Uninitialised Disk

[haileris]

Hello

I've got quite a few disks so I am not sure whether a disk in one of my servers did have data on it or not - it is not showing as uninitialized in Windows 2008 R2 disk manager. Tried a few disk recovery programs - didn't seem to find anything (no files on deep scan and no missing partitions) but if I use a hex editor the disk isn't all 0000 etc. Any advice on any other checks to make please?

 

[HobartTas]

Greetings

You do realise that typically when you delete a file all that usually happens is that the directory entry is amended and the file contents remain unchanged but get allocated to the free pool and can be claimed by the subsequent creation of new files that overwrite the data, the same applies when the hard drive contents are "erased" or even simpler still the partition information is simply dropped giving the impression of being an empty drive while as before the contents are unchanged.

Either the partition information was accidentally erased or deliberately so, accidentally is highly unlikely as since Windows NT was introduced applications have been prevented by that OS from writing directly to the hard drive, prior to that I have had experience of Msdos programs running amuck and writing directly to the hard drive starting from Sector 0 and then I had to go in with a hex editor and manually insert the starting and ending sector numbers in the partition table, but those days are long gone and thankfully so.

If deleted deliberately then it could still have been accidental but usually this is due to confusing drives/partitions etc. If this did occur I would be expecting somewhat of a mad panic as people would immediately try to restore the information so its probably unlikely this is the case as well.

The conclusion I have is that the drive contents were deleted on purpose presumably to denote that the drive no longer has any valuable data on it, if however, that is not the case as far as you see it I will now answer your question as asked.

Firstly an "uninitialized" drive as Windows is concerned is one that has no MBR or GPT on it, so when it asks "do you want to initialize it?" it writes an MBR or GPT to it otherwise it tells you that if you answer "no" the drive remains unavailable for use, after you do this by answering "yes" you can then create partitions on it, later if you format it it puts in a valid but blank directory information.

In your case assuming there is data still there and you want to restore this information then in Windows XP I used to fire up the recovery console and issue the FIXMBR command, another thing you many have to do is issue the FIXBOOT command also, NTFS is a bit strange in that the drive must have a valid boot record otherwise it will not recognise and load NTFS partitions and this also applies even if the drive is non booting as well. After all this you may still have to edit the partition table and put in starting and ending sectors manually assuming the drive was one big partition, then it may load if there is any data on there.

The trouble you have is that most of the disk recovery programs automatically do the Fixboot and Fixmbr actions as a matter or course anyway and then scan the drive for metadata they recognise as being the start and end of partitions so if they can't find anything then its highly likely there is nothing there anymore.

Thats the best I can help you with

Cheers