Guide to recovering information on your hard drive
This guide will show you how to recover information on your hard drive, even if it has a damaged file system partition (including NTFS).
We'll show you how to recover it and not lose your data and how to solve other possible problems related to loss of information on your hard disk.
Guide to recovering information on your hard drive
This guide will show you how to recover information on your hard drive, even if it has a damaged file system partition (including NTFS). We'll show you how to recover it and not lose your data and how to solve other possible problems related to loss of information on your hard disk.
If you work with a computer for a long time, it's not a secret for you that a hard disk can not be considered a reliable place for data storage. Unlike CDs and other storage media, a hard drive is a mechanical device that wears out like any other mechanism during operation. In addition to mechanical failure, there are many ways to lose data on a disk, on which it is very simple and fast to change.
The solution to most of the problems with hard disks when working with Windows 98 and earlier systems was to use the fdisk program and a number of other utilities that allow partitioning and recovery of disks. Now the use of such utilities even by an experienced user sometimes leads to irreversible consequences ...
Imagine this situation: While working on an article on updating computers, when more than 10,000 characters were written and there were several sentences and screenshots, all you had to do was run fdisk on a computer with two Windows 98 / XP Pro operating systems and Save multiple screen shots. I have several paragraphs in the article describing the work with fdisk, warning readers not to use this program if there is no complete certainty in their actions ...
So, I needed to get just a few screenshots, but I forgot that fdisk at startup writes data to some areas of the disk so that they are not there before. I remembered this only when I got the copies of the screen that I needed and rebooted the computer in Windows XP mode, or rather, I wanted to restart ... After a long wait, the system did not boot.
The main partition of the disk disappeared?
The affected disk with which we will be dealing was Fujitsu 17 GB with two partitions of NTFS for 5 GB (XP Home and Professional) and 6 GB of unused space. After the incident described above, the system in both sections of XP stopped loading.
After connecting the disk to a computer with Windows 2000, I ran "disk management". To do this in XP or 2000, right-click on "My Computer", select "Management", and in the appeared window - "Disk Management".
The main section on which my article was located was displayed as not formatted, and the operating system could not read it. The system in the second partition could not boot, but at least it was recognized as formatted and it was possible to copy the necessary files from it. Unfortunately, all the data I needed was in the first section.
What to do? There are several ways to extract data, but before we consider them, we need to focus on what the file system is and how your data is stored in it.
File Systems
The file system defines the method that is used to store data on the hard disk or on any other device that is used to store information. Free space on the hard disk is divided into sections in which logical disks are created (C :, D:, ...).
Windows can work with several file systems, which are called NTFS (NT File System) and FAT (File Allocation Table). FAT is an earlier file system used in DOS under the name FAT-16 and in Windows 9x / Me - under the name FAT-32. The main difference between FAT-16 and 32 is the maximum amount of disks and files with which they can work. FAT-16 can use disks up to 2 GB. Operating systems Windows 2000 and XP are fully compatible with FAT, even though they use a different method of data storage as standard.
Windows NT, 2000 and XP work with the NTFS file system, providing better security and reliability of data storage. In addition, NTFS allows you to define access rights for each file. All these file systems use a partition table and boot records (MBRs) that are stored in the first sector of each disk, determining which partition is bootable.
If the information in the MBR is corrupted, the operating system stops loading from it, and the disk partitions can be defined as empty.
NTFS partitions
The first sector of the NTFS partition is reserved as a boot sector. It contains information that allows the system to work with this section, without this information the section will be inaccessible.
A copy of the boot sector is stored in the last sector of the partition. The equivalent of such a sector in FAT is also called the boot sector and is stored in the first sector of the partition. The difference with FAT is that FAT does not store copies of this information, making recovery a more difficult process ...
The first file that is stored on the disk is called the Master File Table (MFT) - this is a table that contains information about the location of all files, their properties and access rights. NTFS stores a copy of this information. FAT has a similar file allocation table File Allocation Table (FAT), a backup copy of which is also on the disk.
If a file is deleted, including from the "Recycle Bin", both file systems just mark it as deleted. The data is not really deleted from the disk, but the space that they occupy on the disk is considered free. So all the files can be restored, unless you write anything to the disk after they are deleted.
