Would Disk Director really be able to reinstall a partition lost by TI Home 11?
Hi,
I described my problem largely already here:
http://forum.acronis.com/forum/9824
I have WIN XP pro, 1.5 GB RAM, Acronis TI Home 11, S.ATA HD
Fact is that TI Home 11 chipped my 3rd partition when it tried to assemble the SZ to-be-deleted to it.
Now my HD shows a blue disk whenever and wherever (also on other PCs) I try to start it in Windows. The stop error (plug and play/driver problem) is absolutely wrong. The only cause is the disturbed file system which windows is not able to read.
I can only start and read that disk, i.e. the first two partitions, with LINUX.
The most funny thing is: On my very first successful trial to see what was left on the HD, I started my PC from the TI CD. I could see that all the partitions were still there (but the letters had changed!), I could open the folders and subfolders on the 3rd partition and see the files. I could bite my back that I did not save them rightaway from that platform, an action which later was easy performed for C:
The second successful trial was booting from the Ubuntu CD: In Linux the 3rd partition was not visible. I could only save he 2nd to another PC.
I restarted Acronis like before, and the third partition had disappeared, too. Is anybody able to explain that???
I have bought another HD and my computer starts fine, but when I connect my old HD which I assembled already as possible second HD, I get a blue screen instead of a WINDOWS Login (in any mode).
As far as I know, when I boot from my Ubuntu disk, in Linux I can only use TestDisk or Photorec as recovery programs for Win files but they are not very helpful because they cannot restore file names, and they are awfully slow and would need 600 hours to scan the whole disk (because of course the third partition is not there anymore).
I would buy Acronis Disk Director but don't want to throw my money out of my Windows, haha.
What I would like to know is: Could DD solve my problem? Could it reinstall the lost partition? Would my files then be legible again? How much of the program functions could I possibly try by downloading the trial software? I have read the FAQ but I did not find anything about my special problem which is: Could I start DD without starting Windows - because of blue screen you know.
As I had a very big part of my files on the 2nd partition, I don't miss awfully much, but there are two folders with important files which I had uniquely in the archives on my 3rd partition, and as my external HD accidentally crocked just before, my backup is on the fritz. (Yes, I am a lucky dog!)
What do you think?
The problem with the wrong drive letters is not a problem....when booting from environment other than the running windows that was used to run on the particular drive(s) then the drive letters will be set by the running OS to suit it's understanding about which letter belongs to what drive and does not know what drive belongs to what OS resident on your drives(s).
The other problem, which I also found to exist is the Partition numbers assigned to each partition when using a program like Drive Image and True Image. There are four possible partition numbers 1-4 and under normal circumstances, they are assigned at the time of creation of the partition. If the OS is installed to a empty drive that has no other partitions on it then the OS will use partition 1. If you then backup this partition and later restore it to a drive that already has a partition 1 then the new partition becomes partition 2.
What you have to do is go to your Partition Manager and make the Partition 2 bootable (active).
It is far more than the letters problem. It seems that Acronis in full work deleting my SZ has doubled the first two partitions in the partition table and deleted the third. It appears in TEstDisk as not allocated. I fear that Acronis has deleted my files as well!!!
Can you post a screenshot of what Disk Management shows for the drive? If you can't, please post what TestDisk shows. If you have the DD trial version, please also post what it shows (in Manual Mode).
When you say doubled the first two partitions, I assume you mean that there are two shown for each partition (one allocated and one unallocated). Is that correct? If so, the partitions are not doubled in the partition table, it's just that the program you're using has problems with "mixed" Primary and Logical partitions (DD should show it correctly).
Was the SZ a Logical partition? Were the other three partitions Primary?
Hi MudCrab,
I am very glad that you want to help me; I have read much of kudos to you. ;-)
My stubborn WINDOWS does not allow me to run DISK Management with the bad HD connected, because Windows has decided that this is a bluescreen-HD.
