How to recover accidentaly deleted partition/files?

[grancharov]

My last screenshot definitely wasn't 100 MB - it was 154 kB. I resized it to 89 kB but I received the same error. No matter anyway...

In the first post I wrote that when I tried to recover the lost partition with Partition Wizard, after that I rebooted and then in the corresponding step of the starting process XP ran its tool for disk checking. I didn't stopped it and maybe this made the situation worse.

I use the free version of DMDE - is this a problem? Maybe it is better to use dadarescuedd?

The destination will be 2 TB "green" HDD in D-Link DNS-345. It won't be a problem that it runs under linux(file system) - right?

[jaclaz]

NO, the upload limit (maximum global size for attachments on MSFN.ORG forum) is much lower expecially - I believe - for new members, if you sum all the screenshots and logs you posted, you have probably reached it.

It does matter that you find a way to produce that screenshot, as I need to know the actual LBA of the "real", "good" $MFT (the one found for the volume that starts @16373760) and have to know what actually it is found when using that $MFT.

From what I could gather till now, partition Wizard simply recreated a partition with a slightly different situation.

It is possible that CHKDSK made some "damage", but I doubt it (and it shoudl have been an extremely "short" run of CHKDSK)

In the meantime I thought a bit about WHAT caused the issue, and (morally only ) I have good news .

It was not strictly your fault (nor the fault of the tools you used), it was one of the lesser known SERIOUS glitches with XP (actually with it's Disk Manager), see here:

http://reboot.pro/topic/9897-vistawin7-versus-xp-partitioning-issue/

basically the XP disk manager CANNOT deal with disks containing logical volumes NOT aligned to cylinders and whenever you do *anything* on such a disk, even something as trifling as changing the active status of a Primary partition, it attempts to re-calculate/re-check the whole partitioning setup, fails and plainly deletes any and all logical volumes inside extended.

The issues (if any) with that NAS are the following:

• the filesystem of the partition on which you create the huge file must be capable of making such a big file (this means either NTFS or Ext2/3/4, I am not familiar with that hardware but - if by any chance the filesystem is FAT32 it won't work ) and you need to have anyway 2,000,398,934,016 free space on the volume on which you make the file, if the actual disk in the NAS is 2Tb in size, I doubt you will have that amount of space actually free in the filesystem
• transferring 2 Tb over the network might be very slow (normally such dd copies are made to disks directly connected to the machine)

I am not aware of a limitation in the free edition of DMDE about the imaging, but you can use datarescuedd as well as *any* tool capable of making a dd-like copy of the disk.

BEFORE you make the "huge copy" I would like to have a look at:

some 100 sectors starting from sector 0:

dsfo \\.\PhysicalDriven 0 51200 C:\myfirst100.bin

some 300 sectors starting from sector 16370098 <- these include also the beginning of the "bad" $MFT which is @16370322

dsfo \\.\PhysicalDriven 8381490176 153600 C:\mybadpart300.bin

some 300 sectors starting from sector 16373560

dsfo \\.\PhysicalDriven 8383262720 153600 C:\mygoodpart300.bin

some 300 sectors starting from sector (the whatever sector the "good $MFT" is)

dsfo \\.\PhysicalDriven ???????? 153600 C:\mygood$MFT300.bin

(in the screenshot you posted http://www.msfn.org/board/uploads/post-384634-0-55038100-1385319889.jpg which is about the "bad" $MFT, the meaningful LBA address is the one in the top left of the right bottom pane, in GREEN LBA:16370322, I need the corresponding one for the "good" $MFT)

The n in the above is the "usual" disk number.

You can get the dsfo.exe as part of the DSFOK toolkit:

http://members.ozemail.com.au/~nulifetv/freezip/freeware/

extract it in a directory like C:\dsfok, then open a command prompt and navigate to it and then enter the command lines above.

If you have issues with command line tools, say so BEFORE attempting using them incorrectly.

