Partition (Disk Partition)
A “lost partition” is rarely lost data. When a partition vanishes, only its entry in the partition table at the start of the disk is gone; the file system inside is usually intact. TestDisk and similar tools scan the disk for file system signatures (NTFS boot blocks, ext4 superblocks, APFS containers) and reconstruct the partition table from what they find. Understanding the layer between physical disk and file system is what separates “the disk died” from “this is a 10-minute fix.”
TechTarget · Red Hat · CGSecurity
Below file systems
2026 disk layout state
A partition is a logical division of a physical disk drive into one or more independent sections. Each partition appears to the operating system as a separate logical drive, can hold its own file system (NTFS, exFAT, APFS, ext4, and others), and is described by a partition table at the start of the disk (MBR or GPT format). Partitions allow a single physical disk to host multiple operating systems, separate system files from user data, isolate backups, or simply organize storage into logical units.
How Partitions Work
The concept dates to 1966 with IBM’s CP-67 operating system, which used “minidisks” as separate logical sections of a physical drive. The term “partition” entered consumer use with PC DOS 2.0 in 1983, when IBM specifically applied it to dividing a hard disk into segments. By 2026, partitioning is universal: every storage device used by Windows, macOS, or Linux has at least one partition, and most have several.1
The defining property is simple but consequential. A physical disk is a flat sequence of sectors (typically 4 KB each on modern drives, 512 bytes on legacy drives). The disk doesn’t know what’s on it; it just provides numbered storage locations. A partition table at the start of the disk records the boundaries of each logical section: where it starts, where it ends, what type of file system is inside (or expected to be), and which one is the bootable one. The OS reads the partition table during boot and treats each entry as a separate logical drive.
The partition table is the gatekeeper
This is the central concept worth internalizing for recovery purposes. The partition table is a small piece of metadata, no more than a few hundred bytes on MBR or 16 KB on GPT, that determines whether the OS can find the data on the disk. If the partition table is intact, the OS sees the partitions and mounts them. If the partition table is corrupted, the OS sees an “uninitialized” or “RAW” disk even though every byte of the partition contents is still on disk untouched.2
This is why partition recovery is often successful even when the symptoms look catastrophic: the data inside the partition has not been touched, only the directory at the start of the disk that says “the data starts here, ends there.” Recovery tools rebuild this directory by scanning the disk for known patterns.
Each partition gets its own file system
A partition by itself is just an unused range of sectors. To actually store files, the partition needs to be formatted with a file system: NTFS for Windows, APFS for modern Mac, HFS+ for older Mac and HDD-based externals, ext4 for Linux, exFAT for cross-platform, FAT32 for legacy compatibility. Different partitions on the same disk can use different file systems; the partition table records which file system type each partition holds.
Drive letters, mount points, and volume labels
Each partition appears to the OS as a logical drive. Windows assigns a drive letter (C:, D:, E:, and so on) to each partition the user has access to; not every partition gets a letter (the EFI System Partition and Recovery Partition, for example, are usually hidden from the user). Linux and macOS use mount points (typically /, /home, /boot, /Volumes/MyDrive) instead of letters, mounting partitions into the file system tree at well-known locations.
Partition alignment for SSDs
This is a subtle but important detail for performance on flash storage. SSDs work most efficiently when partitions start at boundaries that are multiples of the SSD’s internal page size (typically 4 KB or larger). Misaligned partitions force the SSD to do read-modify-write operations on every write, dramatically reducing performance and increasing wear. Every partitioning tool from 2010 onward (Windows Disk Management, macOS Disk Utility, Linux fdisk/parted) aligns partitions correctly by default. The issue mostly appears when restoring partitions from older images or when migrating from XP-era systems where alignment was less consistent.
Volume vs partition vs disk
The terminology overlaps and the OS sometimes uses “volume” interchangeably with “partition,” which causes confusion:
- Disk: the physical hardware (an SSD, an HDD, a USB stick).
- Partition: a logical division of the disk, defined by entries in the partition table.