When I boot from an Ubuntu CD, it says: Local drive (which was C:\): 20 GB, Volume 97 GB (which was E:\, which I can still read and copy), then 103 GB twice. The navigator shows the same Linux OS files on both of them. (I had Linux installed originally as parallel system but then found out that I could not run my most important programs on Linux, so I dropped but never uninstalled it. Though, I can't get to the linux system by booting because I had skipped that OS choose screen. And in the end, Ubuntu presents the biggest joke: It says "18446743971 GB free". WOW! I did not know I had such a big HD!!! The other 103 GB would be my former M:\ which I lost and which was apparently placed on the same space as linux.
I have taken photos from testdisk and join them. I did not try that before in this forum but I hope it will work.
The upper line in the DD screen shows my new HD, you can forget that one.
DD shows the partitions as if they still did exist, the space conflict between the linux and the ntfs partition also makes two out of one partition, but at least DD makes a difference between primary and logical partition. I hope that the "90.06 GB Free space" must not be taken too seriously as far as disaster recovery is concerned, because the last indication of free space on that disk was around 15% as far as I recall.
The SZ hat no partition letter as far as I remember, and it was surely not primary, because I took it from the E: space and that was a logical partition.
So, what do you think? Would the lost files reappear as soon as the partition could be recovered? Or would I need another program to read out the sectors and rebuild tattered and torn pieces??
The first thing I would like to arrange is to be able to boot Windows again with that mad HD connected. If one could deactivate the primary partitions and call them logical - would that be possible and would it help?
Anyway, before I write anything on that disk I will make a complete image of it - only that my extern disk is not free before tomorrow evening.
Besides, the MBR was okay. I used the Acronis boot after the big bang and made an image of C including the MBR and migrated it to my new HD and everything worked instantly fine, with no problem at all. I am very glad that at least I did not have to reinstall and recustomize again all the stuff I just had installed one week ago because of my OS upgrade. I would be still more glad if I could recover some folders which I miss.
Thank you for your attention.
Marieluise
Deleted because it was displayed twice
When you make the backup image, you'll need to do a sector-by-sector backup and inlcude the entire drive (it will be very large image). Note that you may not be able to get a successful backup image since the partitions overlap. In that case, you would need to do sector-by-sector images of each partition (or at least the last two if all the ones at the start of the drive are okay).
If I understand what happened, the drive started out like this:
[C: NTFS Primary 19.53GB][20GB Unallocated][D: NTFS Logical 97.65GB][E: NTFS Logical ??GB][SZ Logical ??GB]
The total size of E: and the SZ was 95.69GB (or close to it).
Is this correct?
You wanted to delete the SZ and add the space to the E: partition. TI failed part way through the procedure and left you with the partitions displayed in your screenshot.
You said the original E: parition was Logical, so, if it were me, I would remove the "duplicate" Primary partition (the 95.69GB Primary located just prior to the 95.69GB Logical) and change the Logical partition type to NTFS and see if it could then be read. Again, if I'm understanding this correctly, the corrupted partition was NTFS and not Ext3. DD shows that the partition is set as Ext3, but is actually NTFS so I think that's right.
To remove the "duplicate" Primary partition, you would just need to set its partition type to 0 (zero) in the partition table and save the sector. Next, you would need to change the partition type for the Logical partition from Ext3 to NTFS (0x7) and save that sector.
Instructions can be provided to try this, but you would need to have the purchased version of DD to allow saving the changes since you can't use DD in Windows and have to do it from the CD. Also, I would like to know for sure if I have the setup right before proceeding.
Another option would be to use DD to delete (don't wipe) the last two partitions and then see if the Recovery Expert could find the original partition or the "combined" partition. The problem is, it's likely only one of them has a chance of being correct and which one depends on where the "combine" operation failed.
In that case, you would need to do sector-by-sector images of each partition (or at least the last two if all the ones at the start of the drive are okay).
The sector-by-sector method is evident. Indeed, the first two partitions are okay, the SZ was on the run to be deleted anyway and it has indeed been deleted before the disaster began.
