Moving 5 GB from one partition to another destroyed the NTFS file table of the downsized partition
Hallo all,
last week a friend of mine got big trouble with his Notebook when tryíng to move some hard disk space from his data partition (Drive letter E:) to hist Windows system partition (Drive letter C:).
Using Acronis Disk Director 9 Personal Edition (Software Version licenced to abonnents of a German PC magazin) he tried to move 5 GB of Space from Drive E: to Drive C:.
During the process a error message about defect hard drive sectors occured and Disk Director forced the user to reboot the Notebook.
After rebooting Drive C: is available with the same size like before, but Drive E: is vanished. You can see it in Windows disk device management console, but you cannot perform any action on it - even running chkdsk in Explorer only pops up a window for a second and then it vanishes immediately without any notice or error message.
After trying a lot of things .... the only way to get the hard drive data was to create a ddrescue image file from Partion E: with Ubuntu Live Disk and save it onto an external hard drive. After that we deleted drive E: partition completely from the hard disk and created a new one with the original size and restored all data from the backup. Unfortunately the Backup of the Outlook pst file were canceled halfway during the backup, so we have the problem, that the most important (and maybe largest) file is lost by now.
Thinking thats easy: just mount the image file into a Unix system and copy the file. But .. neighter loop/mount nor testdrive find a valid NTFS partion.
The following is the output of testdrive after running the command "Analyse current partition structure and search for lost partitions":
Disk image_sw5.dat - 68 GB / 63 GiB - CHS 8839 240 63
Current partition structure:
Partition Start End Size in sectors
1 * Sys=72 14426 133 11 126992 13 60 1701990410
Bad relative sector.
2 * Sys=74 48217 145 3 84194 184 29 543974724
Bad relative sector.
3 * NetWare 3.11+ 11154 86 41 11154 86 40 0
Bad relative sector.
Only one partition must be bootable
Space conflict between the following two partitions
1 * Sys=72 14426 133 11 126992 13 60 1701990410
Next
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
[Quick Search] [ Backup ]
----------------------
So - now the question ...
It seems, the original location of the NTFS file table ist destroyed. Does anyone have an idea, where Disk Director could have been copied the file table to? Testdrive doesnt find any useful NTFS data and alerts "The following partition can't be recovered:" ... but maybe the NTFS file table is portioned only and could be find part-splitted anywhere? At the end, we only have to find the location of the PST file mentioned above - maybe using a Hex Editor?
Any ideas out there?
Hard- and Software information: the Notebook is a Lenovo Thinkpad T61 mit 80 GB Hard disk space and 2 GB RAM. Installed is Windows XP Pro SP3, Trend Micro virus scanner and MS Office 2003.
Thanks for all : Michael
Hallo bin,
thanks for your reply.
Don't know if it's the right forum here, because the problem partition were overwritten with a completely new created. The idea behind this was to recover the data from "normal" backup space. This should have been successful ... but the Outlook backup file was not complete copied during last backup session and is corrupt now.
So, we only have the ddrescue image: in the meantime a professional data recovery service is asked for recovery from the ddrescue image - if I understand the situation right, they found a lot of Outlook-PST file fragments and just trying to put them together in the right order. Sounds really crazy though.
Maybe someone can give hints about searching for partition table relicts of a downsized partition? Acronis developers should know such things ...
Thx for all help ... Michael
Michael,
This is one of the reasons I tend to avoid the more "automated" features of DD and instead do them manually (usually with Resize). It's also the main reason that it's strongly recommended to create an Entire Disk Image backup before making any partitioning changes (regardless of the actual software used).
I'm sure Acronis knows the process used in the procedure, but I highly doubt that they can provide any recovery help because of the nature of the problem. Data is being moved, the partition structions are being changed, etc. There probably isn't any way to tell exactly what was where at the time of the error.