- Volume: a formatted area accessible by the OS. A partition becomes a volume after it’s formatted with a file system. APFS and Btrfs volumes can also be subdivisions of a single partition (an APFS container holds multiple volumes; see the APFS entry).
- Logical Volume (LVM): Linux’s abstraction layer that lets you create logical volumes across multiple partitions or disks, then resize them dynamically. Most modern Linux installs use LVM on top of a single partition rather than creating many partitions.
Partition Types and Functional Roles
Partitions have two different “types” of classification: structural types (primary, extended, logical) defined by the partition table format, and functional roles (boot, system, recovery, data) defined by the operating system’s expected use. Both matter for recovery.3
Primary, extended, and logical partitions (MBR concept)
These categories exist only on MBR disks; GPT disks have a flat list with no hierarchy.
- Primary partition. Listed directly in the MBR’s 4-entry partition table. An MBR disk supports up to 4 primary partitions. Only primary partitions can be marked as “active” (bootable).
- Extended partition. A special primary partition that acts as a container for logical partitions. Only one extended partition per disk. Doesn’t hold data directly; just provides the structure for logical partitions inside.
- Logical partition. Lives inside an extended partition. There can be multiple logical partitions, limited only by drive letters in Windows (effectively 26 minus the letters used by primary partitions and other drives). Logical partitions cannot be bootable on most BIOS firmware.
The four-primary limit is the original reason GPT was invented; it’s an arbitrary limit dating to a 16-byte partition entry size and a 64-byte partition table header. GPT removes the distinction entirely.
EFI System Partition (ESP)
On UEFI systems, the EFI System Partition is a small (typically 100-500 MB) FAT32-formatted partition that holds the bootloader. The UEFI firmware reads the ESP at boot to find which OS to start. Modern Windows installations always create one; macOS installations create one; Linux installations create one (or share an existing one for dual-boot). The ESP is formatted with FAT32 because UEFI firmware understands FAT32 universally.
Microsoft Reserved Partition (MSR)
Windows creates a small (16 MB or 128 MB) Microsoft Reserved Partition on GPT disks. It’s reserved for future Windows uses; right now it’s mostly empty. Don’t delete it; Windows expects it to be there, and removing it can break disk management operations.
Boot partition vs system partition
This is where Microsoft’s terminology gets confusing. In Microsoft’s vocabulary:
- System partition: the partition that holds the bootloader. On UEFI systems, this is the EFI System Partition. On legacy BIOS systems, this is the partition with the active flag set.
- Boot partition: the partition that holds Windows itself (the
C:\Windowsdirectory). Despite the name, this is usually NOT what the firmware reads first.
Most other operating systems use the opposite convention: boot partition is what the firmware reads first, system partition is what holds the OS. The Microsoft naming is historical and confusing but unchanged.
Recovery partition
A read-only or hidden partition that holds the OS installer or factory restore image. Used to reset the system to a known-good state without external media. Windows OEM systems usually have one or more recovery partitions (10-20 GB). macOS keeps a Recovery volume inside the APFS container. Modern Linux distributions don’t typically use recovery partitions, relying on package management and the system snapshot tools.
Swap partition (Linux)
A partition formatted as swap space rather than a file system. Used by Linux for virtual memory when RAM is exhausted. Modern Linux distros increasingly use a swap file inside the root file system instead of a dedicated swap partition, which is more flexible and easier to manage. Swap partitions don’t hold user data and are not part of normal file recovery.
