newprouser Posted February 27, 2011 Share Posted February 27, 2011 (edited) Hi friends,I had created 5 partitions on my HDD in Windows XP (Drives C,D,E are Primary , F,G are in extended parition ). Today i decided to do some re-partitioning, so openedup disk management utility (diskpart) and deleted partition E which is a primary partition but somehow the partition G also got deleted. The space that was E partitionnow shows up as "unallocated space" and the space of G partition as "Free Space".The rest of the partitions are intact. I don't understand how this happened, can anyone explain how this happened.Also is there a way I can mount the "Free space" to a new partition, so that I can do a recovery of my data , if at all its possible ? If i try to assign a drive letter to G partition area using the disk management, i will have to format it, which will destroy any remaining data.Configuration:Up-to-date Windows XP SP3Intel DG35EC MoboIntel C2D 2.53 GhzUsed XP's inbuilt Disk Management Utility - Diskpart Edited February 27, 2011 by newprouser Link to comment Share on other sites More sharing options...
jaclaz Posted February 27, 2011 Share Posted February 27, 2011 If all you did was to delete the partitions on disk management, (or diskpart) you can probably get them back in a relatively easy manner.Get TESTDISK and run it (with a LOG file):http://www.cgsecurity.org/wiki/TestDiskTake some time to read the documentation BEFORE running it.DO NOT write anything to the disk.Post the log after you have done a Search for lost partition AND a "deep scan".jaclaz Link to comment Share on other sites More sharing options...
newprouser Posted February 27, 2011 Author Share Posted February 27, 2011 (edited) Hi,I ran the deep search as you suggested. But the details of test weren't written to the log, so i'm attaching the screenshot. I've attached the log just in case there is some information in there.The last partition is the one I need to recover.testdisk.rar Edited February 27, 2011 by newprouser Link to comment Share on other sites More sharing options...
newprouser Posted February 27, 2011 Author Share Posted February 27, 2011 I guess all I've to do is to recover the partition by marking it appropriately. Since it is a logical drive in an Extended partition, I'm confused whether to mark it as Logical or Extended Link to comment Share on other sites More sharing options...
jaclaz Posted February 27, 2011 Share Posted February 27, 2011 I guess all I've to do is to recover the partition by marking it appropriately. Since it is a logical drive in an Extended partition, I'm confused whether to mark it as Logical or ExtendedWait before doing something you may later regret.Data gathered needs to be analyzed BEFORE deciding WHAT to do (and doing it).The Log has this data:Analyse Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63Geometry from i386 MBR: head=255 sector=63NTFS at 0/32/33NTFS at 4171/87/13NTFS at 82496/120/57Current partition structure: 1 * HPFS - NTFS 0 32 33 4171 87 12 67010560 [Windows 7] 2 P HPFS - NTFS 4171 87 13 17225 129 56 209715200 [Ebooks n Pictures] 3 E extended LBA 82496 88 25 121601 25 24 628217856 5 L HPFS - NTFS 82496 120 57 108604 206 18 419430400 [Software Music n Gamez]The "deep scan" screenshot has found more partitions than the one(s) you apparently deleted.Can you couple the drive letters in your first post to the actual volume labels as found by testdisk?If you are positive that the drive was a logical volume inside Extended, mark it as Logical.From what you posted, it seems like the one you deleted is the one with label "[backup n Workshop]", which yes, it's a Logical drive inside Extended, but double check, see if you can see through testdisk the actual files that were in it before writing the partition table:http://www.cgsecurity.org/wiki/TestDisk_Step_By_Stepjaclaz Link to comment Share on other sites More sharing options...
