The Title says it.
Can data Recovery be done without a partition table? And, if yes, why a partition table are being needed?
I asking this, because i am regular have to rescue some files. But my understanding is limited and i like to understood how this works and would like to get some clarification.
I make the following considerations:
My understanding is, Partition Tables are a part of the Filesystem itself. My Data (Files and Folders) that i wanna rescue on the Disk, on the filesystem is Data. I Mean zeros an ones. This Data would look the same on a different filesystem, right? So, then, why i care about the Partition Table? Instead, i just could use a File Recovery tool, and scan for my Data (Files and Folders) for example a file carving tool like foremost.
is this consideration correct?
I did some testing:
I have an accidentally overridden Disk (multiple times). The Image is from an Apple Disk, so Filesystem is HFS. The first thing i do is take a image of the data drive (with ddrescue). Then, i try to mount the image as a loop drive in Linux, but i always get an error: "Wrong fs type bad option bad superblock on...." Next tool i try is the sleuth kit. But, i get an error: "Can't find Magic Block...". Then, try data recover with Testdisk. Testdisk can't handle HFS (i can't Browse Files after Analyzing, when i press "P": "Filesystem are not implemented.."). I believe, the Partition Table are broken.
Now, my new considerations are:
Some types of Data Recover Tools are tied to the Partition Table. When its corrupt, the tools wont work. If this is the case, the only way tho rescue data, is to use a File Carving tool, or repair the Partition Table, so you can Mount the drive or use tools like the sleuth kit, PhotoRec etc.
Generaly:
For rescuing files, the way would always be the same, if you have some data loss. For example, a corrupt drive a failing drive, a broken drive, an accidentally deleted or overridden file / partition. First, if possible, get an image of the disk. Second, try recover data from the image. The first goal would be to mount the image, and use a data rescue tool. If this is not possible, as a last hope use a data carving tool.
Are this considerations correct?
Thanks
