Home | Products | Download | Purchase | Support

DIY DataRecovery.nl

 
General Data Recovery FAQ

What NOT to do when confronted with a data recovery situation

My disk appears to be physically damaged, what can I do?

I have accidentally formatted a partition, what can I do?

I have accidentally deleted one or more files, what can I do?

I have lost or deleted one or more partitions, what can I do?

DiskPatch, iRecover or iUndelete: which tool to pick for the job

I will buy a license if you guarantee success

My hardware RAID 0 array is no longer detected

"Invalid system disk" (Windows 9x versions only)

Diagnosing and resolving NT boot issues

General data recovery procedures

Terminology: an explanation of terms used in data recovery and disk usage

 
What NOT to do when confronted with a data recovery situation
These 5 golden rules apply (until you know exactly what you're dealing with):
  • DO NOT run "chkdsk" or "scandisk" or any other partition repair utility
  • DO NOT use the Windows recovery console commands "fixmbr" or "fixboot"
  • DO NOT attempt to recreate a deleted partition with "Fdisk" or "Disk Management"
  • DO NOT change the contents of the disk or partition that needs to be recovered
  • DO NOT recreate a failed or broken RAID0 or RAID5

If you need help diagnosing the problem please look here to find out how to get started.

 
My disk appears to be physically damaged, what can I do?
If the hard disk makes unusual noises (clicks, grinding, scratching etc.):

STOP using it immediately and do not attempt any software based recovery! Recovering data from a physically defective disk is very expensive so consider the need for this type of recovery carefully.

The hard disk spins but is not detected in the BIOS:

This can be caused by a number of things ranging from defective IDE cables to physical damage:

  • Make sure the drive is properly configured in the BIOS (the AUTO setting should do well in most circumstances)
  • Make sure the drive is properly jumpered
  • You can try if the disk is detected using different hardware; a different PC, different cables etc.

Sometimes swapping the drive circuit board with one from an identical disk (type AND revision) can resolve this.

Drive doesn't spin up:

Consider if the value of the data outweighs the cost of data recovery by an outfit equipped to deal with physical defects (expertise, tools, cleanroom environment etc.).

Drive contains unreadable sectors:

Clone the drive immediately using DiskPatch. If required repair logical structures on the clone or extract data from the clone using a tool like iRecover.

 
I have accidentally formatted a partition, what can I do?
Important: avoid writing data to the accidentally formatted drive/partition!

Successful recovery of deleted files depends on certain factors:

  • The file system type that is in use (FAT or NTFS)
  • The level of fragmentation
  • Is all data still available (or already overwritten)

Background: when formatting a drive a large portion of the administrative and meta information is re-initialized, but not all of it. Whether recovered data will be intact highly depends on the fragmentation of the file system: since there's no way of telling exactly what clusters "belonged" to specific files, recovery software will assume that the file system was not fragmented and files were stored in consecutive clusters. The effect of fragmentation on the quality of the recovered files is higher for FAT(32) than it is for NTFS.

What to do: if the partition was reformatted with a different file system, or the same file system using different parameters (for example different cluster sizes) than this will further complicate the recovery. When the program used for the recovery allows it (as iRecover does), specify exactly what file system you are "looking for". So if for example a FAT32 drive was accidentally formatted NTFS, tell the software to "treat" the partition as if it were a FAT32 drive.

The only way to verify if files can be recovered intact is by trying. In general, if the FAT(32) drive was recently defragmented chances for a good recovery are high. Large files have a higher chance of being fragmented and so have files that are frequently modified. Again, for drives that were originally formatted NTFS, this is less of an issue.

For this specific scenario we advise against the use of tools that attempt "in place" repairs; that is, tools trying to repair the file system. In general those repair attempts are almost never successful and they can't be undone, which in the end makes data recovery even harder.

Suggested tool for the job: iRecover.

 
I have accidentally deleted one or more files, what can I do?
Important: if you have deleted or lost files, immediately STOP writing to the partition that contained the lost files!