newprouser Posted February 27, 2011 Author Share Posted February 27, 2011 The "deep scan" screenshot has found more partitions than the one(s) you apparently deleted.Yep, that's a bit misleading coz I don't know where the "Linux" partitions popped up from, and also all the partitions are marked as "D" - deleted, whereasin reality only Two are deleted "movies" and "[backup n Workshop]".Can you couple the drive letters in your first post to the actual volume labels as found by testdisk?Apart from the Linux Partitions , Yes.If you are positive that the drive was a logical volume inside Extended, mark it as Logical.From what you posted, it seems like the one you deleted is the one with label "[backup n Workshop]", which yes, it's a Logical drive inside Extended, but double check, see if you can see through testdisk the actual files that were in it before writing the partition table:http://www.cgsecurity.org/wiki/TestDisk_Step_By_StepYes & yes. I did check the files , and they are right there.I've got one more question. What do i do for the rest of the partitions , which are also marked as deleted, but are actually present correctly in windows ? If I mark only the last partition as Logical and leave others as such it may delete them while I write the partition table.On the other hand , setting other partitions again to appropriate designations (primary, extended etc) *might* screw up existing partitions as well. Link to comment Share on other sites More sharing options...
jaclaz Posted February 27, 2011 Share Posted February 27, 2011 I've got one more question. What do i do for the rest of the partitions , which are also marked as deleted, but are actually present correctly in windows ? If I mark only the last partition as Logical and leave others as such it may delete them while I write the partition table.On the other hand , setting other partitions again to appropriate designations (primary, extended etc) *might* screw up existing partitions as well.Leave them alone. Mark ONLY the partition you want to undelete with L.Go back to the partition view, and it should contain the SAME partitions as in the Log you posted+the one you just marked.If it is so THEN write the new partition tables.Compare with point "Partition table recovery" in the given:http://www.cgsecurity.org/wiki/TestDisk_Step_By_StepIn other words, BEFORE you WRITE you need to make sure that everything is EXACTLY as you wish it to be.If in doubt DO NOT write the partition tables.Until you hit the "write" and confirm with "y" everything is "virtual" and you can easily start again.jaclaz Link to comment Share on other sites More sharing options...
newprouser Posted February 27, 2011 Author Share Posted February 27, 2011 I should've set the other partitions to their respective values as well, coz i got this when i tried to write the partition table. The most boring part is that I have scan all over again :sigh: Nice software though i wish it would've been great if it had "back" option for all screens and menus. Link to comment Share on other sites More sharing options...
jaclaz Posted February 27, 2011 Share Posted February 27, 2011 I should've set the other partitions to their respective values as well, coz i got this when i tried to write the partition table. The most boring part is that I have scan all over again :sigh: Nice software though i wish it would've been great if it had "back" option for all screens and menus.Sorry, but NO (meaning that you did *something* before thoroughfully checking, as you were told it would be needed).You write what you see.If the partitions were not listed when you hit Write they won't be there, that is essentially the meaning of my previous post.You might have deleted them accidentally before the disk scan, but if you did so, they were NOT there when you hit the Write.jaclaz Link to comment Share on other sites More sharing options...
newprouser Posted February 27, 2011 Author Share Posted February 27, 2011 I seem to have conveyed the wrong meaning there The screenshot was that of the "Partition table recovery" step , and i obviously didn't dare to "write" (as u can see from the screeshot i selected quit) .I only meant to say that I'd have to do the "deep analysis" again for another ~5 hrs and then set all the partitions to respective parameters again todo the recovery.btw i did restart my PC to check if the other partitions were available and also a ran a test on a rar file to see if anything is wrong. ALL is good as of now Link to comment Share on other sites More sharing options...
urie Posted February 27, 2011 Share Posted February 27, 2011 @ newprouser, there is also free MiniTool Partition Wizard you could give that a try. Link to comment Share on other sites More sharing options...
jaclaz Posted February 27, 2011 Share Posted February 27, 2011 I seem to have conveyed the wrong meaning there Pheew. But you have the screenshots, and you can manually add new partitions:http://www.cgsecurity.org/wiki/Data_Recovery_Examples#Two_FAT32_partitions_to_recoverOnly, it is not advised (better wait a few hours and avoid a possible mistake)jaclaz Link to comment Share on other sites More sharing options...
newprouser Posted February 27, 2011 Author Share Posted February 27, 2011 @ newprouser, there is also free MiniTool Partition Wizard you could give that a try.thanks, i'll check it out !Only, it is not advised (better wait a few hours and avoid a possible mistake)had pretty much the same thought ! Link to comment Share on other sites More sharing options...
newprouser Posted February 28, 2011 Author Share Posted February 28, 2011 Thanks guys, I recovered the partition and my data Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now