Boot sector and partition viewing and recovery
Hard disk drives can often have multiple partitions. These partitions may contain different types of operating systems, such as FAT16, NTFS. Logically, each partition acts as if it is a separate drive.
A very common reason for disks to fail is if the partition information is missing, corrupted, or has been changed due to repartitioning. CnW Recovery software will allow this information to be reconstructed, and tested even on disks where the boot sector has failed totally.
In recovery mode, CnW Recovery software will display details on up to 8 partitions, giving details of format type (FAT16, NTFS etc) start location and length. It is possible for the user to override these locations to overcome corrupted boot sectors etc. The dialog box, also allows the user to select as few or as many as required for the recovery process. For complex recoveries, it is recommended to work on just one partition as a time.
How partitions are defined
On most PC disks, the very first sector on the disk contains some code for booting, and also a table which defines 4 partitions. The partition definition has the following information
- Boot indicator
- Starting head (0-255)
- Starting sector (1-63)
- Starting cylinder (0-1023)
- System ID
- Ending head
- Ending sector
- Ending cylinder
- Relative sectors (0-4G)
- Total sectors (0-4G)
The layout of the table dates back many years, and has caused several bottle necks in maximum disk sizes. For instance, the cylinder number has a maximum value of 1023, and sector has a maximum of 63. When added to a limitation of 16 heads, this produced the 528MB limit on a disk. When a big disk was 30MB, this was not a problem. Later limitations have been at about 8GB, and then about 137GB. The 137GB limit is due to 28 bit sector addressing limit or some earlier operating systems, and controller boards. Occasionally a BIOS update is required to enable drives greater than 137GB to be used. These have slowly been eroded by changing the BIOS on computers, and the current limitation is 2TB. This is a 32 bit sector address (4GB) and the sector size of 512 bytes.
T13 AT Attachment standards committee developed a new 48-bit addressing method. This method increases the address space by approximately a million fold to: 144 Petabytes. It is controlled by EFI entries. It should last a few years.
The partition table starts at byte 0x1BE, and each partition is defined by a 16 byte string. There is space for 4 partitions. Disks may actually contain more than 4 partitions, and this is achieved by using extended partitions, for which there can be any number. Currently the CnW Recover program will support a maximum of 8 partitions
Corrupted Partitions on hard disks
If is a fairly common problem where hard disk partition information is either deleted, or corrupted. Boot sector viruses can also cause damage, or programs attempting to repartition a disk. To assist with recovery, there is a function, Analyse Partitions where the whole disk will be scanned, and possible partition starts will be flagged. These can then be verified, and selected, or changed. There is an option to write these new boot sectors to the failed hard drive, but the program will restore files using a virtual boot sector, and so is unnecessary to change the drive in anyway. For forensic applications, this is essential as disks must never be changed, so maintaining continuity of evidence.
Partition Recovery and Boot Sector recovery
Corrupted, boot sector failure, or missing boot sectors are a major cause of apparent disk failure. With the analysis program, this can be resolved, and often all data on the hard disk drive recovered. The program will determine a possible boot sector, at which time a restore may be done, without actually changing the boor sector on the disk. This enables variations of boot sectors to be tried, before a new boot sector is written to the disk. It also allows disks to be recovered, when it is not possible to write a physical boot sector.
When finally happy with the partition parameters, there is an option to write the boot sector back to the disk. In this process, the original boot sector is read, and saved as a file on the main operating system disk. The partition tables are then updated, and the sector written back to sector 0. If it is not possible to write to this sector, then the operation will fail, and the disk will remain usable in a normal PC.
Types of partition