Partition tables become corrupt for various (often obscure) reasons, causing various symptoms, including but not limited to the following most common:
* Some volumes just disappear. Disk Manager may show either unallocated space or something weird where the volume(s) are supposed to be.
* System may refuse to boot up with messages similar to “Bad or missing partition table“, “Error loading operating system”, or without any messages at all (in this case double check cabling and SCSI termination, BIOS settings, and that BIOS does successfully detect the drive).
* “Phantom” volumes or free space areas may appear in the Disk Manager (i.e. the ones you did not create). The total storage capacity (calculated by summing up all volume and free space area sizes) may be exceed the capacity of the physical disk. This indicates that some volumes overlap with each other, a particularly dangerous situation because writes to one volume end up damaging the other one. Note that Disk Manager GUI has no way to indicate such an overlap, you need to perform the calculations yourself.
* In rare cases Windows blue screen STOP: INACCESSIBLE_BOOT_DEVICE is caused by the damaged partition table, most likely reasons for this error being a RAID drivers and/or BIOS/cabling issues.
Typical partition damage profiles are illustrated below:
(1) (2) (3)
Note: red vertical lines indicate inaccessible data.
(1) illustrates the most simple situation caused by an operator error – the deletion of a wrong volume. The data is still intact and in place, albeit inaccessible. Since the reference to the volume is deleted, there is no way for the operating system to reach that data.
(2) is the example of a significant localized damage, similar to that caused by some viruses. This is the worst case scenario: all the partition table entries are either damaged (MBR) or inaccessible (no route to locate EPPs). On top of that, the boot sector of a primary volume is damaged and in case of FAT32 file system, the backup boot sector is also gone (since it is stored close to the primary one).
(3) illustrates partition chain corruption. Note that both logical drives are lost once the first link has been broken.
False positives while scanning for missing partitions
Modern filesystems store a backup of the boot sector somewhere on the volume. FAT32 typically places it into the 6th sector of the volume. On NTFS, the backup copy is stored in the last sector of the volume. FAT16 does not have a backup boot sector. ZAR attempts to identify and filter out these backups, but filtering is not perfect and some “phantom” volumes may appear. With FAT32, it does not matter whether you specify the primary boot sector data or the backup copy because the difference between their location is minor and ZAR will easily accommodate it during filesystem analysis.
In-place repair possibilities
It is sometimes possible to repair the damaged partition table in-place, i.e. by modifying the damaged drive. In the situations like (4) and (6) above, the immediate and exact recovery is achieved by manually editing the MBR. This operation does however require a person skilled in direct disk editing, and such people are somewhat of a scarce resource. That said, we generally do not recommend any kind of the in-place repair for a real world use.
Resource: ZAR data recovery
Data recovery Salon welcomes your comments and share with us your ideas, suggestions and experience. Data recovery salon is dedicated in sharing the most useful data recovery information with our users and only if you are good at data recovery or related knowledge, please kindly drop us an email and we will publish your article here. We need to make data recovery Salon to be the most professional and free data recovery E-book online.