But how can I get an image of a single partition which does not appear in TI Home? Is DD able to make partition images?
Or - if I write a whole HD TI Home sector-to-sector image on my extern disk - would that cover everything, the "invisible" partitions as well? In this case, I would do that, no matter how long it takes (I suppose appr. 8 h).
If I understand what happened, the drive started out like this:
[C: NTFS Primary 19.53GB][20GB Unallocated][D: NTFS Logical 97.65GB][E: NTFS Logical ??GB][SZ Logical ??GB]
The total size of E: and the SZ was 95.69GB (or close to it).
Is this correct?
Not quite:
[C: NTFS Primary 19.53GB][20GB Unallocated][D: CD-writer][E: NTFS Logical ??GB][M: NTFS Logical 103GB][SZ Logical ??GB], when it was still a sound HD. If the SZ had been taken from E: or M: I am not so VERY sure, but as M: always had around 100 GB and the two parallel last partitions in DD now have about the same space, and as I was surprised that E: should have 100 too, because I had thought of something around 50, I suppose that the SZ had been something like 50 GB taken from E:
But that would mean that the deleted SZ space has been added to E: because E: is bigger now!
You wanted to delete the SZ and add the space to the E: partition. TI failed part way through the procedure and left you with the partitions displayed in your screenshot.
No, i wanted to add the space to C:. But the programm said "C blocked" and went on writing and I thought it wanted to add the space to M: which was the last partition on the HD. And it left me with a blue screen and a 000000CA stop code which is nonsense.
You said the original E: parition was Logical, so, if it were me, I would remove the "duplicate" Primary partition (the 95.69GB Primary located just prior to the 95.69GB Logical) and change the Logical partition type to NTFS and see if it could then be read. Again, if I'm understanding this correctly, the corrupted partition was NTFS and not Ext3.
DD shows that the partition is set as Ext3, but is actually NTFS so I think that's right.
Absolutely! I never even knew what ext3 is!
To remove the "duplicate" Primary partition, you would just need to set its partition type to 0 (zero) in the partition table and save the sector. Next, you would need to change the partition type for the Logical partition from Ext3 to NTFS (0x7) and save that sector.
Hmm, I like that, it is what I supposed by intuition.
Instructions can be provided to try this, but you would need to have the purchased version of DD to allow saving the changes since you can't use DD in Windows and have to do it from the CD. Also, I would like to know for sure if I have the setup right before proceeding.
If you are sure that it would make reappear my partition with its folders and files (I did not write anything on that HD since the first blue screen), I would gladly buy DD. (When I upgraded my system recently I had to spent a lot more money for a EFS data recovery program because all files which had been stored in "my documents" were encrypted, a folly which I committed so long ago that I was completely surprised to learn about the encryption. But that program worked so fine and fast - the money has not been wasted! I got back 30000 files but one single stubborn which would not accept defeat.)
Which setup do you exactly mean? And I do prefer to follow a very clear step-by-step instruction for that procedure.
Another option would be to use DD to delete (don't wipe) the last two partitions and then see if the Recovery Expert could find the original partition or the "combined" partition. The problem is, it's likely only one of them has a chance of being correct and which one depends on where the "combine" operation failed.
Yes I had that idea too in a desperate moment, but uh, I prefer the first option!
Can you post a couple more screenshots? The partition table entries and the Logical partitions as shown by DD would be helpful.
- Boot to DD from the CD (select Manual Mode).
- Right-click on the Disk # (not on a partition) and select Advanced >> Edit from the pop-up menu.
- The Disk Editor should start and show Sector 0.
- In the View menu, select As Partition Table. Resize the Disk Editor window (if necessary) so the entire partition table shows on the screen. (The partition table is located at the bottom of the window.)
- Take a screenshot of this window (this is the partition table in the MBR [Sector 0]).
- Next, click the Enter button to the left of the Extended partition. (The Extended partition will show type 05h and Extended in the Partition Type box.) This will move the editor to that sector and display a new partition table.