As an alternative you can use the DMDE or the DatarescueDD to create the needed "partial" .bin files.

Once you have created them, do compress them all into a .zip archive, upload to a free hosting site and post a link to the file.

Ask for clarifications if you have doubts.

jaclaz

[grancharov]

You at first wrote that 2 TB HDD will be enough and now - won't be enough? I already was thinking about buying a 4 TB HDD to put it into last free slot in the NAS. I know that more than 2 TB won't work with XP, but right now I can't exchange XP with 7...

I think the file system for my NAS is ext3 or ext4. Because of the low network speed(I use a cheap router) I agree that it maybe would be better to mount this HDD in the PC. But then I will have to format and align(or reversely) it. So if only the speed will be the problem here, and not the space - I will copy through the LAN.

I'm not very comfortable with command line tools. Would you tell me how exactly to get those 100 sectors with DMDE?

$Noname02 $MFT - LBA 16373784

Edited November 25, 2013 by grancharov

[jaclaz]

A 2 Tb hard disk would be enough if you do a "clone" (i.e. you can write directly to a disk or \\.\Physicaldrive).
A 2 Tb hard disk would NOT be enough if you do an "image" (i.e. a file written on an existing filesystem) as the filesystem structures will occupy a part of the 2 Tb.
If you can use Explorer, if you select the volume and Right click->Properties you need to have at least 2,000,398,934,016 bytes in "Free Space":

the above example most likely belongs to a 2Tb disk partitioned under XP that has a few hidden sectors at the beginning and some unused space at the end, since also your currently failed disk has some unused space at the end, you could do with (3,907,024,064+1)*512=2,000,396,321,280 to image/clone the WHOLE disk.

BUT it would be also "enough" if you save separately (in two distinct files) only the sectors from 0 to 100 and the sectors from 16,370,000 (rounded) to 3,907,024,064, which would make (3,907,024,064+1-16,370,000)*512=1,992,014,881,280 which should fit in a filesystem on a 2 Tb disk.

With DMDE, after having opened the PhysicalDrive, go to Tools->Copy Sectors

• myfirst100.bin:
  Input in "Source" Start sector=0 Number of sectors=100
  In "Destination" click File button and then Save to myfirst100.bin
• mybadpart300.bin:
  Input in "Source" Start sector=16370098 Number of sectors=300
  In "Destination" click File button and then Save to mybadpart300.bin
• mygoodpart300.bin:
  Input in "Source" Start sector=16373560 Number of sectors=300
  In "Destination" click File button and then Save to mygoodpart300.bin
• mygood$MFT300.bin:
  Input in "Source" Start sector=???????? Number of sectors=300 <- the ???????? stand for the LBA that I still miss
  In "Destination" click File button and then Save mygood$MFT300.bin

jaclaz

[grancharov]

http://www2.zshares.net/7rjdwmauz1zz - this is from Noname02.

[jaclaz]

Ok, all data seems (if not "right") understandable.

I am still curious about the exact procedure that was originally used to create the filesystem.

The $MFT is on cluster #3, which is VERY unusual (default is as said 786432), most probably this is the single issue that "throws off" TESTDISK.

The data seems like entirely recoverable. :

The point is whether once you will have made a simple corrections to the MBR and possibly checked the Bootsector mirror (or replace it) it will be possible only through DMDE (in which case you will need to buy a license for the full version, since the Free one only allows for recovery of single items) or the small manual repairs will be enough to run TESTDISK and get the files or (better) it will be possible to run successfully CHKDSK.

If you have found a suitable way to make the image (always better safe than sorry) all seems like fine and dandy.

The plan is to have the image created, do a few changes/correction on the disk and let CHKDSK fix the rest, if it works (it seemingly worked nicely on the partially rebuilt filesystem I tried ), good, if it doesn't, we restore the image and try again with DMDE.

