How to Recover Deleted Partition on Hard Disk?

Overview

Partition is a continuous disk area logically divided by a storage device. In the computer, the operating system also assigns a drive letter to each normal partition, such as C, D, E, etc. Dividing the hard disk into one or more partitions makes it more convenient for investigators to install the operating system, store and manage data. The number and size of partitions on the hard disk are not fixed. Partitions can be deleted, formatted, hidden, cloned, re-created, etc. Usually there is a large amount of data stored in partitions, such as photos, videos, music, documents, work materials, emails, databases, etc. If one partition is lost, the data in the lost partition will also be lost.Therefore, how to recover lost partition is a big problem.

When encountering the problem of partition loss, we usually have these questions: Can the data be recovered after the partition loss? How to recover deleted partitions and data simultaneously? Can lost partitions and data be recovered to the original disk? According to the current data recovery technology, in many cases, lost partitions and data can be recovered.

Also interested in other data recover cases?

How to Recover Formatted Data with Partition Recovery Software?

Western Digital USB Hard Disk Data Recovery Tips — Step by Step

Common Causes of Partition Loss

Here are some common reasons cause for partition loss:

• Partition deleted accidentally: In addition to the partition where the operating system is located, investigators can easily delete other partitions through the system’s own disk management tool. Therefore, partition deleted accidentally is the main reason for partition loss.
• Repartitioning: Repartitioning a storage device will erase existing partitions and data, and then create new partitions. If no data is written after the repartitioning, the probability of recovering lost partition is high.
• Virus Damage: Computer viruses or malicious programs can cause various problems and threaten data security. Some viruses can destroy partitions or even delete partitions.
• Partition table is corrupted: The partition table stores important information about the partition, such as the starting position of the partition, the number of partitions, the partition type, etc. If the partition table is corrupted, the system will not know where the partition is and cannot access the data in the partition.
• Bad sectors: Bad sectors can cause various problems, such as hard disk stuck, data corruption, the entire space becoming unallocated, and all original partitions being lost, etc.

Case Study

There is an involved virtual hard disk contains a partition which was deleted accidentally, and the data needs to be recovered. Let’s delve into how to recover deleted partition:

Inspection Material: “test.vhd”

Recover Tool: DRS Data Recovery System

Before we start, let’s take a look at how partitions are accidentally deleted:

1. Right- click a specific partition and click “Delete Volume”

2. It prompts that deleting this partition will erase the partition data. After clicking “Yes”, both the partition and the data in the partition will be deleted.

3. When the partition is deleted, the lost partition will be displayed as unallocated in the “Disk Management”.

4. Scan lost partitions after accidental partition deletion through the DRS Parition Recover ToolData Recovery System

• Open the DRS partition recover tool and select the File recovery/ File Carving function on the homepage.

• Add the image file “test.vhd” involved in the case.

• After adding the image file, it is shown that the image file currently has two partitions, one of which is the Microsoft reserved partition and the other is the basic data partition. Before the partition is accidentally deleted, the virtual hard disk has two basic data partitions. In this case, the lost partition needs to be scanned.

• Right-click the loaded virtual hard disk and then click “Scan For Lost Partitions”.

• Click “Start” to scan the lost partition. By default, the scan process starts from the initial logical block address “0” (that is, scanning the entire disk). The investigators can also customize the initial logical block address according to the actual situation.

• After successfully scanning out the lost partition, the basic information of the partition, such as the partition name, file system, capacity, sector offset value, and total number of sectors will be displayed on the interface.

• Select the lost partition to perform a deep scan to scan the data in the lost partition (compared with quick scan, the scan results of deep scan will be more comprehensive, including ordinary, deleted, overwritten, formatted data and fragmented data)

• Successfully scanned out the data in the lost partition, including some word documents , PDF documents and pictures involved in the case

• By double-clicking the scanned file with the mouse, the investigators can preview it inside the DRS software (supports previewing files in multiple formats, including Word ,PDF, png , jpg, etc.)

Notes

After discovering that the partition has been deleted, please do not operate the computer at will to avoid increasing the difficulty to recover deleted partition and lost partition data:

• Do not perform any operations on the hard drive with lost partitions.
• Do not format the hard drive with lost partitions.
• Do not add new items to the partition.
• Do not rebuild the partition table.