- Take another screenshot of the new partition table. Note that this table will link to the next Logical partition (showing as 05h and Extended as the second entry). Click the Enter button on the Extended entry to go to the next Logical partition. Take another screenshot. Since you only have two Logical partitions showing, this partition table should show 00h and Unused in the second entry of the table (it's the end of the "chain").
Below is an example of what the partition table looks like. In this example, the second entry is the Extended partition entry.
Hi MudCrab,
as I have to boot DD from CD, I cannot influence the screen so that the resolution is too small and I had to take two photos for each PT and stitch them together.
As you will see, the third PT is not as you described for it shows 00 and unused not in the second but in its first entry.
Meanwhile, I have created a clone of my mad HD and can experiment with it. It is on a USB HD and mad like its mother: When I connect it, the screen turns blue and shows the same error code. I suppose that this is important because the crash seems not to be only a booting problem but also appears while windows is working (like in the first place when IT Home created the disaster).
And here is something else which I forgot to mention: When I boot from Ubuntu CD or TRK with TestDisk, I can look into both parallel partitions, and BOTH of them show the Linux system folders. I find that strange.
Shouldn't I set both primary partitions on that mad HD (from now on I always mean to try it on the clone, of course) to zero? As I would not boot from that HD any more but only use it as slave, it would not harm, would it?
Thanks
Marieluise
Well, I made a hazardous trial: I just deleted all the partitions (without wiping, of course). And I had to stop TestDisk when it had found 138000 deleted files already because I would never be able to find out which are the ones I need. I am now searching for a program that will recover only selected files with their own names, if not with their folders. I think as far as DD is concerned, my problem has been solved. I hope I can find the files I need, but that is now another question. Thank you so much for your help!
Marieluise
Why did you delete all the partitions? Did you try just deleting the last two (the Primary and Logical that use the same space)? There's no point in recovering files that aren't needed. If you undeleted the partitions before those, you shouldn't need to reclone.
Since the "Ext3" partitions are using the same space on the drive, it's normal for them to show the same contents. However, since Ubuntu is reading the Linux files and folders from them, neither seems to be correct for the NTFS partition.
With the partitions deleted, do any NTFS partitions show up in the last half of the drive if you run the DD Recovery Expert? Try a Fast scan first, then a Complete scan if it's not found.
When you created the clone, did you have it copy every sector (used or not)? A "used space" type clone wouldn't do much good.
Does TestDisk report any different "deleted" partitions than before?
I deleted all partitions because I wanted to make sure that the wrong PT which I supposed on the first partition wouldnt disturb anymore.
But you are right: PhotoRec has been searching for 12 hours now, is half through with the reading (though I search only for doc, pdf, psd and jpg!), and has found 38.000 useless files till now, some of them deleted ages ago, but not a single one from the third partition. I hope they are to-be-found yet.
As I did not run PhotoRec entirely before (I had to run it from CD, which was awfully slow) I have no comparison if it finds more files now than before.
I tried to make the clone with Acronis TI Home pre-system from CD, but it got stuck twice (remained in the last quarter on 29 resp. 31 minutes left and showed no difference in the blue marked progress for at least half an hour), so I skipped that and tried it with EASEUS DiskCopy which worked fine. But none of them asked me if I wanted the sector-by-sector-mode used or unused. I thought a clone would ALWAYS read every little sector no matter if used or unused??? Isn't that the most important difference from an image?
As to your question: In the DD Recovery Expert, the clone disk only shows a small green part at the beginning, and then a long blue part. DD says it is "no partition 0x6 (FAT 16)". But that is not quite right. Windows calls it a partition, system RAW.
I had to create (in the Windows Volume Manager or what that is called in English) a new all-in-one-partition with one logical drive, otherwise the Explorer and most of the recovering programs could not recognize the HD at all. But as I did of course not format the disk, the system is now RAW. Maybe that is the reason why Word cannot open any saved doc-file; in an editor you can see that they are all shreddered. Word asks for a wpc-converter which apparently does not exist on the install CD.
