Deleted partition or diskpart clean: data recovery

The short answer: Deleting a partition or completing diskpart clean does not usually erase the files themselves—it only overwrites the partition table, leaving Windows unable to determine where the volume begins. Shut down the computer immediately, do not write anything to the drive, do not create a new partition and do not continue installing Windows. The exception is clean all, which Microsoft says writes zeros to every sector; no one can recover data from the portion that has been overwritten.

Unallocated space does not mean an empty drive

A typical accident occurs when you delete partitions on the wrong drive during Windows setup, select the wrong disk number in diskpart and run clean, or confirm initialisation in Disk Management. The drive then appears as „Unallocated space".

This only means that the current partition table does not describe any volume. The file system (NTFS, exFAT, ext4) and the files on the drive are usually still there. The outcome depends on the exact command, the type of drive and what happened to it afterwards.

What each operation actually overwrites

Microsoft’s documentation for the diskpart clean command states that on MBR disks, only the disk partitioning information and hidden sectors are overwritten, while on GPT disks the partitioning information, including the protective MBR, is overwritten. The all parameter, by contrast, sets every sector to zero.

Initialisation is therefore not a harmless „confirmation", but it is still a much smaller intervention than creating a new partition and formatting it. The article Accidentally formatted drive or card: what are the chances? covers post-format situations in greater detail.

What to do immediately after the accident

• Stop the Windows installation and shut down the computer.
• Do not create a new partition in the unallocated space.
• Do not confirm drive initialisation as GPT or MBR.
• Do not run a quick or full format.
• Do not run CHKDSK, „Repair drive" or automatic repair.
• Do not install recovery software on the affected drive or save recovered data back to it.
• Disconnect an external SSD or NVMe drive from its power source as well.

Write down exactly what happened: whether you deleted a partition in the installer, ran clean or clean all, initialised or formatted the drive, when it happened, whether the command completed, and whether the device is an HDD, SATA SSD, NVMe drive or a drive in a USB enclosure. These details affect the recovery procedure more than anything else.

HDDs and SSDs behave differently after deletion

On a healthy HDD, deleting a partition changes only the metadata, not the contents of the files. Until something new is written to the same locations, the original NTFS or exFAT file system can be found and its files extracted. A powered-off HDD does not deteriorate on its own.

SSDs and NVMe drives are less predictable. Windows enables TRIM for NTFS by default: the system tells the controller which blocks it no longer needs, and the controller may erase them during internal housekeeping. Reads then return zeros. Deleting a partition alone does not necessarily mean that TRIM has affected its entire range, but a quick format, a new file system or further use of the connected SSD significantly increases the risk. The result also depends on the controller, firmware and whether the USB adapter passes TRIM commands at all. The article SSD data recovery: why it is harder than HDD recovery explains the details.

When TestDisk may help

The free TestDisk utility can find lost partitions from surviving file-system structures (Analyse, Quick Search and, if necessary, Deeper Search). For supported systems, pressing P shows whether a discovered partition contains the expected folders.

The final step is the trap. The Write option writes the discovered structure to the drive’s partition table (TestDisk documentation). If the boundaries are identified incorrectly, overlapping partitions may be created, or a damaged volume may be mounted and Windows may begin writing to it.

TestDisk is most useful with a physically healthy HDD when:

• you know exactly what was deleted;
• the drive makes no unusual noises and reads without errors;
• you are working with a sector-by-sector image, not the only original;
• the discovered partitions do not overlap and show the correct files;
• you save the recovered data to another storage device.

For accounting records, databases, the only copy of important documents, SSDs, BitLocker volumes or drives with several historical partitions, writing directly to the original is an unnecessary risk. For an overview of other tools and their limitations, see Data recovery software: when it helps and when it destroys data.

What happens in the laboratory

The first goal is not to „repair" the drive, but to preserve its current state. The device is connected in read-only mode and a sector-by-sector image is created on separate storage. If an HDD has read errors, the easily readable areas are copied first and the problematic locations are addressed afterwards. The article ddrescue: a sector-by-sector image of a failing drive and its mapfile explains why imaging should not restart from the beginning with every attempt.

The image is then examined for the original partition boundaries, the primary and backup GPT, the NTFS boot sector, the MFT and its mirror, backup exFAT or ext4 structures, encrypted-volume headers, and traces of a new partition or format that may already have overwritten some data. The partition is reconstructed on a working copy, or the files are extracted to a third storage device. Verification does not end with the number of file names found: the files must open correctly and the folder structure must make sense.

BitLocker: finding the partition is not enough

Restoring the partition boundaries does not remove encryption. Accessing the files requires an unlock credential, usually the 48-digit recovery key. It may be stored in a Microsoft account, in corporate device management, on a USB drive or as a printed copy. Microsoft cannot recreate a lost key (where to find your BitLocker recovery key). Without the key, the encrypted sectors can be preserved, but their contents cannot be recovered.

When to stop trying

SSDs and NVMe drives, business data without a backup, encrypted drives, drives with read errors, and situations where you do not know whether clean, clean all or a format was performed belong in a laboratory. The same applies if Windows setup has already created new partitions and started copying the operating system.

If clean all completed across the entire drive, no one can restore the overwritten sectors, and we will tell you that immediately. If you are unsure which command was used or the process was interrupted, however, it is worth checking the drive’s condition before making further attempts.

An initial standard assessment of a conventional HDD or SSD may be free. Deleted partitions, formatting or overwritten data are cases in which diagnostics may cost CZK 1,210 including VAT (CZK 1,000 excluding VAT)—you will be told in advance. The data recovery price list provides an indicative price for recovering from logical damage; the exact amount depends on the storage medium and the extent of the damage.

What to include in your enquiry

In the data recovery contact form, state the drive type and capacity (HDD, SATA SSD or NVMe), the exact command or step performed, whether it completed, whether the drive was encrypted with BitLocker, and which folders or file types are most important. Do not power the drive on again before it has been assessed.

FAQ

Can a partition deleted during Windows setup be recovered?

Often yes on an HDD, provided that the installation did not continue after deletion. If the installer has already created new partitions and copied the operating system, some of the original data has been overwritten and the recovery will only be partial.

How can I tell whether clean or clean all was run?

By the command entered and the duration of the operation. clean finishes almost immediately, whereas clean all must process the drive’s entire capacity, which takes hours on large HDDs. The „Unallocated space" message does not reveal the difference.

Does unallocated space mean that the drive is empty?

No. It only means that the partition table does not describe any volume. The original file system and files may still be present on the drive.

Should I let TestDisk write the partition it found?

First verify that the discovered partition shows the correct folders, and ideally work with a sector-by-sector image. The Write option changes the partition table; if the boundaries were identified incorrectly, it will make the situation worse.

Can data from a BitLocker partition be recovered without the key?

The encrypted sectors can be preserved, but their contents cannot be recovered without a valid recovery key. Check the Microsoft account, corporate device management, and any printed or saved records first.

Where to find us

ITHOPE is a company based in Brno, Czechia: we do data recovery from disks, RAID and NAS, PC and laptop service and IT for business, all in our own lab at Viniční 3587/216, 615 00 Brno.

Phone +420 775 556 063 (24/7 line). You can bring the device in person, or send it by courier (Zásilkovna, PPL).