MBR vs GPT Partition Tables
The partition table format is almost as important as the partition itself. MBR (Master Boot Record) is the legacy standard from 1983; GPT (GUID Partition Table) is the modern replacement that’s part of the UEFI specification. Modern Windows, macOS, and Linux all default to GPT on new installations.4
| Property | MBR (Master Boot Record) | GPT (GUID Partition Table) |
|---|---|---|
| Year introduced | 1983 (PC DOS 2.0) | 2002 (UEFI 1.0) |
| Location | Sector 0 only | Sectors 1–33 + backup at end of disk |
| Maximum partitions | 4 primary (or 3 + extended) | 128 (Windows), more by spec |
| Maximum partition size | 2 TB | 9.4 ZB (effectively unlimited) |
| Maximum disk size | 2 TB | 9.4 ZB |
| Boot firmware | BIOS | UEFI (BIOS via Compatibility Support Module) |
| Partition entry checksums | No | CRC32 |
| Backup partition table | No | Yes (at end of disk) |
| Partition GUIDs | No | 128-bit unique IDs per partition |
| Partition labels | No (file system label only) | Yes (36 UTF-16 chars) |
| Used on | Legacy systems, USB drives < 2 TB | Modern Windows / macOS / Linux |
GPT’s redundancy advantage
The single biggest recovery-relevant difference is that GPT keeps a backup copy of the partition table at the end of the disk. The primary GPT lives in sectors 1-33; the backup GPT lives in the last 33 sectors of the disk. If the primary GPT is corrupted (overwritten by a misconfigured tool, damaged by a bad sector, or wiped by a Linux installer that didn’t recognize the existing layout), the backup is usually intact and can be copied to the primary location to restore the disk.5
MBR has no equivalent backup. The single sector at the start of the disk is all there is, and a corrupted MBR means the partition table is gone unless a recovery tool can reconstruct it by scanning the disk for file system signatures. This is why GPT is dramatically more recoverable in practice; cgdisk, gdisk, parted, and TestDisk all support primary-from-backup repair as a one-step operation.
Protective MBR (the GPT compatibility hack)
This trips up users sometimes. GPT disks have a fake MBR in sector 0 that lists a single partition covering the entire disk, with type 0xEE (“EFI GPT”). Tools that don’t understand GPT see this and assume the disk is fully used; they don’t try to write to it and corrupt the GPT. Modern tools recognize the protective MBR and read the real GPT in sectors 1-33. If a recovery tool reports your GPT disk shows only one large MBR partition, it’s not GPT-aware; use a different tool.
When to use which
Use GPT for: any new system installation; any disk larger than 2 TB; any system with UEFI firmware (which is essentially all systems built since 2012). GPT is the right answer for almost every modern use case.
Use MBR for: old systems with BIOS-only firmware that don’t support GPT booting; USB sticks intended to boot legacy systems; specialized embedded systems. Outside these cases, MBR is a legacy choice without practical advantages in 2026.
Common Partition Corruption Modes
Partition table problems typically fall into two categories: software-caused (operator error, bad installers, malware) and hardware-caused (bad sectors hitting the partition table area, controller failures). Both produce similar symptoms but require different recovery approaches.6
- Accidental partition deletion in Disk Management. The user clicks “Delete Volume” on the wrong partition. The entry is removed from the partition table; the partition’s data is intact until something writes over it. TestDisk’s quick search usually finds it within minutes by scanning for file system signatures.
- Failed dual-boot installation. A Linux installer (or recovery USB) overwrites the existing partition table with a new layout, often because the user clicked through the partitioner without paying attention. The original Windows or macOS partitions are still on the disk; their boot blocks and metadata are intact, but they’re no longer in the partition table. TestDisk’s deeper search recovers them, sometimes after hours of scanning.
- Partition table corruption from malware. Some ransomware variants and “wiper” malware specifically target the partition table to make recovery harder. The data inside the partitions is usually unaffected (because writing over a multi-terabyte file system would take hours and be detectable); only the partition table is wiped. TestDisk handles this scenario routinely.
- Bad sectors at the start or end of the disk. The first sectors of the disk hold the MBR or primary GPT; the last sectors hold the backup GPT. Hardware failures specifically in these regions can destroy the partition table while leaving the data intact. On GPT disks, recovery from the backup is automatic; on MBR disks, full reconstruction is required.
- RAW partition state. The OS sees the disk and partition exist, but reports the partition as unformatted or RAW. The partition table is intact but the file system inside is corrupted. This is a file system recovery problem (see NTFS, exFAT, etc.), not a partition recovery problem.
