Jump to content

partition disappeared after using Disk Management


jbclem
 Share

Recommended Posts

I was adding a new partition using Disk Management, and seconds into this action the screen went black.  When I rebooted the dual boot WinXP sp3 computer it wouldn't go past an error message indicating it couldn't access the boot disk.  Eventually I started the computer using a bootcd and ran Disk Management which showed the missing boot partition was still in place but its 113.68 gb was identified as "free space".  When I right clicked on the missing partition, the only option was "new logical disk".  I was later able to run the analysis part of a file recovery software and it looked like the files/data were still there.

How to recover this partition?  I've had a hard time running any partition software from inside thie bootcd's minixp, so I'd appreciate some suggestions.  I've discovered that others have had a similar problem when using Disk Management, but haven't found a solution yet and I'm hampered by the very old version of Opera (v12) that comes with the bootcd's minixp...it can't access most websites for security reasons.

John

 

 

Edited by jbclem
Link to comment
Share on other sites


10 hours ago, jbclem said:

I was adding a new partition using Disk Management, and seconds into this action the screen went black.  When I rebooted the dual boot WinXP sp3 computer it wouldn't go past an error message indicating it couldn't access the boot disk.  Eventually I started the computer using a bootcd and ran Disk Management which showed the missing boot partition was still in place but its 113.68 gb was identified as "free space".  When I right clicked on the missing partition, the only option was "new logical disk".  I was later able to run the analysis part of a file recovery software and it looked like the files/data were still there.

How to recover this partition?  I've had a hard time running any partition software from inside thie bootcd's minixp, so I'd appreciate some suggestions.  I've discovered that others have had a similar problem when using Disk Management, but haven't found a solution yet and I'm hampered by the very old version of Opera (v12) that comes with the bootcd's minixp...it can't access most websites for security reasons.

John

 

 

Hello @jbclem! In the past, I had lost the whole partition structure of my hard disk several times. Only one tool was able to recover the lost structure. And the winner is TestDisk. Use the boot disk or boot cd! If Windows XP is your main system, download TestDisk 6.13. It is also part of different rescue CDs like for example UBCD.

Cheers, AstroSkipper metiers1.gif

Edited by AstroSkipper
Link to comment
Share on other sites

@jbclem! Here is a downoad link of TestDisk 6.13 Boot CD (German website): https://www.computerbase.de/downloads/systemtools/festplatten/testdisk/ link.gif

Be careful when usimg that! First read, then act! There is no better solution. This tool is the best of all. If it can't recover your MBR and partition structure, then most probably all is lost.

Cheers, AstroSkipper matrix.gif

Edited by AstroSkipper
Link to comment
Share on other sites

2 hours ago, AstroSkipper said:

This tool is the best of all. If it can't recover your MBR and partition structure, then most probably all is lost.

Naaah, Testdisk is an extremely useful and usually perfectly working :thumbup semi-automated tool, but often some manual intervention is needed, very likely it will work in this case, but before calling anything actually lost there is manual repair possible.

When (if) something is not recoverable via DMDE (used by a somehow knowledgeable operator) then you might state that "most probably all is lost".

jaclaz

Link to comment
Share on other sites

42 minutes ago, jaclaz said:

..., but before calling anything actually lost there is manual repair possible.

A manual repair by editing the MBR is for most users not really a choice. A deeper knowledge would be necessary in such a case, otherwise a user might destroy the structure forever. BTW, most probably means there may still be a chance, but it'll be very unlikely for the "normal user" to recover the lost partitions. If TestDisk can't repair the errors, all is most probably lost for a normal user. Spoken for me, I always could successfully repair my damaged partition structure using TestDisk. :thumbup And, I had a lot of these booting problems with lost partitions in the past. :yes:

Kind regards, AstroSkipper metiers1.gif

Edited by AstroSkipper
Link to comment
Share on other sites

Astroskipper, thanks for the Testdisk suggestion.  I've been trying it on the Ultimate bootcd and Hirens Bootcd PE.  I'm going to try to attach 7 screen shots from running the Analysis section, could you give me your opinion as to what I should do next...

2nd screen...Quick Search.jpg

1st screen Current Partition Structure.jpg

3rd screen....(P) List Files.jpg

4th screen...try to find more partitions..jpg

5th screen... after deeper search.jpg

6th screen...CONTINUE after deeper search results.jpg

7th screen.  (P) list files result.jpg

Link to comment
Share on other sites

That disk has been  partitioned or "touched" at some time on a later than XP System, the first (NTFS) partition starting at 0/32/33 (i.e. LBA 2048) is typical of a Vista or later system, on the other hand, somehow a partition starting at 0/1/1 (i.e. LBA 63) was created, spanning all disk, and by using the XP disk manager (there is a known bug) the Extended partition has been "normalized" to the XP standard, breaking the chain of EPBR's, the Extended partition starts on a cylinder boundary (3917/0/1) which is a sign that the original partitioning (at least the creation of the Extended) was made on a XP or earlier system, or anyway respecting cylinder boundaries.

