0

The entire hard disk is 1.5TB

The partition I hope to recover is 900GB

There were two partitions

[ 600 GB - OS partition ] [ 900 GB - the data partition I want to recover ]

Which cylinder should I begin searching at?

And which program do you recommend?

TestDisk EaseUS

I can use Windows 7 / GParted / Knoppix

Giacomo1968
  • 58,727
Reggie Mantle
  • 1

2 Answers2

0

Cylyinder 1 seems the safest (and longest) place to start looking, then then have whatever program you use scan the whole disk.

Note that it is likely that you created two partions sequencially, and that the second partion might be 2/3rd of the way into the disk, but:

1) The actual layout might very well have been [partition2] [partion1]
2) Cylinders are not even used anymore. CHS went out of fashion ages and ages ago. These days SCSI (And SATA which is SCSI like) just use sectors. And there is no guarantee where a sector will be mapped. On rotating rust that probably still is linear, but there is no guarantee for that.

As to which program is recommended:
Product recommendations are off-topic here.

Hennes
  • 65,804
  • 7
  • 115
  • 169
0

Assuming the disc was partitioned with a halfway modern Operating system, the first partition should start at 1 MB (sector 2048). In a hex editor, you should be able to see immediately if this is the case, as for example in NTFS you'll see the string NTFS amongst the first few bytes. In an NTFS, on byte 0x28 of that sector you'll find the size of the file system in sectors (little endian, 8 bytes). Add these to the 2048 sectors and you'll know where the end of the partition is. Usually, at the end point you'll find an exact copy of the sector 0 of the partition (not the disk).

After this address, you can now search for the 2nd partition, if that also was an NTFS partition, simply searching in a Hex Editor for "NTFS" as string will suffice, you'll then find (usually within the next MB) the start of the 2nd partition.

If the filesystem is ext2/3/4, you'll see nothing at the start of the partition, as the ext2/3/4 data only starts 1024 bytes (= 2 sectors) inwards.

Also, if the disk was partitioned with Windows XP (or older Linux fdisk), the first partition might not start at 1MB, but rather on sector 63.

Ro-ee
  • 2,250