- Mismatched primary and backup GPT. The primary and backup partition tables disagree, often after a partial write or a tool that only updated one. UEFI firmware refuses to boot in this state.
gdiskon Linux anddiskutilon macOS can detect and fix the inconsistency; on Windows, third-party tools like MiniTool Partition Wizard handle it. - Encrypted partition with lost or wrong header. BitLocker, LUKS, and FileVault all keep encryption metadata in specific partition locations. A damaged header makes the partition unmountable even if the actual encrypted data is intact. Recovery requires either the recovery key or specialized tools to reconstruct the header.
- Disk cloning to wrong-sized destination. Cloning a 1 TB disk to a 500 GB target with the wrong tool can result in a corrupt partition table because the GPT backup at the end of the source disk is now beyond the end of the destination disk. Recovery requires reconstructing the partition table on the destination from the source’s primary GPT.
- Hibernation file partition issues. Some systems use a dedicated hibernation partition. Failures in the hibernation partition can block boot until the hibernation flag is cleared, even when the data partitions are perfectly fine.
The single most important mental model for partition recovery: when the OS says “this disk needs to be initialized” or “the disk is unformatted,” the data is almost certainly intact. The disk-level metadata (partition table) is what’s broken, not the file system inside. Resist the urge to click “Initialize” or “Format” in Disk Management. That click is what actually destroys data, by writing a fresh partition table that overwrites the start of the data. Image the disk first with ddrescue or HDD Raw Copy Tool, then run partition recovery against the image. If recovery succeeds on the image, you’ve validated the approach without risking the original.
Warning signs your partition table is failing
The OS gives clear signals when partition table problems are happening, but they’re often confused with file system issues. Watch for these in combination:
- “You need to format the disk” prompts on a disk that worked yesterday. Almost always partition table or boot sector damage. Click Cancel. Don’t format.
- Disk Management shows “Disk N is uninitialized” on a disk that has data. Partition table is gone or unrecognized. Don’t initialize.
- Disk shows up as RAW in Windows Explorer. Partition exists but the file system inside is corrupted, or partition table is listing wrong file system type.
- Partitions appearing with no drive letter. Partition exists but Windows can’t or won’t mount it. Often a partition table type mismatch or missing file system.
- System won’t boot, drops to UEFI/BIOS setup. EFI System Partition or boot loader is damaged. Use the OS recovery media to repair.
- “Operating system not found” errors. The bootloader can’t find the OS partition. Often a partition table problem after disk migration or failed update.
- Different partition layouts visible from different tools. Indicates partition table inconsistency. Compare what Windows Disk Management, Linux
fdisk, and TestDisk all see. - SMART warnings on the underlying disk. Hardware failure threatens partition table integrity. Address the disk before the file system becomes unrepairable.
When to Use Multiple Partitions
The default is a single partition per disk. Multiple partitions make sense for specific use cases; otherwise, they add complexity without much benefit. The classic reasons to partition (saving space on FAT16, optimizing HDD seek time) mostly don’t apply in 2026.7
Reasons to use multiple partitions
- Dual-boot multiple operating systems. Windows + Linux, macOS + Windows via Boot Camp on Intel Macs (Boot Camp doesn’t exist on Apple Silicon Macs). Each OS lives on its own partition with its own file system.
- Separate system from data. Linux conventional layout:
/(root) and/homeon different partitions, so that reinstalling the OS doesn’t touch user data. Less common on Windows but some users put games or media on a separate D: partition for the same reason. - Isolate a backup target. A separate partition formatted differently (e.g., a Time Machine APFS partition on an external drive that also has an exFAT partition for cross-platform files).
- Recovery partition. OEM systems usually have a dedicated recovery partition with the factory image. Useful for resetting the system without external media.
- Encryption boundaries. A partition that’s encrypted (BitLocker / LUKS / FileVault) and another that isn’t, when only some data needs encryption.
- Server workloads with isolation needs. Database servers might put logs on one partition and data files on another, with different mount options and quotas.
Reasons NOT to use multiple partitions
- “Performance optimization” on SSDs. Doesn’t help; SSDs have uniform access times.
