recovery expert

Shaun:

I can try to help, but first we need some additional information. You can get most of this info by viewing the disk editor in Acronis Disk Director (DD). After opening DD, click on the icon of the disk in question and from the left pane choose Edit. When the editor opens, from the menu bar choose View, and then As Hex.

1. What is the ending sector number on the disk? Scroll to the end of the disk to find the ending sector number.
2. View sector 2048. Do you see any data in this sector? If possible, post a screen shot of this sector.
3. Scroll back to sector zero and from the view menu choose As Partition Table. If possible, post a screen shot of the partition table. Be sure to drag the window border so that all fields are visible in the screen shot.

Thanks Mark,

Attacked are screen shots for all 3 questions
Apologies for the delay. I thought I had email notify on this post, but I guess not

Shaun:

To see the partition table, you need to be at sector 0. Your picture is for sector 1. Could you re-post a view of sector 0?

To view sector 0, first click on the icon of the disk drive in question, and then choose "Edit". One bit of good news - sector 2048 does indeed look like the start of a valid NTFS partition.

the editor only allows you to go to absolute sector 1

Shaun:

You have to first select the entire disk; not a partition. Here's an example:

thanks

Shaun:

Your disk doesn't have a partition table; all of the 64 bytes in the table are zeros. That's why the disk appears as unallocated. I'm surprised that Acronis Recovery Expert could not fix this, although it may have been coded to look for partitions that use the older 63-sector offset partitioning rules. Your disk partitions were created by Vista and use the newer 2048-sector rules.

I just tried a test by deleting a partition and trying to see if Recovery Expert could find it. I used Manual mode and pointed Recovery Expert to the unallocated space where the partition used to be located. It found and recovered the partition in about 3 seconds. In fact, it found an older partition that used to be on the disk a long time ago and gave me the choice of which one to recover. I chose the one that I had just deleted and it was successfully recovered. It's worth another try to see if it will work on your disk. Try manual mode and select the entire disk. If nothing is found within a reasonable amount of time, cancel the operation.

If it doesn't work then we can try manually entering the partition table parameters. From what I have seen so far, there is an NTFS partition starting at sector 2048, so your data is probably still there. You only appear to be missing a partition table; the rest of the boot sector appears normal. If you want to manually enter the parameters for the partition in the partition table, again select Disk 2 and then start the Acronis Disk Editor. Make sure that you are at absolute sector 0 and then change the view to "As Partition Table". Make the following entries (click to enlarge):

When finished, choose "Edit" then "Save Sector". You should now be able to see a partition, but whether the ending sector is correct or not is a question. When calculating the value of "Number of sectors" I assumed that Vista Disk Management would have made this value a multiple of 2048, so that's what I did. This is 47 sectors shy of the end of your disk, so I think it's correct. If not, let me know and we'll fix it by other means. Find out by seeing if Vista now sees the disk, then run chkdsk on it (without automatic repairs) to see if there are any errors found. Post back if there are.

the auto/manual scan on fast/complete did not find this, but the manual edit did.
Thanks Mark!

Shaun:

Glad to hear that. I have checked with a friend who has a Vista-partitioned disk with 2048-sector offset partitions like yours, and he reports the same problem with Acronis Recovery Expert being unable to find deleted partitions. It would appear that Recovery Expert was specifically coded to find cylinder-aligned partitions (ones that are created by pre-Vista tools).

While I'm certain that the values that I gave you for manual entry into the partition table were mostly correct, remember that I had to guess about the "Number of Sectors" entry. If I got this wrong, chkdsk will complain about errors on the disk. So it is very important that you check for errors.

In Windows Explorer, right-click on your external disk drive icon and choose Properties and then Tools. Run a disk check with both options un-checked:

If the disk check finds any errors, please post a screen shot showing its findings. Expand the window to show the detailed report.

Chkdsk found no errors.

Thanks again !

So I thought I'd try some of the skills I learned here on my 2nd drive. This one is a bit more complex as it has a primary/boot partition already. the settings of that one are in the attached.

The 2nd entry is what I'm trying to build.

I got the value for the relative sector of  209346352 by navigating the editor window until I saw some data.  I tried to look for a signature like one at sector 2048 that would indicate it was a NTFS partition but couldn't find one so thought I'd take the shot in the dark.

