Note: This page was only created to give you a brief overview of a specific DiskPatch feature. Before continuing with a procedure please make sure you consult the product manual.

This article describes a general data recovery procedure.

By following these steps, you increase your chances of a successful recovery and work in the safest manner possible!

Note: this article does not address 'boot-issues' (software / O.S. related startup problems).

Step 1: Cloning

Cloning the disk (if possible) should always be the first step in a recovery process. Since you can then perform the recovery on the clone, the clone provides you with a safety net: if the recovery damages the clone, the original is not lost and you could create another clone. Also, cloning the problem disk might give you some additional information about the problem disk, like the status of the disk surface, the status of the controller or the status of the disk itself (screechy noises, clicking noises etc.).

When a disk is going bad (bad sectors appear and/or data becomes unreadable) cloning the disk is vital because each read on the problem disk may generate more damage. In fact, a dying disk should be treated as if the next read action will be the last read action.

To reduce 'noise' caused by data that is already present on the destination disk it is advised you wipe the destination disk first. By wiping I mean that all sectors on the destination should be zeroed, only deleting the partitions or reformatting partitions on the destination disk is not sufficient! By wiping the destination disk you also verify the condition of this disk.

Both disk cloning and wiping can be performed using DIY DataRecovery DiskPatch Pro or higher.

Step 2: Diagnosis

The first thing that needs to be assessed is the physical condition of the problem disk. As mentioned, observations made during the cloning process can provide useful information.

If your tool of choice to clone the disk doesn't detect the disk there are probably electronical or mechanical defects. If the disk is detected but the disk produces abnormal noises (clicking, scratching), the disk is physically damaged. If there is no sound at all, the disk is not spinning up.

If the disk isn't detected, produces noise or doesn't spin up, you should send the disk to a data recovery company that is equipped and qualified to deal with this. For example: http://www.disklabs.com/refer.asp?id=220.

If the disk can be read and the cloning tool creates a logfile, this logfile may include information that is useful for assessing the problem. Please refer to the DiskPatch FAQ forum for more details on the DiskPatch logfile (http://www.diydatarecovery.com/forum/viewtopic.php?t=16).

If the cause for the data loss is known, for example because you have accidentally deleted a partition that you shouldn't have deleted, the diagnosis is pretty straight forward. If data just disappeared 'all of a sudden' additional examination and analysis is required.

Avoid these common mistakes:

- If you are using 'on-board' partitioning tools to assess the situation, be very careful; for example Fdisk deletes key structures when re-creating a partition. You will re-create the partition, but lose it's contents!

- Running on-board or 3rd party 'diagnostics and fixers': by this I mean Windows Chkdsk, Scandisk or 3rd party Chkdsk utilites like Norton Disk Doctor. If one or more volumes can not be accessed, do not use any of the aforementioned utilities!
If those utilities were already used and as a result files disappeared, the contents of those files may have been written to .CHK files. To determine if .CHK files contain usable data you either need to open those files (with a binary file editor) and manually inspect their content, or a specialized tool like CHK-Mate can be used. Note that if files were fragmented before Chkdsk or Scandisk was run, the contents of a file may be scattered among multiple .CHK files.

- The Windows Recovery Console's Fixboot command; this command frequently makes the damage worse! Do not use this command if a volume can not be accessed!

Your first step (after you have cloned the disk) is to verify if volumes or partitions are present. Each disk must contain at least one partition or volume before it can be used for data storage. A partition/volume is defined in the partition table. In Windows 2000/XP a volume can also be defined in the LDM database; managing the LDM database is handled transparantly by the Windows Disk Manager.

In general a volume or partition is assigned a drive letter (by the operating system) through which you can address the volume. If you are no longer able to boot the operating system you need to boot the PC from a diskette or bootable CD.

FAT and FAT32 partitions/volumes, if they're present and intact, can be accessed using a DOS boot diskette. DOS can not access NTFS volumes without the help of a driver (for example NTFS4DOS: http://www.wsdownload.de/download/ntfs4dos/ntfsinst.exe)

- If one or more volumes or partitions can not be found, the problem is probably in the partition tables. Even if the damage extends beyond that, the next step is determining the partition locations (their start position, their size). DiskPatch can be used to get additional information about the partition tables, and DiskPatch can rebuild the partition tables.

- If ALL volumes can be found but one or more volumes can not be accessed, the damage is probably specific to those volumes (the boot sector, the FAT, the MFT, etc.). DiskPatch is often able to indicate if the problems come from a damaged boot sector, and several types of bootsector damage can be repaired by DiskPatch.

- If all volumes are found and can be accessed while only a few files or folders on a particular volume have disappeared or can not be accessed, there is probably only minor file system damage (FAT, MFT or directories are damaged to some degree). In this case running a DiskPatch surface scan can reveal if this damage is caused by unreadable sectors.

Step 3: Repair or Extraction

- Repair:

Before attempting in-place repairs you should verify that the repair utility has an undo feature! As stated earlier, the safest way to conduct repairs is to work on a clone. At the very least, the software used to perform the repairs should create backups of areas that are repaired or allow the user to backup areas of the disk he or she is modifying.

In our experience it is safe to make in-place repairs if the dataloss is caused by a corrupt master boot record, corrupt partition tables or a corrupt boot sector. It is this type of repair that DiskPatch can be used for.
DiskPatch fixes the partition tables and boot sectors, after the user has selected which partitions to repair. DiskPatch allows the user to work on a clone (Pro or higher versions), and can undo all modifications made during the automatic repair.

- Extraction:

If in-place repairs are impossible or undesired, software like iRecover can be used to extract data from the damaged disk, and copy it to an intact disk.

Software like iRecover scans a disk to determine volume locations and their file system specific parameters. Since files are addressed using cluster addresses relative to the start of a data area (like the O.S. does), it is vital that the correct start and end values for a partition or volume are known, and that the software is able to determine the cluster size even if the boot sector is damaged.

If damage extends to the file system's main bookkeeping structures (FAT, MFT), recovery of fragmented files may be impossible (the files may be recovered, but they're probably corrupt/incomplete).

Sometimes all vital file system information can be lost. In this case it may still be possible to recover certain files based on their headers (recovery software checks the file's contents to see what type of file it is and then copies the connected clusters to a file). With this type of recovery file sizes and filenames are often generic. After the files are recovered they must actually be opened one by one to determine their content. DIY DataRecovery is working on a solution to perform file recovery based on file headers.

After files have been recovered, and before re-formatting the problem disk (if possible or desired), the recovered data needs to be verified! It may appear files were recovered (the folder structure is present, files with recognizable names are present), but this is no guarantee the files are actually intact.

Important

Never re-create partitions using Fdisk or the Windows disk management applet to recover partitions!

Select ALL partitions you want to be present after the recovery

First try the DiskPatch demo version to see if the hard disk and the partitions on it are detected by DiskPatch

DIY DataRecovery Technical Support can help determine if DiskPatch can fix the issue you have at hand. For their assessment they require a log file. Under the [Support Menu] you will find the option to create a [Support Analysis Logfile].