The key to successful partition recovery is knowing the sizes and locations of the missing volume(s). The simplest situation is if the disk was partitioned as a single logical drive. In this case it is efficient to assume that volume occupies the whole physical drive and let the filesystem recovery algorithm do the rest. The “slack” space before and after the volume is typically small and does not create any significant distortion. Partition recovery becomes more complicated when multiple volumes are involved, because the damage to MBR or somewhere early in the extended partition chain makes multiple volumes disappear at once. The difficult part is then to define the boundaries between the volumes. To solve the problem, utilize following features of the on-disk layout to the full extent:
* The boot sectors (and their backup copies if any, see below) may be still be intact on the disk. ZAR can search for and identify any such remains. Manual attribution of the found objects to their corresponding volumes is still required, but the disk scan results are in most cases helpful.
* The volumes are placed close to each other. “Slack” (unused) space between them is typically about 64 or 128 sectors (32KB and 64KB respectively). For partition recovery purposes, it is in most cases safe to disregard this slack space and treat the allocation as contiguous. This provides a last-resort information: one can derive the location of the volume by simply summing up the sizes of the volumes before it.
Take a special note that FAT series filesystems (FAT16 or FAT32) place their metadata very close to the start of the volume. So, the filesystem recovery process is much more sensitive to lower (start) boundary of the volume than to the upper (high) boundary. Keep this in mind when manually defining the areas for the filesystem recovery.
Manual volume definition
The process of manually defining the volume seems pretty straightforward. However, there are some tricks involved, depending on the original volume placement.
* The physical disk containing the single volume is the simplest albeit widespread case. A special option is designed specially for these cases and you should use it when appropriate.
When there are multiple volumes on a physical disk, the following considerations apply
* The volume is at this stage defined by its two location parameters: offset and size. Offset is a distance from start of a physical disk (sector 0) to the start of the volume (boot sector). It can be expressed either in megabytes or in sectors. Take note that size-based specification (in megabytes) is imprecise (due to the rounding-off errors).
* When exact data is available, just enter the appropriate values (sector-based) and you’re all set.
* If no exact data is available, compute starting offset by summing up sizes of all the volumes before the damaged one, then subtract 20MB to compensate possible rounding errors. If the result comes negative, use zero instead. Then, enter the resulting value as a starting offset.
* Increment the volume size by 20MB to compensate starting offset shift, and enter this value as appropriate. If you do not know the volume size precisely, use lower values (for example if the size is around 4.5GB, enter 4400 MB).
* The placement errors are almost inevitable. It is preferred that you shift the volume towards the “front” of the disk (lower offsets and sector numbers). ZAR does not always honor the boundaries you set, and will trespass them if deemed appropriate, e.g. when following the explicit file reference. However, lower (start) boundary is more “rigid” and has more impact on the recovery results than a higher (start + size, end-of-volume) boundary.
Measurement unit conversions
Unit conversion is influenced by the fact that binary, rather than decimal, numbers are used in computers. Hence the K (kilo) prefix is applied for 1024 units, rather than 1000:
* 1 KB (kilobyte) = 1024 bytes
* 1 MB (megabyte) = 1024 KB = 1 048 576 bytes
* 1 GB (gigabyte) = 1024 MB = 1 048 576 KB = 1 073 741 824 bytes
* 1 sector contains 512 bytes
* 1 KB (kilobyte) contains 2 sectors
* 1 MB (megabyte) contains 2048 sectors
Recommended data recovery software today: http://www.z-a-recovery.com/download.htm
Data recovery Salon welcomes your comments and share with us your ideas, suggestions and experience. Data recovery salon is dedicated in sharing the most useful data recovery information with our users and only if you are good at data recovery or related knowledge, please kindly drop us an email and we will publish your article here. We need to make data recovery Salon to be the most professional and free data recovery E-book online.