Partition is Deleted or Partition Table is Damaged

Information about primary partitions and extended partitions is contained in the Partition Table, a 64-byte data structure, located in the same sector as the Master Boot Record (cylinder 0, head 0, sector 1). The Partition Table conforms to a standard layout, which is independent of the operating system. The last two bytes in the sector are a signature word for the sector and are always 0x55AA.

For our example disk layout we have a Partition Table that looks like this:

Physical Sector: Cyl 0, Side 0, Sector 1
0000001B0                                              80 01   ..............Ђ.   
0000001C0   01 00 07 FE 7F 3E 3F  00 00 00 40 32 4E 00 00 00   ...?>?...@2N...
0000001D0   41 3F 06 FE 7F 64 7F 32  4E 00 A6 50 09 00 00 00   A?.?d2N.¦P....
0000001E0   41 65 0F FE BF 4A 25 83  57 00 66 61 38 00 00 00   Ae.??J%?W.fa8...
0000001F0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 AA   ..............U?

We can see three existing entries and one empty entry:

  • Partition 1, offset 0x01BE (446)
  • Partition 2, offset 0x01CE (462)
  • Partition 3, offset 0x01DE (478)
  • Partition 4 - empty, offset 0x01EE (494)

Each Partition Table entry is 16 bytes long, making a maximum of four entries available. Each partition entry has fields for:

  • Boot Indicator (BYTE)
  • Starting Head (BYTE)
  • Starting Sector (6 bits)
  • Starting Cylinder (10 bits)
  • System ID (BYTE)
  • Ending Head (BYTE)
  • Ending Sector (6 bits)
  • Ending Cylinder (10 bits)
  • Relative Sector (DWORD)
  • Total Sectors (DWORD)

From this information the MBR loader can assume the location and size of partitions. The MBR loader looks for the "active" partition, i.e. the partition that has the Boot Indicator equal to 0x80 (the first one in our case) and passes control to the partition boot sector for further loading.

Four Situations When Data Loss Causes Computer Startup to Hang

The four situations are:

  1. No partition has been set to Active state.
  2. No System Files on the Boot Partition.
  3. Partition entry has been deleted.
  4. Partition entry has been damaged.

1. No partition has been set to the Active state (Boot Indicator=0x80)

In our sample computer, we will remove the Boot Indicator from the first partition:

0000001B0                                            00 01  ................   
0000001C0 01 00 07 FE 7F 3E 3F  00 00 00 40 32 4E 00 00 00  ...?>?...@2N... 

When we try to boot with this change to the Partition Table, we see an error message like "Operating System not found". This tells us that the loader cannot determine which partition contains the active os system and therefore does not know where to pass control to.

2. Partition has been set to the Active state (Boot Indicator=0x80) but there are no system files on that partition.

(This example can happen if we had used FDISK and not selected the correct active partition).

The loader will try to boot from the indicated partition and will fail. It will try to boot again from other devices like the floppy. If this attempt fails to boot, there will be an error message like "Non-System Disk or Disk Error".

3. Partition entry has been deleted

If the partition entry has been deleted, the following two partitions will move one line up in the partition table.

Physical Sector: Cyl 0, Side 0, Sector 1
0000001B0                                              80 00   ..............Ђ.
0000001C0   41 3F 06 FE 7F 64 7F 32  4E 00 A6 50 09 00 00 00   A?.?d2N.¦P....
0000001D0   41 65 0F FE BF 4A 25 83  57 00 66 61 38 00 00 00   Ae.??J%?W.fa8...
0000001E0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0000001F0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 AA   ..............U?

In the Partition Table above, we have removed the partition entry. If we try to boot now, the second (FAT) partition will be read as the first and the loader will try to boot from it. If the second partition is not a system partition, we will get the same error messages as in the previous example.

4. Partition entry has been damaged

In our example Partition Table, we will write zeros to the location of the first partition entry to simulate a damaged entry.

Physical Sector: Cyl 0, Side 0, Sector 1
0000001B0                                              80 00   ..............Ђ.
0000001C0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0000001D0   41 3F 06 FE 7F 64 7F 32  4E 00 A6 50 09 00 00 00   A?.?d2N.¦P....
0000001E0   41 65 0F FE BF 4A 25 83  57 00 66 61 38 00 00 00   Ae.??J%?W.fa8...
0000001F0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 AA   ..............U?

If we try to boot now, the MBR loader will try to read and interpret zeros as partition parameters. (The zeros are simulating a damaged entry that could be other garbage or random characters.) The error message that appears will be "Missing Operating System".

This is the reason why the second step in partition recovery is to run Disk Viewer to make sure that the proper partition exists in the partition table and has been set as active.

How can recovery software help in the above-mentioned scenarios?

A recovery utility will automate these methods of discovery as follows:

  1. Discover an error and suggest that you choose a partition and make it active (even FDISK does this).
  2. Perform a free disk space scan to look for the partition boot sector or remaining data from deleted partition information in order to try to reconstruct the Partition Table entry for the deleted partition.
  3. Perform a scan of the entire disk space to look for a partition boot sector or remaining data from the damaged partition information in order to try to reconstruct Partition Table entry for the damaged partition entry.

Why is Partition Boot Sector so Important?

If data recovery software finds the Partition Boot Sector, all necessary parameters to reconstruct partition entries can be found here. (see Partition Boot Sector topic for details).

What Happens in This Case: Partition entry is deleted then recreated with other parameters and re-formatted?

To further describe this case, the original partition entry is replaced by a new re-constructed one. All file partitions work fine and drive operation continues until, at a later date, someone recalls some missing and important data on the original partition

If MBR, Partition Table, Volume Sectors backup was created before partition re-construction (for example, Active@ Partition Recovery and Active@ UNERASER can do this), you can virtually restore the old, damaged partition entry and look for your data (provided it has not been overwritten with new data yet).

Some advanced recovery tools also have an ability to scan disk surface and try to reconstruct the previously deleted partition information from the residual data of remaining information (i.e. perform virtual partition recovery). However it is not guaranteed that you can recover anything.

 

sales@lsoft.net

+1 (877) 477-3553,
+1 (905) 812-8434

LSoft Technologies Inc.
2550 Argentia Road, Suite 218
Mississauga, Ontario
L5N 5R1
Canada

© 2016 LSoft Technologies Inc.