- Organizing files. Use folders, not partitions. Partitions are inflexible (fixed sizes); folders aren’t.
- “Saving space.” Modern file systems don’t have the FAT16-era allocation block waste that made small partitions useful.
- External USB drives for general use. Single partition is almost always the right answer for portability and simplicity.
- Replacing LVM on Linux. If you need flexibility, LVM is a better choice than multiple physical partitions.
Partitioning advantages and drawbacks
Strengths
- Enable multiple operating systems on one disk
- Isolate system files from user data for clean reinstalls
- Allow different file systems on the same disk
- Provide recovery partitions for factory reset capability
- Define encryption and access control boundaries
Trade-offs
- Fixed sizes can run out while other partitions have plenty of space
- Resizing partitions is risky and sometimes destructive
- More partitions mean more places where partition table corruption can hurt
- Disk Management complexity grows with each partition
- Backup and imaging strategies need to consider all partitions
The single most important fact about partition recovery: when the OS reports a disk as RAW, uninitialized, or unrecognized, the data inside is almost always still there. The partition table is a tiny piece of metadata at the start (and end, on GPT) of the disk. When it’s corrupted, the OS loses the directory that says “the partition starts here, ends there, holds NTFS.” But the partition itself, with its file system and all your data, is still on disk untouched. Recovery is the process of rebuilding that directory from what’s on disk, not reading data that’s been lost.8
TestDisk is the canonical free tool for this work, and it has been since the early 2000s. Its core trick is simple: it scans the disk sector-by-sector looking for file system signatures (the NTFS boot block at offset 0, the FAT32 boot record, the ext4 superblock at offset 1024, the APFS container superblock with its NXSB magic). When it finds a signature, it walks the file system enough to confirm it’s real and figures out the partition’s start and end. After scanning, TestDisk presents a list of found partitions and offers to write them back to the partition table. Quick Search handles the easy cases (recently deleted partitions, MBR overwrite). Deeper Search handles the harder cases (longer scan, finds older deleted partitions, often takes hours on large disks). On GPT disks, TestDisk can also restore the primary partition table from the backup at the end of the disk in a single step.9
The single rule that determines partition recovery success: do not let the OS or any tool write to the disk before recovery is complete. That means: if Windows asks “do you want to format/initialize this disk,” click Cancel every time. If macOS asks to repair the disk via Disk Utility, decline. If Linux’s GNOME Disks offers to fix the partition table, say no. Each of these “helpful” actions writes new metadata to the start of the disk, overwriting the data that recovery tools depend on. The right procedure: image the disk with ddrescue, HDD Raw Copy Tool, or other disk imaging tool to a separate disk that has at least the source’s capacity. Run TestDisk against the image, not the original. If TestDisk succeeds on the image, you’ve validated the approach without risking anything; you can then write the recovered partition table back to the original. Commercial alternatives like EaseUS Partition Recovery, MiniTool Partition Wizard, and DiskInternals Partition Recovery all do the same essential job with friendlier interfaces. For physically failing disks where reads themselves are the problem, lab-grade tools like R-Studio combined with hardware imagers like the DeepSpar Disk Imager handle the difficult cases. The mantra holds for partition recovery as for every layer of the storage stack: image first, recover second.
Partition FAQ
A hard drive (or SSD) is a physical storage device. A partition is a logical division of that physical device. One disk can hold one or more partitions, and the operating system treats each partition as if it were a separate drive with its own drive letter (Windows), mount point (Linux/macOS), or volume name. The partition table at the start of the disk records where each partition begins and ends. A disk with no partition table has all its space available but no usable storage; you must create at least one partition before you can format it with a file system and start using it.
MBR (Master Boot Record) is the older partition scheme dating to 1983. It supports up to four primary partitions (or three primary plus one extended containing logical partitions), and individual partitions can be no larger than 2 TB. GPT (GUID Partition Table) is the modern replacement, part of the UEFI specification. GPT supports up to 128 partitions on Windows (theoretically much more), partition sizes up to 9.4 ZB, and crucially keeps a backup copy of the partition table at the end of the disk for redundancy. New disks larger than 2 TB must use GPT; modern Windows, macOS, and Linux installations all default to GPT on new systems. MBR is still used for compatibility with older systems and BIOS-only firmware.