In my case, a disk with two NTFS partitions was used. When you run fdisk, the program writes something to important areas of the disk in both partitions. As a result, the first partition has a damaged boot sector. The second partition simply has a corrupted area with system files, and the system also does not boot from it, but the files on it are available. I transferred the disk to another computer. It was at this place that we broke off.
Warning: everything described from this point on, can, with careless use, lead to the deletion of disk partitions and files. If your hard drive has a physical problem, for example, it emits strange sounds or smokes, nothing described below will help, turn off the computer, remove the hard drive and carry it to the service shop. Attempts to repair yourself will most likely lead to much more expensive consequences.
Information recovery
The first rule that can not be violated, if you are going to recover information on a damaged hard disk - do not write anything on top. If you accidentally delete a partition, do not create a new one in its place, leave it as it is.
If you deleted files from the Recycle Bin, and then realized that the remote information you need, do not write anything to the disk.
The same applies to disk partitions. If you do not create a lost new section in place, the information about the old one will still be preserved.
In my case, copies of information about partitions and critical files have been preserved on the disk. One partition is unavailable due to the overwritten boot sector, and the second is no longer bootable, but the information from it is still read. Looking ahead, I will say that everything (or almost all) was restored. And now we will dwell on how to do it.
The most uncomfortable option is when you have a single partition on the disk, and it was he who disappeared. Then it's best to transfer the hard drive to another computer. Working on a second computer has many advantages. You do not need to make the disk bootable, you can simply make the files readable and rewrite the necessary information using Windows Explorer.
If system files are corrupted and the system does not boot, but the partition is accessible, the files are easily read on another computer, and the problem will be solved.
Software for recovering files
If you do not have the ability to physically transfer the hard drive, do not be tempted to reinstall the system. There are several software tools that will allow you to boot up a computer running an alternative operating system and help you restore your files.
The easiest way to access files on your hard disk is to boot your computer using the DOS boot diskette and use the data recovery program like testdisk, discussed below.
Keep in mind that when working with one partition, which is also not visible, data recovery becomes much more difficult. Many recovery programs need space to copy the recovered data. In this case, you have no guarantee that you will not destroy more than restore. If you can not transfer the hard drive to another computer, consider connecting another hard drive to which you can install the system and the recovery program.
There are several programs, for example, 'Winternals Disk Commander' and 'ERD Commander', which will load your computer running DOS or another operating system and start the recovery process. Unfortunately, none of these programs is free.
If you connected your drive to another computer or connected a disk with an installed operating system to your computer, you can try to download the computer and copy the necessary data. You can not get it if the information about the partitions is lost. In this case, the system simply "does not see" logical disks.
Free software to recover information
Existing free programs are usually less functional than paid ones. This is due to the fact that developers understand that if lost data is really important, then people are ready to pay for the program to restore them.
Before you do anything further, carefully read everything.
FINDNTFS
FindNTFS ( Utilities.htm) is a free program that can find and repair a corrupted NTFS partition. There are several different versions, among which there are also designed to work after loading in DOS mode. It can be used if Windows does not boot. FindNTFS in addition to searching and restoring partitions NTFS has some more useful functions that we do not need now, and we will not dwell on them.
To use findntfs, boot the computer with the DOS boot floppy, with the file named findntfs.exe written to it. You can get the list of files and folders on the restored disk by typing 'FINDNTFS # 1 1 1 c: \ recoverlog.txt files' from the command line. The # symbol must be replaced with the disc number. If you only have one hard drive, then its number will be 1, and if there are several disks, then number 1 will receive the physical disk on which the logical drive 'C:' is located.
This command tells findntfs to search the entire specified drive for NTFS files and list them in a text file on drive C :. You can specify any file name on any drive. Just do not create it on the same disk, the information on which you want to restore. Once the file is created, you can view it. It should look something like this:
If everything went well, you can find the files in the list. The folders in which they found findntfs may not coincide with where they were actually located. Before proceeding to the next steps, note down the folder numbers with the files you need.
To restore files using findntfs, you need to use the 'copy' command. The limitation of the program is that it writes the files to a folder in which it itself is located. So before the next step, make sure there is enough space.