Successful recovery of deleted files depends on certain factors:

  • The file system type that is in use (FAT or NTFS)
  • The level of fragmentation
  • Is all data still available (or already overwritten)

Background: when a file is deleted its actual contents initially remain intact. However, in the partition's book-keeping of clusters in use by the file, these clusters are marked as free for use. The deleted file's name is modified so the deleted file no longer appears in the directory list. As it is no longer known exactly what clusters "belonged" to the deleted file, the successful recovery of files that were not stored in consecutive clusters is uncertain. If fragmentation is high the chances of a good recovery become less.

What to do: whatever tool you use to undelete files, do NOT copy the tool to the partition from which the files were deleted, and do not recover the deleted files by copying them to another folder on the same partition!

Suggested tool for the job:
If you have additional problems with the partition, use iRecover.
If it's just a simple undelete job and the partition is fine, use iUndelete.
 
I have lost or deleted one or more partitions, what can I do?
Important: if you have deleted or lost partitions do NOT try to recreate them using Fdisk, Disk Management, or any on-board or third party volume management utility!

Normally you can repair this type of damage with DiskPatch by rebuilding the partition table. Alternatively, you can extract data rather than fixing the damaged disk using iRecover to copy data from the deleted partitions to another disk.

Please note the functional difference between the two approaches:

  • DiskPatch repairs structures on-disk, thus changing the contents of the disk. Changes made by the automatic repair can be undone.
  • iRecover extracts files from the disk, not changing the contents of the disk.

Which approach to take depends on the nature of your problem (and perhaps even personal preference). When posting a request for support, we will suggest which tool is best suited for the job.

 
DiskPatch, iRecover or iUndelete: which tool to pick for the job
For the uninitiated it may be tricky to pick the right tool for the problem you're currently facing. Let's see if we can make some things a bit clearer.

Our three main tools for Data Recovery are DiskPatch, iRecover and iUndelete. There is some minor overlap in functionality but each tool has its own specific uses:

DiskPatch: performs actual repairs on the (physical) disk
iRecover: lifts data from disks that may suffer from all sorts of problems
iUndelete: undelete files, pure and simple

Obviously this is the short version of the description but it will give you an idea of which tool to pick for your recovery job. We'll look a bit closer now, and see what differentiates the tools.

DiskPatch:
This tool is aimed at working with a hard disk in general and puts the actual disk center stage. This means that a lot of the things you can do with DiskPatch are based on fixing disk related problems. Use DiskPatch to clone (copy) a disk that has read problems, or to wipe a disk that needs to cleared. You can also check the disk's surface and get an idea of your disk's health. One of the more elaborate functions though is one step above the hardware and involves the volumes that are on the disk. As you may or may not know, all volumes on a hard disk have a number of structures that define them. A partition table for instance defines the size and types of the volumes, and a boot sector tells the operating system where to find important bookkeeping information in the volume. You can read more about these structures in this faq item. If any of these structures is damaged you can not access the volume. DiskPatch can identify problems in these structures and repair them. It's important to understand that DiskPatch actually corrects things on the disk: this is the main difference between DiskPatch and our other tools; iRecover and iUndelete do not actually repair things, they copy files to a safe location.
One thing that might be difficult is to recognize a certain problem and determine if DiskPatch is the way to go. An example would be a damaged boot sector; this would prevent you from accessing the data normally. You could use iRecover to copy the data to safety but repairing the boot sector would be much quicker and much more convenient. So in this case you would need DiskPatch to repair that boot sector. To help you identify such problems we have created the DiskPatch walkthroughs and getting started guide. Look at the getting started page and see if your particular problem is listed. Remember: you can at any time ask us for help, free of charge. Post your problem description in our support forum and we will suggest the right course of action.

