Call us — 0161 871 0788
Mon–Fri · 9am–5:30pm · No fix, no fee
Start a free diagnostic →
← All case files // case file · PC

A PC that lost its partition, but not its files.

Nothing wrong with the hardware at all. A corrupted partition table had made a full disk look like empty space, and Windows was offering to format it — which is the one thing that would have caused real damage.

DeviceWindows PC · healthy HDD
FaultCorrupt partition table
Turnaround3 days
OutcomeFull recovery
ToolsPC3000

What arrived

A PC that had come up one morning announcing the drive needed formatting. A disk that had been full the night before now showed as unallocated space in Disk Management. It looks like catastrophe and it usually is not: a drive that abruptly reads as blank is far more often carrying a logical fault than a physical one, and this was a clean example.

The customer stopped using the machine the moment the message appeared, which is most of the reason this was a three-day job.

What a partition table actually is

It is a very small amount of data doing a very large job, and its size is the reason it fails this way.

On an MBR disk the entire table lives in the first 512-byte sector. Of that, 446 bytes hold bootstrap code, then four 16-byte entries describe the partitions — each recording a type byte, a starting address and a length — followed by the two-byte signature 0x55AA that tells the system the sector is valid. Sixty-four bytes describe the layout of a multi-terabyte disk. Damage them and every file remains exactly where it was, while the operating system loses the map to all of it.

Worth knowing that GPT was designed partly to fix this. A GPT disk carries its header at the second sector and a full backup copy at the very end of the disk, with CRC32 checksums over both the header and the partition entry array. When the primary is damaged, the system can detect it and restore from the backup automatically. MBR has no equivalent — one bad sector at the front and there is nothing to fall back to.

This disk was MBR, which is why the fault presented so completely.

Diagnosis

The drive was read on the bench and was mechanically unremarkable: no reallocated sectors, no pending sectors, normal seek and spin-up behaviour. That eliminated the physical explanations and confirmed the fault was structural.

The first sector was examined directly. The signature was intact but the partition entries were inconsistent — type bytes that did not correspond to anything, and starting addresses pointing outside the disk. That pattern is characteristic of a partial write during an interrupted operation rather than of media failure, which the surface scan supported.

Finding the volume without the map

The useful part, because it is the step people assume is guesswork and is not.

A partition table only tells you where a volume begins. The volume itself announces what it is, in its own first sector, entirely independently. An NTFS volume opens with a boot sector carrying the OEM identifier NTFS at a fixed offset, followed by a parameter block recording bytes per sector, sectors per cluster, the total sector count and the cluster address of the master file table. NTFS also writes a duplicate of that boot sector at the very last sector of the volume.

So the disk was searched sector by sector for that signature. Finding it establishes where the volume starts. Reading the parameter block establishes how long it is and where its file table lives. And finding the duplicate boot sector at exactly the offset the parameter block predicts confirms the answer arithmetically rather than by assumption — two independent structures agreeing on the same geometry.

From those numbers a correct partition entry can be reconstructed and written, because they are the same numbers the entry is supposed to contain.

How the work ran

The original disk was never modified. It was imaged in full, read-only, and every operation afterwards happened on the copy — the volume search, the table reconstruction and the file-system repair.

That ordering is not ceremony. Repairing a partition table means writing to the first sector, and if the reconstructed geometry is wrong the write destroys the evidence needed to work out the right one. Done on an image, a wrong attempt costs nothing but the time to discard it and try again.

With the table rebuilt on the image, the volume mounted exactly as it had before. The master file table and its mirror were checked against each other, and the file-system journal examined for any transaction interrupted at the moment of the original fault.

Outcome

Complete, in three working days. Nothing had genuinely been overwritten, because the machine was switched off rather than used.

That last point is the whole lesson. A drive that suddenly demands formatting or reads as empty has very often kept every file intact — so do not format it, do not run a repair tool that offers to fix the disk, and stop using the machine. On a fault like this it is the continued writing, rather than the fault itself, that loses data.

// getting it to us

Two ways to start.

Send the device over with a short account of what happened to it. The diagnostic costs nothing and commits you to nothing, and the figure that follows is fixed in writing before anything is opened.

1

Post it, or drop it in

Nothing can begin until the device is on the bench, which makes this the only step that needs anything from you. Pack it properly, put your details in with it, and send it over. What follows is a free diagnostic and a written figure, in that order.

Packing it properly
  • A small rigid box or a padded envelope — and an anti-static bag if one is to hand, though a food bag will do at a push.
  • Leave the caddy, cables and power supply at home. None of it is needed to read the drive, and it only adds weight.
  • Put your name, address, phone number and email inside the box — on paper, or on the shipping form below.
Post toManchester Data Recovery
Peter House, Oxford Street
Manchester M1 5AN
Shipping formPDF · print & include with your devicePDF ↓

Posting it? Use something tracked and insured — whatever is on the drive is worth considerably more than the postage. Bringing it in? Weekdays, 9am to 5:30pm, and it still wants packing as above for the journey.

2

Not ready to send it?

Tell us what the device is, what it is doing, and anything already tried — an engineer will come back with a realistic view of the odds and a price band, before you commit to posting anything.

Every enquiry is read by an engineer rather than a form-handler, and most get an answer inside the hour on a working day. Would rather speak to someone? 0161 871 0788.

Got it — that’s with an engineer.

We’ll be in touch shortly. For anything urgent, call 0161 871 0788.

Common questions

Can data be recovered from a desktop PC that will not start?

Usually yes. The drive is removed and imaged read-only on separate equipment, so a failed power supply, motherboard or Windows installation makes no difference to whether the data comes back.

My partition has disappeared — are the files gone?

Generally not. A missing partition normally means the partition table or boot sector is damaged while the file system beneath is intact, and the volume can be rebuilt from what survives. Don't let Windows initialise or format the disk.

What does PC data recovery cost?

A single desktop drive is from £300 plus VAT after a free 48-hour diagnostic and a written quote. Most jobs are no fix, no fee.

Related

// ready when you are

Facing something similar? Let's help.

Start with an instant online quote, or call and talk it through with us first. You'll have a clear, fixed price before any work begins.

Peter House, Oxford Street, Manchester M1 5AN · Mon–Fri 9am–5:30pm · No fix, no fee on most jobs