It is very possible that originally the disk had a single NTFS volume spanning the whole disk (starting at 0/0/1 and 97676802 in size) and that later it was re-partitoned creating the first Primary partition and the Extended one, and the logical volumes inside the latter.

If you look at the 6th (the one before last) screenshot, you have a list of all found partitions/volumes (all marked as D - deleted).

Of these, some are false positives, namely the first one (starting at 0/1/1 and spanning all disk) and the FAT12 one are almost surely artifacts.

The issue is understanding which of the other ones are fine, and which should be fixed.

The first "real" partition (the primary NTFS one, starting 0/32/33) might be either correct OR it could derive from the use of some other software (an XP one would start 0/1/1).

Then most probably the Extended partition data is valid, but (due to disk manager messing with sectors before offsets) all volumes in it are now incorrect/wrong.

From what I can see - and as you confirmed by the analysis of the (unnamed) data recovery software - the data should still all be there and the MBR and chain of EPBR should be all recoverable, but there is the need of some manual analysis and fixes.

Although Testdisk -as said - is an exceptionally good software, it automagically detects partition(s) or volumes through an analysis searching/carving and provides results that include false positives but, more than that it doesn't specifies from where the data it retrieves comes from (bootsector, $Boot, $BootMirr, EPBRs, etc.) so it is not easy to separate the wheat from the chaff.

A good thing would be if you could recall as much as you can of what happened to this disk, how many volumes there were, which file system they used, their size (approximate), etc.

My Personal advice would be:

1) make first thing a forensic sound or dd-like image of the whole disk/physicaldrive  ( you will need a clean disk, that since the failed disk is 500 GB will need to be a 750 GB or 1TB one)
2) no, really, you NEED to have this image, it is the only fail (or fool) safe provision you can make
3) run DMDE on this disk and see what it finds (you can use DMDE also to make the image)

DMDE is not an automated tool and needs some understanding of the mechanisms of partition/filesystems, but with some support it can be used by anyone:

https://dmde.com/

having a view of the TEBCFf indicators:

https://dmde.com/manual/partitions.html

would be important to understand what needs to be corrected or recreated.

jaclaz

 

 

Link to comment
Share on other sites

On 10/27/2022 at 1:41 AM, jbclem said:

Astroskipper, thanks for the Testdisk suggestion.  I've been trying it on the Ultimate bootcd and Hirens Bootcd PE.  I'm going to try to attach 7 screen shots from running the Analysis section, could you give me your opinion as to what I should do next...

First of all, a general tip. If you want to ask someone a specific question in this forum, you have to quote or mention that member. Otherwise, the person will not be notified and will not realise that you have asked a question addressed to them. That's how you mention someone, for example me: @AstroSkipper. The fact that I saw you ask me a question is purely coincidental.

Furthermore, your images are relatively useless, except for the fact that they don't bode well. Without any information about your affected hard disk, its original partition structure you want to recover, and the names of these partitions with their OSes installed on it, I can't say anything reasonable. :no: This information is very important. TestDisk might find old, deleted partitions which you don't want to recover, of course. Therefore, you have to decide what is to be restored or not. One thing is crystal clear from your pictures: you do not want to restore partitions marked with a (Deleted).These partitions can't be restored, they are overlapping. In such cases, you have to take a deeper look into them. Actually, you want to find partitions marked with * (bootable), P (Primary), L (Logical) or E (Extended) like in your second picture. That means you should look for an intact partition structure which is really recoverable and corresponds to its last known. BTW, TestDisk is a hell of a tool, but it can also do a lot of damage, especially in the wrong hands.
 ordicolere.gif
Do not write any partition structure on your hard disk if you aren't sure that it is the correct one! The idea of this tool is to find the original, lost partition structure, to check if it is recoverable, and to write it back to the hard disk. I recommended version 6.13 and gave you a download link for it. Have you tried this version first? The versions 7.x didn't work for me. They couldn't recover the lost partition structure on my old hard disk, presumably due to the age and the hardware of my computer. Try TestDisk 6.13, too, and provide more detailed information! The advantage of TestDisk is its easy usage if the partitions are recoverable.

Cheers, AstroSkipper matrix.gif

PS: Spoken for me only, TestDisk was able to recover the lost partition structure of my hard disk in nearly all cases, and that on two different computers. I never had to fix the partition structure manually. In addition, however, I have also created backups of my MBRs in case TestDisk fails.

Edited by AstroSkipper
Update of content
  • Upvote 1
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.


×
×
  • Create New...