iRecover:
This is the tool you need if you have problems accessing your data.  If a volume has been damaged or corrupted by an accident and you no longer have normal access to the files, use iRecover to analyze the volume and copy the files to safety. You can even analyze whole disks and copy files to safety from any volume that was on that disk. Causes for volume corruption could be virus damage, operating system crashes, partition management actions (like merging or resizing) that went wrong, or even read errors. iRecover can be used to read data from disks that have read problems (bad sectors) but in general it is best to clone such a disk first (cloning can be done with DiskPatch).
One of the strong points of iRecover is working with RAID disks. If a RAID set has sustained damage you can use iRecover to analyze the individual disks and copy files from the RAID set to safety, as if it was a single volume: iRecover handles all the actions that are required to "reconstruct" the RAID set and access the files. All you would have to do is select the files and have iRecover copy them to a safe place. Please note that iRecover does not actually repair things; the RAID set is not repaired. Rather, the RAID parameters are determined by iRecover and are used to access the disks as if they are still a functional RAID set.
The original (problem) disks are never changed. This is a good thing: if things didn't work out after the first try you can simply try again (adjusting some parameters if needed) and see what the second attempt brings you. If the disks would be edited by iRecover that would not be possible.
iRecover is somewhat "heavy duty", meaning that it is a professional recovery solution that can be used for just about every possible scenario. There's even support for Linux based volumes. iRecover is the tool to have in a PC repair shop, or an IT department. This doesn't mean that home users should be intimidated: iRecover's scope and wizard-like interface will make sure that every user of any level can recover his or her files.
iRecover also has a digital image recovery mode: use this to recover pictures from cameras and memory cards.

iUndelete:
True to its name, this tool undeletes files. It's the simplest way to get files back from beyond the Recycle bin. iUndelete supports most known file systems but doesn't handle damaged partitions or bad disks. It's undeleting, pure and simple. Make sure you understand that iUndelete can only be used if the disks and partitions are okay; if anything is wrong with the partitions you'll have to use one of our more advanced tools. Just look at iUndelete as an extension to the Recycle bin.
 
I will buy a license if you guarantee success
We can never and will never guarantee a positive outcome. All we can tell you is that we will make every effort to help you recover your data, if things do not initially work out when using our software. You are free to contact us to see if we can make an estimate on the recoverability of your data. Find information on how to contact us here.

You can verify if the software actually runs and detects your disks by running the demo versions. The demo versions will give a fair indication of the possibility of data recovery:

  • You can test to see if the physical disks are detected; if the demo version does not find the disks, the registered version won't either
  • They will detect or not detect lost partitions; if the demo version does not find any partitions, the registered version won't either
  • Using the demos (DiskPatch especially) you can generate log files: you are welcome to submit the log files to us, we will always give a fair assessment of the chances for a successful recovery.
 
My hardware RAID 0 array is no longer detected
Users have reported successful recoveries using DiskPatch. We can not guarantee that DiskPatch will work with each and every hardware RAID 0 setup. Please note that the following scenario applies to hardware RAID 0 arrays.

Scenario:

A RAID 0 array is no longer valid or detected as an array. Using the RAID setup configuration to re-create the array results in a warning message indicating that all data on the disks will be lost.

Solution:

Even after continuing and ignoring the warning message, users frequently reported that DiskPatch was able to recover all partitions on the re-created array using the "normal" procedures for recovering lost partitions.

Explanation:

It appears only the MBR on the array was blanked and this resulted in data loss. DiskPatch can almost always recover all partitions after they were lost due to a wiped MBR. Whether DiskPatch does this on a disk or a hardware RAID array makes no difference.

 
"Invalid system disk" (Windows 9x versions only)
This description is relevant for Windows 9x versions ONLY.

First, make sure there is no diskette in the floppy drive. If there is, remove the diskette and reboot your computer. If the problem persists and is not floppy related, do the following:

Important! Do not perform any of the following actions if the partition can not be accessed!

  • Boot the computer from the Operating System boot diskette. Run Scandisk on the C: drive to detect and repair any disk errors.
  • Make sure your hard drive is not compressed and that no anti-virus programs are running.
  • Insert a bootable diskette that contains the same system files as the operating system on your hard drive. For example, if you have Windows 95b on your hard drive, insert a bootable floppy that was created using Windows 95b.
  • Run the program "SYS.com" as follows: type "SYS A: C:" <enter>. The file SYS.com can usually be found in the c:\Windows\Command folder.
  • The necessary system files will be transferred from the floppy to the appropriate location on your hard drive. When the process is complete, remove the bootable floppy and restart your computer. You should now be able to boot your operating system.

Note that damage to the partition's boot sector may be beyond what can be repaired by using the above procedures. For instance, damage to the BPB (which contains important meta information about the file system) can not be repaired this way; this type of damage can often be repaired by DiskPatch.

