How to recover accidentaly deleted partition/files?

[grancharov]

I think that the image is ready. What is the next step?

[jaclaz]

I think that the image is ready. What is the next step?

Rather easy.

Download the attached file and unzip it *somewhere*.

Copy the Rightsector0.bin to first sector of the "botched" disk.

To do that:

Start DMDE, tell it to load an image file and point it to Rightsector0.bin.

Click on Close in the "Partitions" window that pops up.

Tools->Copy Sectors.

Leave the "Source" pane "as is".

In the lower "Destination" pane choose device, select the "right" PhysicalDrive, (double check) and press OK.

Close DMDE.

Reboot.

You should have a drive letter for the volume, let's say it gets drive letter E:\ (or change below drive letter accordingly).

Open a command prompt.

In it type:

CHKDSK E:

[ENTER]

It will most probably tell you that there are errors in the filesystem that cannot be fixed because the /F parameter was not specified.

type:

CHKDSK E: /F

[ENTER]

it will most probably output a number of lines telling you it is fixing this or that.

Once it has finished type:

CHKDSK E: /R

[ENTER]

it will most probably output a number of lines telling you it is fixing this or that.

Once it has finished (hopefully) all your data should be accessible.

Post reporting if something different from the above happens.

jaclaz

RightSector0.zip

[grancharov]

This is not very clear. In the Source I have WD20EARS - start sector 0, end sector 0, number of sectors 1. In the Destination I have by default the same drive - WD20EARS. Is'n it right that I have to select the path to .bin-file in the Source-section - File? The file itself now is in the other drive - how can I copy it when in Source and in Destination is the same drive?

[jaclaz]

This is not very clear. In the Source I have WD20EARS - start sector 0, end sector 0, number of sectors 1. In the Destination I have by default the same drive - WD20EARS. Is'n it right that I have to select the path to .bin-file in the Source-section - File? The file itself now is in the other drive - how can I copy it when in Source and in Destination is the same drive?

No.

Start DMDE.

When you start it a popup windows will appear.

On the left of it there are Physicaldrives listed.

On the right there is a set of radio boxes with - by default - "Physical Devices" selected.

Select "Disk Images" instead.

A "browse" window will open, navigate to and choose file Rightsector0.bin and press OK.

A new popup window "Partitions" will appear.

Click on th "Close" button.

Now, Tools->Copy sectors.

The "Source" will be "Image:<somepath>\Rightsector0.bin", Start Sector 0, End Sector 0, Number of sectors 1.

jaclaz

[grancharov]

I'm afraid that I made another mistake. I ran CHKDSK E:/R, but it should be H:/R. Now it is on stage 4 of 5 and stay on 0 percent. What to do now - did I lost another partition? Can I just close CMD window and start again with the correct partition?

[jaclaz]

I'm afraid that I made another mistake. I ran CHKDSK E:/R, but it should be H:/R. Now it is on stage 4 of 5 and stay on 0 percent. What to do now - did I lost another partition? Can I just close CMD window and start again with the correct partition?

No, don't worry

Leave it running CHKDSK is a built-in Windows tool thar REPAIRS (does NOT damage) filesystems.

The only issue is that you NEED to wait for it to finish (it may take some time, i.e. even hours on a largish volume, to run, but eventually it will finish) and your filesystem (the "E:" that you selected by mistake) will be in the same (or better) condition than it was before.

jaclaz

[grancharov]

Good Now it is on 3 %. I noticed my mistake only when I looked at the total disk space and the size of the files. It was something like 900/800 GB and in my damaged partition it should be much more...

When this check finish - should I go again through the three stages: chkdsk H: - chkdsk H: /F - chkdsk H: /R, or just go for the last one?

Edited December 1, 2013 by grancharov

[jaclaz]

Good Now it is on 3 %. I noticed my mistake only when I looked at the total disk space and the size of the files. It was something like 900/800 GB and in my damaged partition it should be much more...

When this check finish - should I go again through the three stages: chkdsk H: - chkdsk H: /F - chkdsk H: /R, or just go for the last one?

No, just the last one.

CHKDSK without any parameter does very limited fixes (in theory it is "check only") but it also does a "limited" check, i.e. it may ignore some problems (and report a filesystem as "sound" even it it has actually some issues).

The CHKDSK /F is both a "generic fix" and a more thorough check.

The CHKDSK /R is the most complete check (and set of fixes) you can have (and actually implies the /F).

In theory you could run only CHKDSK /R which already comprises the two previous ones, but in practice it is better to run it in the mentioned three stages because one can visually understand the "seriousness" of problems in a filesystem, a CHKDSK or CHKDSK /F takes on a "sound" filesystem a few seconds/minutes, and - from experience, you can call it anecdotal evidence alright - it seems like the /F alone is *somehow* more effective than the same /F implied in the /R, or however "prepares" the disk for a more effective /R repair later.

