The common situation of partition recovery - FAT Table Recovery

The FAT table recovery

CIH destroys data backwards from partitions. In this case, system data in the former part may be destroyed and lost. If FAT2 is still intact, we may make FAT2 to cover FAT1. Usually we use DiskEdit and WinHex. Regarding to other forms of destruction such as format and so on, we usually make use of tool software to scan the whole disk, seldom manual recovery; because there are even dozens of trillions sectors a partition has several trillions. Depending on the manual analysis is impossible. For some extremely important data file, we can also recover manually.

Recover FAT by DiskEdit
After recovering DBR of FAT, if part of FAT1 is damaged while FAT2 remains intact (It is the most situation when destroyed by CIH), we may use FAT2 to cover FAT1. The specific method is to find the start sector of FAT2 and then start searching the start sector of DATA (if it is FAT16, search FDT). By this way, we can figure out the length of FAT table. According to length and the start sector of FAT2, we may know the start sector of FAT1. Copy FAT2 to the damaged FAT1, we can finally recover the whole partition.

Recover FAT by WinHex
Principle of recovering FAT by WinHex is the same as that by DiskEdit. After recovering DBR, we can make FAT2 to cover FAT1. After finding FAT2, we begin searching the start sector of DATA (if it is FAT16, search FDT). The division is distinct, because the conclusion part of FAT must be 0 regions, otherwise there is not any free space (even so, in ordinary circumstances, there is still a bit of space in FAT after scanning DATA area. So the end of the last sector must be 0 too.). While at the beginning of DATA region or FDT region it mustn't be 0. No matter there is fixed FDT, the system always begins from second cluster. If there is FDT, it follows closely FAT2, and its file registration must exist; if there is not, then begins from data area where some data must exists. Thus we may figure out the length of the FAT table, and then the start sector of FAT1 according to the length and the start sector of FAT2. Copy FAT2 to the damaged FAT1 we can finally recover this partition.

Create an emergency disk to build a DOS operation system, then you can recover your partition:

Do MBR recovery under DOS system:

To recover DBR

The partition's first sector is also known as the boot sector. What the MBR is for entire drive, the boot sector is for an individual partition: like the MBR, the boot sector contains information that the system needs to locate the materials that are needed to start the operating system. A corrupt or missing boot sector is a serious problem. Without it the partition can not be accessed.
Possible (but not all) symptoms are:
Invalid media type reading drive
Abort, Retry, Fail?
File system is displayed as 'RAW'
Windows may ask if you want to format the drive
File names contain 'weird' characters
'Sector not found' messages

If boot sector of one FAT16/FAT32/NTFS partition was corrupt, it will be marked with X by Partition Table Doctor.
If you cannot access the FAT16/NTFS partition and the partition was marked with X Right click the partition and choose Fixboot. Partition Table Doctor will automatically check and repair the boot sector of the partition.

If you cannot access the Fat32 partition and the partition was marked with X Right click the partition and choose Fixboot. There are two choice:

'Auto' mode: Partition Table Doctor will automatically check and repair the boot sector of the partition. We recommend you choose this mode. If 'Auto' mode doesn't work, you could choose 'Interactive' mode. You must input the Label for the partition or file name (the file is in the Root Folder). If you do not know what file name to input, follow the file name that is suggested:
Bootable partition:
io.sys   msdos.sys    ntldr    bootlog.txt
Other partitions:

_restore  recycled
File name cannot support long name or wildcard character by DOS version of Partition Table Doctor.
Note:
For Fat16/Fat32 partition, fixboot is very good at repairing boot sector of partition.
For NTFS partition, even if boot sector is correct but MFT( Main File Table ) is corrupt, symptoms are the same. We recommend you download the trial version of Partition Table Doctor to check whether boot sector of partition was corrupt.
Most, scandisk will destroy more than they retrieve. Please stop scandisk from starting at logon: Opening msconfig and then clicking advanced there was the option to disable scandisk after a bad shutdown.

FAT table recovery
CIH can destroy data at the latter parts, it can cause part of data lose. If FAT2 is ok, we may use FAT2 to cover FAT1 to carry on the restoration. Usually we use DiskEdit and WinHex carry on the process.

use DiskEdit to restore FAT
After restores DBR, if FAT1 partially suffers injury, but the FAT2 maintain integrity (this is regarded the most common situation of the CIH destruction), we may use FAT2 to cover FAT1 and to carry on the restoration. The method is to find the range area of FAT2 and to start to search DATA (FAT16 then searches FDT), and then calculate the length of the FAT table according to this length and FAT2, FAT1 t. Cover the damage FAT1 with the FAT2,then we can restore the entire district.

use WinHex to restore FAT
The method is the same with using DiskEdit. Searching DATA is easy because the dividing line is extremely obvious. The region where FAT finished shows certainly 0, otherwise this district do not have any surplus space, but where DATA region or FDT region start can not be 0. no matter it has fixed FDT or not, the system can start from the second bunch to use. If it has FDT, then after FAT2, its document registration certain exist; If it does not have fixed FDT, then it is the data area, also certainly has the data. From this method the length of the FAT table and FAT1 may be calculated. Cover the FAT2 copy to the damage FAT1 may restore this district.