 
Diagnosing and resolving NT boot issues
The following will help you diagnose boot problems for Windows NT, and recover the operating system if necessary. The following files must be located on the Windows NT System partition:

NTLDR -- The "NT Loader" takes control of the entire boot process until control is given to NTOSKRNL.EXE. (This occurs when the NT system menu option is selected.)

BOOT.INI -- This file contains the location of the NT boot partition and displays the menu options on bootup.

BOOTSECT.DOS -- This file takes control from NTLDR if you are running an operating system other than Windows NT.

NTDETECT.COM -- This file detects the installed hardware and adds the hardware list to the registry.

If any of the above files are missing or corrupt, an error message will be reported that may prevent Windows NT from loading properly. The following paragraphs outline some common error messages and their solutions.

"Couldn't find NTLDR. Please insert another disk."
This error message will occur during bootup if NTLDR is missing, or if there is a diskette in the floppy drive. To solve the problem, run an NT Repair.

"Windows NT could not start because the following file is missing or corrupt: winntrootsystem32ntoskrnl.exe"
This error will almost always indicate that the boot.ini is pointing to the wrong partition. It can also be reported if NTOSKRNL.EXE has become corrupted. To solve the problem first verify that the boot.ini points to the boot partition. If the boot.ini is correct, run an NT Repair; if the NTOSKRNL.EXE is corrupt, it will be repaired.
Note: If the BOOT.INI is missing, NTLDR will attempt to boot NT from the default directory of the active partition. If this fails, the above error message will also be reported.

"I/O Error Accessing Boot Sector File..{ARC Path..}"
This error message will occur when attempting to boot to another operating system other than Windows NT. This occurs when BOOTSECT.DOS is missing. To solve the problem run an NT Repair.

"NTDETECT v1.0 Checking Hardware...NTDETECT failed"
This error message will occur if NTDETECT.COM is missing or corrupt. To solve the problem run an NT Repair.

 
General data recovery procedures
This article describes a general data recovery procedure.

By following these steps, you increase your chances of a successful recovery and work in the safest manner possible!

Note: this article does not address "boot-issues" (software / O.S. related startup problems).

Step 1: Cloning

Cloning the disk (if possible) should always be the first step in a recovery process. Since you can then perform the recovery on the clone, the clone provides you with a safety net: if the recovery damages the clone, the original is not lost and you could create another clone. Also, cloning the problem disk might give you some additional information about the problem disk, like the status of the disk surface, the status of the controller or the status of the disk itself (screechy noises, clicking noises etc.).

When a disk is going bad (bad sectors appear and/or data becomes unreadable) cloning the disk is vital because each read on the problem disk may generate more damage. In fact, a dying disk should be treated as if the next read action will be the last read action.

To reduce "noise" caused by data that is already present on the destination disk it is advised you wipe the destination disk first. By wiping we mean that all sectors on the destination should be zeroed, only deleting the partitions or reformatting partitions on the destination disk is not sufficient! By wiping the destination disk you also verify the condition of this disk.

Both disk cloning and wiping can be performed using DIY DataRecovery DiskPatch.

Step 2: Diagnosis

The first thing that needs to be determined is the physical condition of the problem disk. As mentioned, observations made during the cloning process can provide useful information.

If your tool of choice to clone the disk doesn't detect the disk there are probably electronical or mechanical defects. If the disk is detected but the disk produces abnormal noises (clicking, scratching), the disk is physically damaged. If there is no sound at all, the disk is not spinning up.

If the disk isn't detected, produces noise or doesn't spin up, you should send the disk to a data recovery company that is equipped and qualified to deal with this. For example, DiskLabs.

If the disk can be read and the cloning tool creates a log file, this log file may include information that is useful for assessing the problem. When requesting support always include the relevant log file (DiskPatch creates a detailed log that contains information on what could and could not be read, always include this log file when requesting support).

If the cause for the data loss is known, for example because you have accidentally deleted a partition that you shouldn't have deleted, the diagnosis is pretty straightforward. If data just disappeared "all of a sudden" additional examination and analysis is required.