In your case you already (very recently) run the CHKDSK and the CHKDSK /F, so you only have to run the CHKDSK /R (this time on the "right" volume ).

jaclaz

[grancharov]

I ran chkdsk H: /F and it showed:

1945325152 KB total space

48 KB in 17 files

20 KB in 13 indexes

0 KB in bad sectors

125892 KB in use by the system

65536 KB occupied by the log file

1945199192 KB available on disk

4096 bytes in each allocation unit

486331288 total allocation units on disk

486299798 allocation units available on disk

What to do now?

[jaclaz]

I ran chkdsk H: /F and it showed:

1945325152 KB total space

48 KB in 17 files

20 KB in 13 indexes

0 KB in bad sectors

125892 KB in use by the system

65536 KB occupied by the log file

1945199192 KB available on disk

4096 bytes in each allocation unit

486331288 total allocation units on disk

486299798 allocation units available on disk

What to do now?

This is very strange.

I can get more data than you with my (very partial) image.

Are you sure you did the steps correctly?

(or that you didn't modify the disk since you posted those sectors?)

With only about 150 records in the $MFT I get:

2938304 KB in 106 files

48 KB in 29 indexes

It would be very, very queer that an error in the $MFT past the part that you sent me is capable of deleting files already indexed in that first part.

The only difference in the image I rebuilt with your data (apart the smaller number of entries in the $MFT) are:

1. the traces of the "wrong" partition deleted (but this is irrelevant with the new MBR I posted)
2. the presence of a correct $MFTmirr (but in theory you should have one nonetheless)
3. the presence of a correct $BootMirr (but this is completely irrelevant)

and yet it gives "better" results.

Try re-stating exactly the steps you made, maybe you unwantingly did something different from the instructions?

What happens if you now open the disk in DMDE and click on [All Found+Reconstruction]?

Now, your next step should be to image back the copy to the original, are you confident that you can do it without messing with disks or drives?

jaclaz

[grancharov]

I think that I didn't modify the disk - I once opened the partition and saw that there are some hidden files - does this matter?

When I doubleclick on All found + Reconstruction - the program ask for virtual file system reconstruction.

http://www2.zshares.net/4mjtnprvto53

http://www2.zshares.net/jd2sqq8qdzc5

When I click once i don't see nothing there.

I think that the partition should start at sector 16370235(this showed TestDisk at first - before I tried with Partition Wizard)...

Edited December 1, 2013 by grancharov

[grancharov]

Can I try some recovery program before to turn back the image(for another 8 hours)?

[jaclaz]

I think that I didn't modify the disk - I once opened the partition and saw that there are some hidden files - does this matter?

How exactlty did you "open" the partition?

I think that the partition should start at sector 16370235(this showed TestDisk at first - before I tried with Partition Wizard)...

NO, that's the "botched" new partition that Disk Manger made, the right one, as I tried to explain you before the beginning of the existing partition is 16373760.

When I doubleclick on All found + Reconstruction - the program ask for virtual file system reconstruction.

Sure, you need to tell it to do the virtual file reconstruction.

The DMDE is already "a" recovery program, let's see what it sees, first, if you prefer i doubt that *any* recovery program (exception made - maybe - for some pricey Commercial ones) can see "more" files than DMDE.

The point here is with much less data than you have I have a much better result, which as said can mean only that the disk was modified (i.e. the data on disk is not the same as the snippets you posted/sent) or that some other issue in the parts of the $MFT after the snippet you sent causes CHKDSK to ignore almost all the data.

Let's see what happens with the virtual filesystem reconstruction, instead of reimaging back the whole image, you can reimage back only the $MFT and see if DMDE can rebuild a better fielsystem, before doing the whole reimage.

jaclaz

[grancharov]

I opened the partition with doubleclick and changed View - Show protected files(recycler and system volume information).

So I will try Virtual file system reconstruction. I open DMDE - select the drive WD20EARS - open volume $Noname01(in the lower right pane LBA begins with 16373784) - doubleclick on Allfound+Reconstruction. After the virtual reconstruction I can see (most of)the folders. Some of the folders have a red X on them.

What next?

[jaclaz]

I opened the partition with doubleclick and changed View - Show protected files(recycler and system volume information).

So I will try Virtual file system reconstruction. I open DMDE - select the drive WD20EARS - open volume $Noname01(in the lower right pane LBA begins with 16373784) - doubleclick on Allfound+Reconstruction. After the virtual reconstruction I can see (most of)the folders. Some of the folders have a red X on them.

What next?

The folders with the "red X" means that they are "deleted" folders (the point here is that this deletion was seemingly done by the CHKDSK).

The LBA 16373784 that you see in the lower panel is OK, it is the beginning of the $MFT, which as we have seen earlier is on cluster #3, and since a cluster is 8 sectors, so 16373760+3*8=16373784.

You can try inspecting with DMDE the clone you made (again on this you will need to choose the NTFS that DMDE finds and that will be presented to you as the volume starting at 16373760, and see if doing the same "Virtual file system reconstruction" it finds more files/directories (it is likely that you will have a "same" number of fies/directories but with less of them with the red "x", but it's difficult to say).

If it does, then your best choice is still that of restoring the original disk from the clone, apply to it the corrected MBR I posted and then either continue with DMDE (getting a license for it) or see what other Recovery utilities may find on it.

jaclaz

Edited December 2, 2013 by jaclaz