By the way, the EASUS DRW displays at the moment as shown in the jpg attached: thousands of NTFS files.
Now I have started EASEUS DRW to read the clone; it is much faster and doesn't waste such a lot of space and time by writing all the unneeded nonsense on my inbuilt HD. It will show me a files system at the end and I will be able to see if my desired folders are recoverable, and can decide then if I buy the full version.
Maybe I have tried a wrong way altogether. But the mad HD is still untouched. With a new clone I could try to commit another error ;-)
At least, I have not been needing any other amusement for weeks ...
If this action fails, I will tell you.
P.S. I cannot see how I could manage to influence the scan mode in the DD Recovery wizard. There is no possibility as far as I can see. But I just found out that when you use the DD Suite, you can change the partition type. Would it be useful to change it back to NTFS??? Would it perhaps bluescreen again?
Ah - no, forget it, with the DEMO mode I could not change that, I forgot.
Well, it's me again. My trial did not succeed: The lost data from the 3rd partition keep hidden from PhotoRec as well as from EASEUS DRW.
Next step would be to recover the lost partition, but that cannot be done with the Demo Version. As I said, I would buy the full version.
But are you SURE the lost data will emerge with it? Can I check that before eventually buying the full version? I did not write anything on the disk after the Disaster, I had no virus and did rather often defragmenting. It is only the question if the crash could have wiped out my data completely. As the director suite does not recover the data (as I understand it), I would have to buy this and an additional software for the data. I.E. I would buy an expensive hammer before I know if I could get the nails.
No, I'm not 100% sure that DD will be able to recover the partitions. Partition recovery and data recovery is more of a "try and see" type of situtation, in my opinion. I've seen it both ways (good and bad).
As far as I know, the demo version should be able to scan the drive for the partitions. It just won't let you do the recovery.
The EASEUS DiskCopy copy (clone) of the drive should be okay (the type of copy it does is a 1:1, sector by sector copy). If you have any doubts, you could do the Disk Copy again. Make sure to keep the source drive safe (don't copy the wrong way and overwrite it).
If DD is showing the partitions incorrectly on the cloned/copied drive, delete the partition(s), commit the change, and then proceed with the Recovery Expert. DD will only scan unallocated space so the area being scanned can't have a partition on it.
If you reclone/recopy the drive, DD should see it exactly as the original (as shown in Post #5). In this case, use DD to delete all but the first two partitions so it can scan the correct unallocated area.
In regards to what DD's Recovery Expert can find, can you try the following:
- Boot to the DD CD. Select Manual Mode.
- Start the Recovery Expert (Tools >> Recover Partitions). Click Next.
- Select Manual as the Recovery Mode and click Next.
- Click on the unallocated space to select it. If you still have the drive with all partitions deleted, it should all be unallocated. Once selected, the unallocated space will be displayed with a red line under it. Click Next.
- Select Fast for the Searching Method and click Next.
- DD will scan the selected unallocated space and display any found partitions.
At this point, look at the list of partitions and try to determine if any of them are the ones you're trying to find. DD should definately find the first two partitions. It may also find the others. If it only finds the first two, recover them and then go back and do a Complete scan (select Complete in Step 5) on the remaining unallocated space (this will be faster since it doesn't need to search the spaced used the the first two partitions). Note that the Complete scan will take a very, very long time.
If the Recovery Expert finds the partition you want, you can try recovering it and then seeing if you can get any data off of it. I would suggest using recovery methods outside of Windows to avoid Windows writing anything to the drive. For example, boot Ubuntu and try browsing the recovered partition.
In case any of the found partitions overlap, you will only be able to restore one of them. If this happens, try one and then try the other one.
As for buying DD, you may want to contact Acronis Support (via Live Chat) or sending a PM to one of the moderators and tell them what happened (give them a link to this thread). They may be able to give you an unlocked copy of DD to attempt the recovery (especially since it was TI that caused the problem). Note that if DD can't find the deleted partitions, then having the unlocked version won't help in that regard.
