recovering disk partitions. Of course, it lacks a graphical interface and it starts only under DOS control, but this is not the main thing for a program that can restore the necessary information in a few minutes.

There are many different free data recovery utilities. Here are a few recovering deleted files: PC INSPECTOR ( http://www.pcinspector.de/file_recovery/UK/welcome.htm ) and Restoration for 9x / NT / 2K / XP ( ). If you set a goal, you can find many similar programs with their own merits, but we didn’t set such a goal, because in our opinion, it’s quite enough to solve most of the problems associated with restoring damaged partitions and deleted files.

Commercial utilities for data recovery

There are many paid programs for data recovery. Most of them only work under Windows. It is convenient to work with them if you managed to connect a hard disk to another computer or to connect another hard disk with an operating system to the same computer. Two good examples of such programs: 'Active file recovery' and 'R-Studio'.

I did not conduct serious testing of commercial programs, but I had to deal with their demo versions, which simply tell you if there is a file on the disk and if it is not damaged. The exception was the demo version of R-Studio, which allowed recovering files that are not larger than 64 KB. She successfully copied deleted files with articles.

From my experience, I can recommend 'Winternals Disk Commander', but you will have to take my word for it, since the creators of the program do not provide demo versions. Below we have a list of paid data recovery software that you can turn to if your free utilities discussed in this review could not solve your problems.