jbclem Posted October 22, 2022 Share Posted October 22, 2022 (edited) I was adding a new partition using Disk Management, and seconds into this action the screen went black. When I rebooted the dual boot WinXP sp3 computer it wouldn't go past an error message indicating it couldn't access the boot disk. Eventually I started the computer using a bootcd and ran Disk Management which showed the missing boot partition was still in place but its 113.68 gb was identified as "free space". When I right clicked on the missing partition, the only option was "new logical disk". I was later able to run the analysis part of a file recovery software and it looked like the files/data were still there. How to recover this partition? I've had a hard time running any partition software from inside thie bootcd's minixp, so I'd appreciate some suggestions. I've discovered that others have had a similar problem when using Disk Management, but haven't found a solution yet and I'm hampered by the very old version of Opera (v12) that comes with the bootcd's minixp...it can't access most websites for security reasons. John Edited October 22, 2022 by jbclem Link to comment Share on other sites More sharing options...
AstroSkipper Posted October 22, 2022 Share Posted October 22, 2022 (edited) 10 hours ago, jbclem said: I was adding a new partition using Disk Management, and seconds into this action the screen went black. When I rebooted the dual boot WinXP sp3 computer it wouldn't go past an error message indicating it couldn't access the boot disk. Eventually I started the computer using a bootcd and ran Disk Management which showed the missing boot partition was still in place but its 113.68 gb was identified as "free space". When I right clicked on the missing partition, the only option was "new logical disk". I was later able to run the analysis part of a file recovery software and it looked like the files/data were still there. How to recover this partition? I've had a hard time running any partition software from inside thie bootcd's minixp, so I'd appreciate some suggestions. I've discovered that others have had a similar problem when using Disk Management, but haven't found a solution yet and I'm hampered by the very old version of Opera (v12) that comes with the bootcd's minixp...it can't access most websites for security reasons. John Hello @jbclem! In the past, I had lost the whole partition structure of my hard disk several times. Only one tool was able to recover the lost structure. And the winner is TestDisk. Use the boot disk or boot cd! If Windows XP is your main system, download TestDisk 6.13. It is also part of different rescue CDs like for example UBCD. Cheers, AstroSkipper Edited October 22, 2022 by AstroSkipper Link to comment Share on other sites More sharing options...
AstroSkipper Posted October 22, 2022 Share Posted October 22, 2022 (edited) @jbclem! Here is a downoad link of TestDisk 6.13 Boot CD (German website): https://www.computerbase.de/downloads/systemtools/festplatten/testdisk/ Be careful when usimg that! First read, then act! There is no better solution. This tool is the best of all. If it can't recover your MBR and partition structure, then most probably all is lost. Cheers, AstroSkipper Edited October 22, 2022 by AstroSkipper Link to comment Share on other sites More sharing options...
jaclaz Posted October 22, 2022 Share Posted October 22, 2022 2 hours ago, AstroSkipper said: This tool is the best of all. If it can't recover your MBR and partition structure, then most probably all is lost. Naaah, Testdisk is an extremely useful and usually perfectly working semi-automated tool, but often some manual intervention is needed, very likely it will work in this case, but before calling anything actually lost there is manual repair possible. When (if) something is not recoverable via DMDE (used by a somehow knowledgeable operator) then you might state that "most probably all is lost". jaclaz Link to comment Share on other sites More sharing options...
AstroSkipper Posted October 22, 2022 Share Posted October 22, 2022 (edited) 42 minutes ago, jaclaz said: ..., but before calling anything actually lost there is manual repair possible. A manual repair by editing the MBR is for most users not really a choice. A deeper knowledge would be necessary in such a case, otherwise a user might destroy the structure forever. BTW, most probably means there may still be a chance, but it'll be very unlikely for the "normal user" to recover the lost partitions. If TestDisk can't repair the errors, all is most probably lost for a normal user. Spoken for me, I always could successfully repair my damaged partition structure using TestDisk. And, I had a lot of these booting problems with lost partitions in the past. Kind regards, AstroSkipper Edited October 22, 2022 by AstroSkipper Link to comment Share on other sites More sharing options...
jbclem Posted October 26, 2022 Author Share Posted October 26, 2022 Astroskipper, thanks for the Testdisk suggestion. I've been trying it on the Ultimate bootcd and Hirens Bootcd PE. I'm going to try to attach 7 screen shots from running the Analysis section, could you give me your opinion as to what I should do next... Link to comment Share on other sites More sharing options...