In the meantime I will rebuild another partial filesystem from scratch and see what TESTDISK can do with it.

jaclaz

P.S.: you might want to remove/delete the last file you uploaded to zshare

Edited November 26, 2013 by jaclaz

[grancharov]

Thank You for the assistance!

I have a couple of questions. At first about DMDE: there is "Express" and "Home" version. Is the "Express" enough for my case? I think that the differences between these versions aren't important to me.

The next one is more general - I'm not sure what would be better(faster, safer...smarter ):

- to free one HDD in my NAS and to make the image there

- to free this HDD and move it in my main PC - and because I use 32 bit OS I will have to reformat and align it

- to mount this HDD and also the damaged HDD in my secondary PC, where I recently installed Win7

or to buy a new - 4 TB HDD and mount it in the NAS?

The problem is that my main PC has only one free SATA port and old OS, and my secondary PC has a case(CM Elite 360), that doesn't support more than 3 HDD's by default and there are already 2(I could connect another 2 but the cooling can be a problem).

[jaclaz]

I am not much familiar with the licensing options of DMDE, but both Home and Express would do (if needed) in your case:

http://dmde.com/editions.html

the difference is support period (that you probably - or hopefully - won't need at all) and number of hardware changes per year (that again you should not need at all).

This is "personal use only", right?

There is no need to "realign" anything (connected to using a 32 bit OS), maybe if the NAS uses Ext2/3/4 there is a need to re-format as NTFS (there are Ext2/3 drivers for Windows XP, but cannot say if they are reliable with this mass of data/size of file/transfer).

You can mount a HD "temporarily" alright, I mean you open the side of the case, put the harddisk on a piece of cardboard beside the case or on top of it and have the cables get out of the case. As long as you don't have kids or pets at loose in the house there would be no issues.

It is some time since I image such a huge hard disk, but it should be (at top SATA 2 speed) something like 150 Mb/s top speed, but on average more like 100 Mb/s, i.e. you have around 2 Tb=2,000 Gb=2,000,000 Mb divided by 100, 2,000,000/100=20,000 seconds/3600=5,55 hours, likely it will take something between 5 and 8 hours.

A "normal" 100 Mbps local Lan will have at the most 12.5 Mb/s of transfer, more probably 10 Mb/s, i.e. it will take approximately ten times!

Think at all the things that may go wrong (power outage/blackout as an example) over 5 days 24h.

jaclaz

[grancharov]

I read that the so called advanced format HDD is optimized for Vista and newer OS and under XP it needs to be "aligned" with special tool... I think (but not sure) that without the "align"-procedure I will have lower performance. Anyway, I will cope with this task.

OK, most likely I will move one HDD from NAS to the main PC. I will write again when I'm ready - probably in Thursday or Friday. Thank you again!

[jaclaz]

Yep , but you see, everything is "relative".

Having a partition aligned to 64K as a multiple of 4096 bytes (the common cluster size in NTFS) is an advantage where the BUS (i.e. SATA2 or later) is faster than the actual hard disk.

BTW this alignment favours only some types of data access, compare with:

http://reboot.pro/topic/9897-vistawin7-versus-xp-partitioning-issue/?p=85960

and it applies (mainly) to NTFS (as NTFS is "inherently" aligned to cluster size), it won't work (unless some further measures are taken) to FAT/FAT32, see:

http://www.msfn.org/board/topic/151798-does-fat32-align-its-clusters/

http://reboot.pro/topic/16775-discover-allocation-unit-and-other-information-of-ufd-under-windows/

http://reboot.pro/topic/16783-rmprepusb-faster-fat32-write-access-on-flash-memory-drives/

It may also apply to EXT2/3/4 , but the point is that if the bus is slower than the device (such as it would be in a NAS) there won't likely be any positive effect.

What people sometimes forget is that only relatively recently actually hard disks were capable of saturating a SATA1 (or ATA6, i.e. IDE133) bus speeds.