Hi,
as it had been necessary to create a new partition and a logical volume so that the HD could be detected by the recovery software, I had no unallocated space anymore. So I repeated the cloning - no worry - always in the good direction - :-) and tried around with TestDisk.
It said that the boot sector was bad and the boot sector backup was good, so I copied the backup onto the bad sector. After that, I should have tried to boot to Windows and have a look at the partitions but I overdid it and tried to change the volume types rightaway in TestDisk.
That was some sort of overestimation - it ended in some confusion and I could still not detect any data on the last quarter of the disk. So, I am producing the third clone and can go on testing in the afternoon.
Well, this means I start again from scratch, i.e. from a fresh clone. Would that change your suggestions a bit?
As Testdisk insists all the time that the boot sector would be bad, I begin to believe that. My opinion is that TI broke down in the very moment when it tried to write the new PT by overwriting the old one.
Do you think it was a good idea to write the good backup over the bad boot sector? I could repeat that and try to boot and if that works, do the rest inside Windows which might allow to use a free and non-dangerous PM program like Atola Find and mount or KDE which are very much praised. As you might know, the Live Chat is inaccessible for owners of such Grandpa software like TI Home 11, and while I wait for possible answers to my PMs, I could try something else. As no moderator has yet showed up in this thread although I expressed it clearly enough that TI was the bad guy in that case, I fear that they do not have much to add to your wisdom or are simply not interested.
Well, this is a catch-22. If I delete partitions in DD, I would have to save my entries first. If not, the recovery wizard shows me quicker out than in because, of course, it cannot find any deleted partition. And, as I can't save ...
There is no reliable and easy to use free partition manager which would work from CD. (KDE tells me that my clone has no partition table and basta.)
That is, I would have to boot in Windows. But I cannot connect my mad clone to windows without provoking a blue screen. This is why I had deleted all the partitions. Before I do that to my fresh clone again, I will ask the moderator whoever that is, and if I get no answer, I try again with TestDisk. In its Wiki, I have found a step-by-step example which is very similar to my case.
In another thread I have read that you could find the beginning of a new partition by examining the space in view/Hex. But that is either not availbale in the CD boot mode.
I start to believe that TI Home is good for nice disasters which aren't if you have always done your backup duties. Real disasters, such as caused by the software itself, cannot be helped but by spending money for pigs in pokes and buying lots of hankies. Since the crash occurred, I have spent at least 70 hours on that cursed recovery.
I just discovered another possibility: I'll try the 11 Beta version, a thing that I never do (normally, but this case is not normal anymore).
It is at least a full version with all features (I hope!!!) and can't make the things worse than they are.
Yes, the DD 11 beta may work for you. It's worth a try (it lacks some of main features of DD 10, like the Disk Editor).
I would start with a clean clone, don't fix anything, and then just delete the last two partitions. It's most likely that it's those last two that use the same space on the drive that are causing the problem with Windows. Once those are deleted, the space will be unallocated and you should be able to boot into Windows and access the drive. Being in Windows will help because you'll have access to a lot more tools.
The devil is against me. The Media Builder of DD11 is rather a Media Builder Promise (which is not held) than a tool.
I have posted it in the Beta forum and waiiiiiiiiiiiiiiiiiiiiiiiiiit again.
message removed for TOU violation
On top of it, TI Home doesn't find its backups anymore when DD11 is installed!!!
Please post any DD11 related content in the DD11 Beta Forum.
I give it up. This issue wastes away my time and energy, so I have contacted professional Data Recovery Services. Thank you very much, MudCrab. I really estimate your support, but the moderators seem to be more interested in house rules than in issues. I am very disappointed by Acronis and think I won't buy anything of them anymore. If a backup and restore software destroys the system, it is like setting a fox to keep the geese.
You can close this thread, if you like.