Deleted partition

Partition is deleted or Partition Table is damaged

The information about primary partitions and an extended partition is contained in the Partition Table, a 64-byte data structure, located in the same sector as the Master Boot Record (cylinder 0, head 0, sector 1). The Partition Table conforms to a standard layout, which is independent of the operating system. The last two bytes in the sector are a signature word for the sector and are always 0x55AA.

Here is a Partition Table which will be used as an example:

   Physical Sector: Cyl 0, Side 0, Sector 1
   0000001B0                                              80 01   ..............€.
   0000001C0   01 00 07 FE 7F 3E 3F  00 00 00 40 32 4E 00 00 00   ...?>?...@2N...
   0000001D0   41 3F 06 FE 7F 64 7F 32  4E 00 A6 50 09 00 00 00   A?.?d2N.¦P....
   0000001E0   41 65 0F FE BF 4A 25 83  57 00 66 61 38 00 00 00   Ae.??J%?W.fa8...
   0000001F0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 AA   ..............U?
   

There are three existing and one empty entry:

• Partition 1, offset 0x01BE (446)
• Partition 2, offset 0x01CE (462)
• Partition 3, offset 0x01DE (478)
• Partition 4 - empty, offset 0x01EE (494)

Each Partition Table entry is 16 bytes long, making a maximum of four entries available. Each partition entry has fields for Boot Indicator (BYTE), Starting Head (BYTE), Starting Sector (6 bits), Starting Cylinder (10 bits), System ID (BYTE), Ending Head (BYTE), Ending Sector (6 bits), Ending Cylinder (10 bits), Relative Sector (DWORD), Total Sectors (DWORD).

Thus, the MBR loader can assume the location and size of partitions. The MBR loader looks for the "active" partition, i.e. the partition that has a Boot Indicator equal to 0x80 (the first one in this case) and passes control over to the partition boot sector for further loading.

Consider the situations which cause a computer to hang up while booting or hang up due to data loss.

1. What will happen if no partition has been set to the Active state (Boot Indicator=0x80)?

2. What will happen if the partition has been set to an Active state (Boot Indicator=0x80) but there are no system files on that partition?

3. What will happen if a partition entry has been deleted?

4. What will happen if a partition entry has been damaged?

How can recovery software help you in the above-mentioned scenarios?

1. Discover and suggest which partition is to be set as active (FDISK also does this).
2. Perform a disk scan of the free space to look for a partition boot sector or remnants of deleted partition information in order to try to reconstruct the Partition Table entry for the deleted partition.
3. Perform disk scan on all space to look for partition boot sector or remnants of deleted partition information in order to try to reconstruct the Partition Table entry for the deleted partition.

Why is the partition boot sector so important?

It contains all the necessary information about the partition so that if recovery software finds it, it can reconstruct the partition entry in the Partition Table. (see Partition Boot Sector topic for details).

What would happen if a partition entry had been deleted then recreated with other parameters and re-formatted?

In this case, a new partition would exist instead of the original one.

Everything would work properly with the exception that you could not go back to the original partition if important data is still there.

If you've created a MBR, a Partition Table, or a Volume Sectors backup beforehand (as can be done with Active@ Partition Recovery and Active@ UNERASER for example), you can virtually restore it and look for your data (in the case it has not yet been overwritten by new data).

Some advanced recovery tools also have an ability to scan disk surfaces and try to reconstruct previously deleted partition information from the pieces of left over information (i.e. perform virtual partition recovery). However it is not guaranteed that you can recover something.