A SATA2 bus outperforms *any* harddisk, the new frontier (SSD's) are faster and do *need* SATA3, but when you put in it a slowish intermediate (such as USB2 or Ethernet connection) the performance of the bus is so inferior to that of the device that it makes little sense to optimize the device.

jaclaz

[grancharov]

Hello, Jaclaz! Are you still there?

I moved the hdd from NAS to the main PC and I can begin the imaging, but I don't know exactly what parameters to choose from DMDE "Copy Sectors"-window. There are "Device", "Partition", "File". Is it better to do a "clone" and does I have to format the destination hdd, or DMDE will do this? I ask because I formatted to NTFS the destination hdd under Win7 on my secondary PC, but when I moved it to the main PC(with XP) the disk manager shows "GPT Protective Partition". What to do with this GPT partition? Should I delete it and format again(using third party software) to MFT ntfs, or just to run copy with DMDE?

[jaclaz]

Sure , still around (and going strong ).

Ideally you should have on the XP machine an added drive letter corresponding to the volume that you created by partitioning and formatting on the 7 machine, and if you right click on this drive letter, and select properties, you should see something similar to the screenshot posted here:

http://www.msfn.org/board/topic/170392-how-to-recover-accidentaly-deleted-partitionfiles/?p=1061281

If you have as "Free Space" more than around 2 Tb, more exactly more than 2,000,398,934,016 bytes, you are good to go.

To make an image:

Open DMDE.

Choose the "botched" PhysicalDrive (as you did before).

Go to Tools-Copy Sectors

In the top pane "Source" (make sure you have the "right" Physicaldrive in it selected) push the min button besides "Start Sector", push the max button besides the "End Sector".

In the lower pane "Destination" click on File button, navigate to the drive letter corresponding to the newish/largish disk drive letter and click on Save.

You will now see in the "Destination" pane the path to the image that will be created.

Once everything has been checked, press "OK".

If you cannot see the "new" drive on that XP machine, yes, you will need to re-partition the new drive as MBR (not as GPT) from within XP, then create a new partition/volume larger than 2Tb, formatted as NTFS. (no need for "third party utilities", though )

Which make/model is the "new" hard disk? (and which size is it)?

Or you could decide to make a "clone" instead of an image. (a clone will be an EXACT copy of the source device, so it doesn't matter if and how the target device is partitioned/formattted as anything related to it will be overwritten by the data coming from the source device).

To make a clone:

Open DMDE.

Choose the "botched" PhysicalDrive (as you did before).

Go to Tools-Copy Sectors

In the top pane "Source" (make sure you have the "right" Physicaldrive in it selected) push the min button besides "Start Sector", push the max button besides the "End Sector".

In the lower pane "Destination" click on Device button, choose the PhysicalDrive corresponding to the "new" disk drive and press OK.

You will now see in the "Destination" pane the path to the PhysicalDrive and the offset pre-set ot 0 (leave it as is).

Once everything has been checked, press "OK".

jaclaz

[grancharov]

...

If you cannot see the "new" drive on that XP machine, yes, you will need to re-partition the new drive as MBR (not as GPT) from within XP, then create a new partition/volume larger than 2Tb, formatted as NTFS. (no need for "third party utilities", though )

Which make/model is the "new" hard disk? (and which size is it)?

Or you could decide to make a "clone" instead of an image. (a clone will be an EXACT copy of the source device, so it doesn't matter if and how the target device is partitioned/formattted as anything related to it will be overwritten by the data coming from the source device).

...

This is exactly what I was asking for. I made one big mistake so I'm on the other extreme and ask twice and trice before click Enter.

The source is WD20EARS and the destination is WD20EARX.

[jaclaz]

The source is WD20EARS and the destination is WD20EARX.

Good.

DMDE besides the PhysicalDrive # should show you also the device type, so you should be able to further confirm that you are using the "right" devices, WD20EARS and WD20EARX

jaclaz

[grancharov]

At this moment the process is on 10% - Current LBA Offset 210 GB.

Edited December 1, 2013 by grancharov