On MBR disks, a maximum of four primary partitions, or three primary plus one extended that can hold any number of logical partitions in practice (often capped at 26 by Windows drive letters). On GPT disks, Windows supports up to 128 partitions and the spec allows even more. Most consumer Windows installations have 3-5 partitions: an EFI System Partition (ESP, ~100 MB), a Microsoft Reserved Partition (MSR, ~16 MB), the main C: drive, and one or more recovery partitions. Linux typically uses fewer partitions thanks to LVM (Logical Volume Manager) which lets you subdivide a single partition into many logical volumes without needing more partition table entries.
When a partition is deleted, only its entry in the partition table is removed. The actual file system and data inside the partition remain on the disk untouched until something writes over them. This is why partition recovery is often successful even when the disk shows up as RAW or unallocated: tools like TestDisk scan the disk for file system signatures (NTFS, FAT32, exFAT, APFS, ext4 boot blocks and superblocks) and reconstruct the partition table. The window for recovery shrinks every time something writes to the disk after deletion, so the standard rule applies: stop using the disk immediately, image it with ddrescue, and run recovery against the image.
Partitioning an SSD has minimal performance impact in either direction; modern SSDs handle partitioned drives just as well as unpartitioned ones. The main reasons to partition an SSD are organizational: separating system files from user data, dual-booting multiple operating systems, or isolating a backup partition. The traditional HDD reason for partitioning, namely keeping frequently-used files near the fast outer tracks of the platter, doesn’t apply to SSDs because they have uniform access times across all blocks. One caveat: ensure partitions are 4 KB aligned (every partitioning tool does this automatically since 2010 or so) to avoid the read-modify-write penalty that misaligned partitions cause on SSDs.
Yes, in most cases. The data inside the partition is unaffected by partition table corruption; only the location/size information for finding the partition is lost. TestDisk is the canonical free tool for partition recovery. It scans the disk for file system signatures (NTFS boot sectors, FAT32 boot blocks, ext4 superblocks, APFS container superblocks) and rebuilds the partition table from what it finds. On GPT disks, TestDisk can also restore the primary partition table from the backup at the end of the disk. Commercial alternatives include EaseUS Partition Recovery, MiniTool Partition Wizard, and DiskInternals Partition Recovery. For severely damaged disks with hardware issues underneath, a recovery lab combines disk imaging with partition reconstruction at the metadata level.
Related glossary entries
- NTFS: the Windows default file system that lives inside most Windows partitions.
- APFS: the Apple file system; APFS containers add another layer of partition-like organization within a partition.
- ext4: the Linux file system that lives inside most Linux partitions.
- exFAT: the cross-platform file system commonly used in single-partition external drives.
- Disk Image: image first then recover from the image, the universal partition recovery rule.
- Bad Sectors: physical disk failures that can wipe out the partition table area.
- Best data recovery software: software roundup covering partition recovery scenarios.
Sources
- Wikipedia: Disk partitioning (accessed April 2026)
- TechTarget: What Is a Partition in a Computer?
- ScienceDirect: Disk Partition: An Overview
- EaseUS: Disk Partition: How to Partition A Hard Drive
- R-Studio: What is a Disk Partition
- CGSecurity: TestDisk Step By Step
- Lenovo: Step-by-Step Hard Drive Partitioning
- CGSecurity: Recovering deleted partition using TestDisk
- Red Hat: Recover partitions and files with TestDisk
- Computer Hope: What Is a Partition?
About the Authors
Data Recovery Fix earns revenue through affiliate links on some product recommendations. This does not influence our reference content. Glossary entries are written and reviewed independently based on documented research, vendor documentation, independent testing, and recovery-engineer review. If anything on this page looks inaccurate, outdated, or worth revisiting, please reach out at contact@datarecoveryfix.com and we’ll review it promptly.