jaclaz Posted October 27, 2022 Share Posted October 27, 2022 That disk has been partitioned or "touched" at some time on a later than XP System, the first (NTFS) partition starting at 0/32/33 (i.e. LBA 2048) is typical of a Vista or later system, on the other hand, somehow a partition starting at 0/1/1 (i.e. LBA 63) was created, spanning all disk, and by using the XP disk manager (there is a known bug) the Extended partition has been "normalized" to the XP standard, breaking the chain of EPBR's, the Extended partition starts on a cylinder boundary (3917/0/1) which is a sign that the original partitioning (at least the creation of the Extended) was made on a XP or earlier system, or anyway respecting cylinder boundaries. It is very possible that originally the disk had a single NTFS volume spanning the whole disk (starting at 0/0/1 and 97676802 in size) and that later it was re-partitoned creating the first Primary partition and the Extended one, and the logical volumes inside the latter. If you look at the 6th (the one before last) screenshot, you have a list of all found partitions/volumes (all marked as D - deleted). Of these, some are false positives, namely the first one (starting at 0/1/1 and spanning all disk) and the FAT12 one are almost surely artifacts. The issue is understanding which of the other ones are fine, and which should be fixed. The first "real" partition (the primary NTFS one, starting 0/32/33) might be either correct OR it could derive from the use of some other software (an XP one would start 0/1/1). Then most probably the Extended partition data is valid, but (due to disk manager messing with sectors before offsets) all volumes in it are now incorrect/wrong. From what I can see - and as you confirmed by the analysis of the (unnamed) data recovery software - the data should still all be there and the MBR and chain of EPBR should be all recoverable, but there is the need of some manual analysis and fixes. Although Testdisk -as said - is an exceptionally good software, it automagically detects partition(s) or volumes through an analysis searching/carving and provides results that include false positives but, more than that it doesn't specifies from where the data it retrieves comes from (bootsector, $Boot, $BootMirr, EPBRs, etc.) so it is not easy to separate the wheat from the chaff. A good thing would be if you could recall as much as you can of what happened to this disk, how many volumes there were, which file system they used, their size (approximate), etc. My Personal advice would be: 1) make first thing a forensic sound or dd-like image of the whole disk/physicaldrive ( you will need a clean disk, that since the failed disk is 500 GB will need to be a 750 GB or 1TB one) 2) no, really, you NEED to have this image, it is the only fail (or fool) safe provision you can make 3) run DMDE on this disk and see what it finds (you can use DMDE also to make the image) DMDE is not an automated tool and needs some understanding of the mechanisms of partition/filesystems, but with some support it can be used by anyone: https://dmde.com/ having a view of the TEBCFf indicators: https://dmde.com/manual/partitions.html would be important to understand what needs to be corrected or recreated. jaclaz Link to comment Share on other sites More sharing options...
AstroSkipper Posted October 27, 2022 Share Posted October 27, 2022 (edited) On 10/27/2022 at 1:41 AM, jbclem said: Astroskipper, thanks for the Testdisk suggestion. I've been trying it on the Ultimate bootcd and Hirens Bootcd PE. I'm going to try to attach 7 screen shots from running the Analysis section, could you give me your opinion as to what I should do next... First of all, a general tip. If you want to ask someone a specific question in this forum, you have to quote or mention that member. Otherwise, the person will not be notified and will not realise that you have asked a question addressed to them. That's how you mention someone, for example me: @AstroSkipper. The fact that I saw you ask me a question is purely coincidental. Furthermore, your images are relatively useless, except for the fact that they don't bode well. Without any information about your affected hard disk, its original partition structure you want to recover, and the names of these partitions with their OSes installed on it, I can't say anything reasonable. This information is very important. TestDisk might find old, deleted partitions which you don't want to recover, of course. Therefore, you have to decide what is to be restored or not. One thing is crystal clear from your pictures: you do not want to restore partitions marked with a D (Deleted).These partitions can't be restored, they are overlapping. In such cases, you have to take a deeper look into them. Actually, you want to find partitions marked with * (bootable), P (Primary), L (Logical) or E (Extended) like in your second picture. That means you should look for an intact partition structure which is really recoverable and corresponds to its last known. BTW, TestDisk is a hell of a tool, but it can also do a lot of damage, especially in the wrong hands. Do not write any partition structure on your hard disk if you aren't sure that it is the correct one! The idea of this tool is to find the original, lost partition structure, to check if it is recoverable, and to write it back to the hard disk. I recommended version 6.13 and gave you a download link for it. Have you tried this version first? The versions 7.x didn't work for me. They couldn't recover the lost partition structure on my old hard disk, presumably due to the age and the hardware of my computer. Try TestDisk 6.13, too, and provide more detailed information! The advantage of TestDisk is its easy usage if the partitions are recoverable. Cheers, AstroSkipper PS: Spoken for me only, TestDisk was able to recover the lost partition structure of my hard disk in nearly all cases, and that on two different computers. I never had to fix the partition structure manually. In addition, however, I have also created backups of my MBRs in case TestDisk fails. Edited October 28, 2022 by AstroSkipper Update of content 1 Link to comment Share on other sites More sharing options...
AstroSkipper Posted October 28, 2022 Share Posted October 28, 2022 @jbclem! Here is the link to an official step-by-step guide of TestDisk: https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step Cheers, AstroSkipper 2 Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now