Run the command 'findntfs # 1 1 1 copy #' (the first character # must be replaced with the disk number, as in the previous command, and the second one by the number of the desired folder). You can specify up to 10 folder numbers. If you do not specify a folder number, the program will try to copy all files from the specified disk.
Check the recovered files to make sure they are not damaged.
The findntfs program has one more significant limitation, it can not copy files to a partition with the FAT file system. This makes recovery impossible without an NTFS partition and its operating system support (Windows NT / 2000 / XP). In this case, you will not be able to restore the files by booting the computer using a DOS disk. Another free utility NTFS reader can solve the problem.
NTFS reader for DOS
NTFS reader for DOS ( ) Is a freeware program that allows you to copy NTFS files to DOS partitions (FAT). If a download from your NTFS partition is not possible, you can copy this program to a bootable floppy disk and overwrite all the necessary files with it.
The limitation of this program is that it can not read data from partitions with damaged boot sectors or from disks with damaged partition tables. So before using it, you need to make the NTFS partition "readable" and then copy the necessary files from it.
These restrictions have no commercial utility 'Active @ Partition Recovery' ( ), Which can find the lost partition and copy the data from it.
These programs are designed to run under DOS, with them you can work and running Windows 9x / ME, but not in Windows 2000 or XP due to restrictions on access to disks operating in these operating systems.
TESTDISK
TestDisk ( ) Is a program that exists in versions for DOS and Linux that you can use to find and restore partitions of FAT and NTFS. With it, you can restore the boot sectors by their copies.
With the help of this particular program, I restored my first NTFS partition, which was not visible at all. To work with testdisk is not very difficult, the main thing to be careful and read the documentation (in the folder 'doc').
After starting the program, you will see a list of available physical disks:
Specify the disk whose partitions you want to restore, and select 'analyze'.
The program displays a list of currently existing sections and, after pressing 'enter', starts its own partition search process.
After finishing the search, press 'enter' again. It is further desirable to select the item 'search!' In order to perform a more thorough search. If suddenly you did not see a single partition at the beginning because of the partition table corruption, testdisk should find them.
Check this information and select 'write' to write the new partition information to disk. If the partition loss was the only damage, then the recovery process is over for you. You will receive a fully restored system. But, if the boot sector of the partition is corrupted (as in my case), you will have to select the item 'advanced', and after it - 'boot'.
Testdisk will compare the boot sector with its copy. If they are different, the program will ask you if you want to copy the copy to the boot sector.
This operation made my "lost" section with the article again available. Testdisk is one of the most useful programs for partition recovery. Of course, it lacks a graphical interface and it runs only under DOS, but this is not the main thing for the program, which can restore the necessary information in a few minutes.
There are many different free utilities for data recovery. Here are a few that restore deleted files: PC INSPECTOR ( ) And Restoration for 9x / NT / 2K / XP ( ). If you set a goal, you can find many similar programs with their advantages, but we did not set such a goal, because everything described, in our opinion, is enough to solve most of the problems associated with the restoration of damaged partitions and deleted files.
Commercial Data Recovery Utilities
There are many paid programs for data recovery. Most of them work only on Windows. С ними удобно работать, если вам удалось подключить жесткий диск к другому компьютеру или подключить к этому же компьютеру другой жесткий диск с операционной системой. Два хороших примера таких программ: 'Active file recovery' и 'R-Studio'.
Я не проводил серьезного тестирования коммерческих программ, но мне приходилось иметь дело с их демо-версиями, которые просто сообщают, есть ли файл на диске и не поврежден ли он. Исключением была демонстрационная версия R-Studio, позволявшая восстанавливать файлы, не большие 64 КБ. Она удачно скопировала удаленные файлы со статьями.
From my work experience, I can recommend 'Winternals Disk Commander', but you have to take a word, as the creators of the program do not provide demo versions. Below we have listed a list of paid programs for data recovery, to which you can contact, if the free utilities discussed in this review could not solve your problems.
Comments
When commenting on, remember that the content and tone of your message can hurt the feelings of real people, show respect and tolerance to your interlocutors even if you do not share their opinion, your behavior in the conditions of freedom of expression and anonymity provided by the Internet, changes Not only virtual, but also the real world. All comments are hidden from the index, spam is controlled.