Avoid these common mistakes:

  • If you are using "on-board" partitioning tools to assess the situation, be very careful; for example Fdisk deletes key structures when re-creating a partition. You will re-create the partition, but lose its contents!
  • Running on-board or 3rd party "diagnostics and fixers": by this we mean Windows Chkdsk, Scandisk or 3rd party Chkdsk utilites like Norton/Symantec Disk Doctor. If one or more volumes can not be accessed, do not use any of the aforementioned utilities! If those utilities were already used and as a result files disappeared, the contents of those files may have been written to .CHK files. To determine if .CHK files contain usable data you either need to open those files (with a binary file editor) and manually inspect their content, or a specialized tool like CHK-Mate can be used. Note that if files were fragmented before Chkdsk or Scandisk was run, the contents of a file may be scattered among multiple .CHK files.
  • The Windows Recovery Console's Fixboot command; this command frequently makes the damage worse! Do not use this command if a volume can not be accessed!

Your first step (after you have cloned the disk) is to verify if volumes or partitions are present. Each disk must contain at least one partition or volume before it can be used for data storage. A partition/volume is defined in the partition table. In Windows 2000/XP/Vista/7/8 a volume can also be defined in the LDM database; managing the LDM database is handled transparently by the Windows Disk Manager.

In general a volume or partition is assigned a drive letter (by the operating system) through which you can address the volume. If you are no longer able to boot the operating system you need to boot the PC from a diskette or bootable CD.

FAT and FAT32 partitions/volumes, if present and intact, can be accessed using a DOS boot diskette. DOS can not access NTFS volumes without the help of a driver (for example NTFS4DOS, currently supported by Avira).

If one or more volumes or partitions can not be found, the problem is probably in the partition tables. Even if the damage extends beyond that, the next step is determining the partition locations (their start position, their size). DiskPatch can be used to get additional information about the partition tables, and DiskPatch can rebuild the partition tables.

If ALL volumes can be found but one or more volumes can not be accessed, the damage is probably specific to those volumes (the boot sector, the FAT, the MFT, etc.). DiskPatch is often able to indicate if the problems come from a damaged boot sector, and several types of boot sector damage can be repaired by DiskPatch.

If all volumes are found and can be accessed while only a few files or folders on a particular volume have disappeared or can not be accessed, there is probably only minor file system damage (FAT, MFT or directories are damaged to some degree). In this case running a DiskPatch surface scan can reveal if this damage is caused by unreadable sectors.

Step 3: Repair or Extraction

- Repair:

Before attempting in-place repairs you should verify that the repair utility has an undo feature! As stated earlier, the safest way to conduct repairs is to work on a clone. At the very least, the software used to perform the repairs should create backups of areas that are repaired or allow the user to backup areas of the disk he or she is modifying.

In our experience it is safe to make in-place repairs if the data loss is caused by a corrupt master boot record, corrupt partition tables or a corrupt boot sector. It is this type of repair that DiskPatch can be used for. DiskPatch fixes the partition tables and boot sectors, after the user has selected which partitions to repair. DiskPatch allows the user to create a clone, and can undo all modifications made during the automatic repair.

- Extraction:

If in-place repairs are impossible or undesired, software like iRecover can be used to extract data from the damaged disk, and copy it to an intact disk.

Software like iRecover scans a disk to determine volume locations and their file system specific parameters. Since files are addressed using cluster addresses relative to the start of a data area (like the O.S. does), it is vital that the correct start and end values for a partition or volume are known, and that the software is able to determine the cluster size even if the boot sector is damaged.

If damage extends to the file system's main bookkeeping structures (FAT, MFT), recovery of fragmented files may be impossible (the files may be recovered, but they're probably corrupt/incomplete).

Sometimes all vital file system information can be lost. In this case it may still be possible to recover certain files based on their headers (recovery software checks the file's contents to see what type of file it is and then copies the connected clusters to a file). With this type of recovery file sizes and filenames are often generic. After the files are recovered they must actually be opened one by one to determine their content.

After files have been recovered, and before re-formatting the problem disk (if possible or desired), the recovered data needs to be verified! It may appear files were recovered (the folder structure is present, files with recognizable names are present), but this is no guarantee the files are actually intact.