The last sector of the drive is 976773167 so if I follow the multiple of 2048 idea I came up with 767426815 to bring me to the end.

Although the size calculation seems to be correct, when I try to assign a drive letter to the partition, windows does not like it, and asks that it be formatted.

I can see my data there, so would really like to avoid formatting :p

Shaun:

1. Was the partition that you're trying to recover a primary partition?
2. Was it originally created by Vista or Windows 7?
3. What is the last sector number on this disk?

Making some assumptions here, if the partition was a primary partition then it should start immediately following the first partition, or at (204,810,637 + 2,048) = 204,812,685. If the last sector number was the same as your other disk (976,773,167) and if the partition was created by Vista or Windows 7, then the size of the partition should have been a multiple of 2048 sectors, or (976,773,167 - 204,812,685) = (771,960,482 modulo 2,048) = 376,933. So the size in sectors should be (376,933 * 2048) = 771,958,784. This puts the second partition's end sector at (204,812,685 + 771,958,784) = 976,771,469, which is 1698 sectors away from the end of the disk.

Also, the Cylinder/Head/Sector (CHS) values will overflow on a disk this large, so the second partition should start at CHS = 1023/0/1 and end at CHS = 1023/254/63. If this is all correct then the values for the partition table should be as shown below (click to enlarge):

If Windows still will not see this partition, then its file system may be damaged. Then your best hope is to try file recovery software like GetDataBack. Out of curiosity, what event caused two disks to lose their partition table entries?

Thanks Mark.

Tried those numbers. That was a no go.
Unfortunately, I don't recall if it was a primary. I want to say it was an extended, but am not sure

I have 2 physical drives, this one in question has 1 partition (the boot partition) and the second partition is a data partition.

This drive would have been created by Vista. The last sector of the disk is 976,773,167

What lead to my drive's demise? Me! :(
I had bought 2 1 TB drives and was planning on mirroring them as I was running out of room on these drives. This machine is my media server. So the way I had it set up was two physical drives, where one was acting as the backup to the other. However, I was not doing a complete back up (due to space). So although it was great to recover the data you already helped me with, thee are some pieces still missing.

When I went to install the 2 1TB and raid them, the one prompt, I mis-understood about the partition table being changed in that it changed the original partition table, not the 2 I was thinking it would be raiding.

Lesson learned...

Shaun:

If it was a logical partition then the first sector of the partition (204,812,685) will contain another partition table. This partition table should then link to the partition, which will be 2,048 sectors beyond the start of the extended partition (204,812,685 + 2,048) = 204,814,733. This sector should look like the start of an NTFS partition. The last sector of the partition (976,771,469) should contain a duplicate copy of the first sector of the partition.

If you don't see these telltale signs, then probably the only way out is to use data recovery software. If you do, let me know and we'll try to figure out how to reconstruct the entry for the second partition table.

Thanks Mark. Will give that a try. Won't be able to get to it until next week though

I checked out 204, 812, 685 and its empty.
I also tried going to 209,346,352 - 2048 (since 209,346,352 was the first place I see 'data') and that is also blank.

I also checked 976,771,469 and that is blank

I'm going to try and edit 209,344,304 (209,346,352-2048) and make that the partition table...

thanks not going to work. Looks like I need to 'make up' a ntfs boot sector somewhere, for the second partition. It seems that is the piece I'm missing? Than hopefully I can point the partition table at sector 0 to that...

Shaun:

Look for the telltale pattern of an NTFS partition. If you select View, As Hex in the editor window then the first sector of an NTFS partition created by Vista or Windows 7 should look like the following:

There should also be a duplicate of this sector at the end of the partition (mirror copy). If you find the mirror copy at the end of the partition but no boot sector at the beginning of the partition then perhaps you could copy the mirror copy and paste it at the beginning.

However, at this point it may be best to use file recovery software like GetDataBack.

Getdataback for ntfs works great in my experience... they have an eval version that will let you see your data, and if its intact or not before you buy the software to extract your data to separate drive. Has a better track record than acronis imho...

it did end up finding my data. I'm going to try using the info it found as a last ditch effort with acronis before having to buy another package.