 
Terminology: an explanation of terms used in data recovery and disk usage
Terminology: Description:
Sector Data is stored on a disk by arranging it in bytes, simply put. It is however not possible to read an individual byte from the disk; you have to read 512 at a time. 1 sector contains 512 bytes, so a sector is the smallest addressable area on a disk.
Cluster An operating system doesn't access the disk per sector, it accesses the disk per cluster. A cluster is a number of sectors that are read or written as a group. So, a partition is divided into clusters, which in turn are made up of sectors, which in turn are made up of bytes.
Partition / Volume A region of a disk that is used for file storage. An empty disk by itself can not be used to store data: partitions (or volumes) must be created on the disk so the operating system knows where to put the files. A disk can be divided into many partitions. Usually 1 disk contains 1 partition which takes up all the disk's space, but since the introduction of Windows 2000 there is actually no real limit to how many partitions can be on a disk. In fact, it's often considered good practice to create 1 partition for the operating system and 1 or more partitions for data storage. Partitions need to be formatted before they can be used (as explained under "partition types: formatted as...").
Disk facts A hard disk (the physical device) is made up of platters. To be able to find a specific location on the disk it is divided into cylinders, each cylinder is divided into tracks (or heads) and each track is divided into sectors. In earlier days these numbers were vital. Nowadays we use LBA addressing and the cylinder/head/sector numbers are no longer used to identify a disk location, but they still play a part when partitions are created. It is important that the PC recognizes the disk correctly (size, head and sector values must correspond to what the manufacturer states).
LBA address LBA stands for Logical Block Addressing. This is simply a way to identify each sector on a disk: the first sector on a disk (the MBR) is numbered 0 and all following sectors are numbered sequentially. So a LBA address is nothing more than a sector number. Keep in mind that the count starts at 0; LBA sector 10 is the 11th sector on the disk.
Basic / Dynamic disks A description of disk types that is used in Windows (2000 and up): a Basic disk contains simple volumes (using the "old fashioned" partition table to describe partitions), a Dynamic disk allows for more types of volumes such as spanned/mirrored/raid/striped. Read more in the Microsoft knowledge base (link).
Disk geometry

Geometry consists of 2 values: heads (per cylinder) and sectors (per track). These values can differ from disk to disk, but are generally 255 (heads) and 63 (sectors). Although modern operating systems don't need to do this anymore, these values are still used when creating (basic) disk partitions. As such it is important that the PC has the correct values for the disk; if the values are wrong the operating system will not be able to find certain important structures on the disk and fail to boot, or even fail to access the partition completely.

S.M.A.R.T. Self Monitoring, Analysis and Reporting Technology.
This is a monitoring system for computer hard disks to detect and report on various indicators of reliability, in the hope of anticipating failures. All modern day hard disks have SMART technology on board.
SMART keeps an eye on various aspects of the hard disk (spin up counts, bad sector count, number of hours used etc.) and attempts to predict problems by analyzing the data that is gathered and comparing that against certain threshold values.
For instance, say the disk has developed a number of bad sectors. Usually that doesn't have to be a problem since these sectors are taken out of commission and are replaced by sectors from a spare pool. But this can not go on indefinitely; at some point either the spare sectors run out or the amount of bad sectors is growing so rapidly that the disk will cease to function within the near future. SMART would keep an eye on these emerging bad sectors and once the amount of bad sectors has crossed a threshold value, SMART takes note.
Understand that SMART itself will not notify the user; a SMART capable utility or operating system is needed to receive these warnings. For instance, the SMART tool that is included in the DiskPatch distribution can check the status of your disk by reading and interpreting the SMART status.
MBR The Master Boot Record, the first sector on the disk. Contains the partition tables (a list that describes the locations of partitions on the disk).
EPBR Like the MBR, this sector contains a partition table. But unlike the MBR, the EPBR can be anywhere on the disk. An EPBR describes a logical partition and can be found on disk just before the position where the logical partition starts.
Partition Tables These describe the various partitions on the disk: where they start, how big they are, what type they are. The MBR contains a partition table.
A partition table has space for 4 entries, meaning that 4 partitions of any type is the maximum that can be created. This can be circumvented by creating at least 1 extended partition, which in turn can contain many more logical partitions. A common setup is 1 or 2 primary partitions and 1 extended that contains the rest of the partitions. Primary partitions are the only ones that can be used to start an operating system from.
If Dynamic disks are used the partition table explanation as described here does not apply anymore.
Partition types:
primary / extended / logical
Primary partitions are the only types that allow you to boot an operating system. In general, you would install the operating system in a primary partition. A primary partition can be set "active", which allows the computer to locate the operating system that needs to be started. Only 1 primary partition can be active, but more primary partitions can exist. If more than 1 primary partition is set active, the computer will not boot. Also, when no primary partition is set active, the computer will not boot. Only the partition table in the MBR can contain primary partitions.
Extended partitions are nothing more than "containers" for logical partitions. In general, all space that is not used by primary partitions must first be added to an extended partition before logical partitions can be created. Only 1 extended partition can exist per disk. The partition table entry that describes the extended partition is in the MBR.
Logical partitions are the partitions that are created in the extended partition area. More than 1 logical partition can exist in the extended partition area.
Note that when using Dynamic disks these rules don't apply anymore.
More information can be found in this knowledgebase article (link).
Partition types:
formatted as FAT / NTFS / etc.
A partition needs to be formatted before it can be used. Different operating systems offer/require different format types:
DOS and older Windows versions (9x/ME) use a FAT type format. Newer Windows versions (NT/2000/2003/XP/Vista/7/8) can also use NTFS type formats (NTFS is preferred, it is more reliable than FAT). Other operating systems use different formats: Linux uses EXT2/EXT3, OS/2 uses HPFS, etc.
NTFS stands for New Technology File System.
Partition states:
active / hidden
A primary partition can have 2 flags enabled or disabled to signify a certain state. These flags are kept in the partition table in the MBR. The states are: active/not active/hidden/not hidden. A primary partition that holds a bootable operating system needs the "active" flag to be set. Only 1 partition can be set active (which makes sense; you can only boot 1 operating system at a time). The "hidden" flag is not as important as it was in the days of Windows 9x: earlier Windows versions couldn't deal with more than 1 primary partition, so if you had more than 1 the others had to be "hidden". Windows 2000/2003/XP/Vista/7/8 have no problems with 2 or more primary partitions.
These flags can be set with DiskPatch (from the MBR operations menu). 
Boot sector The very first sector of a partition. This sector contains a lot of information that the operating system needs to be able to use the partition. If this sector is damaged or deleted, the partition can not be accessed.
FAT The File Allocation Table. A table that is used to keep a record of which parts of the disk are in use. Only used when a partition is formatted as a FAT type partition.
LDM database A region of the disk that is claimed by Windows 2000/2003/xp/vista/7/8, containing a description of all volumes on all disks in the system. The LDM database is located at the end of the disk and is invisible when working with Windows. The LDM is synchronized to all disks on the system when either volumes are created, or volumes are added/changed (when using Windows disk manager). The LDM is only created and used when Dynamic disks are used.
Type 42h partition When the disks are Dynamic and the LDM is used to describe the volumes on the disk, Windows creates a partition type in the MBR that envelopes the entire disk. This way windows knows that the "old fashioned" partition table is not used anymore; the LDM is used to identify volumes.
Boot code Both the MBR and a boot sector can contain a small "program" that allows the operating system to find the stuff that is needed to boot. This "program" (boot code) is only required if one partition is an active primary partition, and if an operating system is booted from that partition. The boot code in the MBR differs from the boot code in a boot sector; the MBR's boot code is needed to find the partition that has to be booted (this boot code is used by the computer's BIOS), the boot sector's boot code is needed to find the necessary files on that partition (this boot code is used by the operating system). Since the boot code in the boot sector is used by the operating system, it is different for each operating system.
"Fdisk damage" When a FAT partition is deleted, people sometimes recreate the partition (using fdisk or a similar tool) in the hope that it will then show up again. This is not the case. This procedure actually damages the FAT area and requires additional repairs to make the partition accessible again. DiskPatch can detect and repair this damage.
Root cluster The cluster in the partition that contains the start of the root directory. Only applicable to FAT32 partitions. The location of the root cluster is needed to rebuild a damaged boot sector.
MFT The Master File Table. A structure on a NTFS formatted partition that contains information on where files and other important NTFS structures can be found. If this structure is damaged the partition will be inaccessible. In general, the MFT can not be repaired. If MFT damage exists, file-oriented recovery should be used (copy files from the damaged partition using a file recovery tool like iRecover).

DIY DataRecovery. All rights reserved | about