SOLVED: Resized partitions with DD10, now one of them is hosed
My laptop has a 100GB (really 93) hard drive. It was partitioned as follows:
C: 20GB
D: 73GB
I was planning to upgrade it to Vista Ultimate x64 (currently XP MCE) so I ran the Vista Upgrade Advisor. The biggest issue it complained about was the size of my C: drive. So I booted up with a CD of Acronis Disk Director 10, and did these steps:
- Resized D: from 73GB to 55
- Created a partition of the empty 18GB inbetween C and D
- Expanded C: to use the 18GB
After this was done, I ended up with the following:
C: 38GB
D: 15MB
E: 55GB
I booted into XP and saw the same thing. So I opened Disk Management and tried to delete D: and ended up with the attached screenshot.
What do I need to do to recover my data - what are the steps, and the tools? I want to use the best possible idea to recover the files, which I can move to an external if need be, or is there a way to recover the partition structure without destroying my data? I have not written any data to what was the D: partition(s)
Did you make an image of the disk prior to partition resizing?
When you booted into XP and you had the drive letters C,D,E: - was there data showing the D: partition at that time?
Something very strange seems to have happened to your partition record as your drive is now being reported as over a terabyte in size.
My first inclination would be to make a complete disk image to another drive if possible. I'm not sure though what will happen to the misreported drive size.
You could try assigning a drive letter to this partition in Windows Disk Manager and see if data is there, in order for TI W9 to make an image, or you could make a sector by sector image, again I'm not sure how W9 will cope with misreported sectors. In other words I'm not sure if it will just image the drive, or get confused with sectors that aren't actually there.
Mudcrab or K0lo might have better suggestions on this.
Gor the record, you should leave out the extra partitioning step, the one that created the between C & D in your list above. This should have been left as unallocated space, then the C: partition extended to fill it.
Did you try this from Windows or from the rescue CD?
Afraid I did not make an image (nor any backup) first :(
When I did boot back into XP the E partition showed all of my data present and intact.
I did notice as I went along that I could have simply expanded my C: into a select amount of free space on my D: thus eliminating a step or two.
I did this from a DD10 CD.
sm8000:
Is this a correct description of your current disk status?
1. When you boot to XP (on the first primary partition), XP Disk Management shows what is in the screen shot attached to your first post.
2. Booting into XP shows an E: drive that you can browse, and all of your files are there.
If that's an accurate description then only your partition table is messed up. Perhaps the easiest way to recover is to copy all of the data on the E: partition to an external USB disk. Once the data is safely copied, do the following:
1. Boot to the DD10 CD again and delete all of the partitions except the first one that contains XP.
2. Commit this operation, leaving uncommitted space following your XP partition.
3. Resize the XP partition to the desired size.
4. Create a new primary partition in the uncommitted space.
5. Commit this operation and reboot into Windows XP.
6. For the new disk, right-click on it in Windows Explorer and let XP format the disk, and give it a label (name).
7. Use Disk Management console to select the desired drive letter for the partition.
8. Attach your external USB disk and copy the data back onto the new partition.
These are extra steps beyond what you'd normally do, but it's less risk to your data at this point.
Hi K0LO, thanks for responding. Of your #1 and #2 scenarios, #1 is correct. I have not assigned a drive letter to the non-C: partition so #2 does not apply.
My current status is what the screenshot shows. Based on that, how should I proceed? Will assigning a drive letter be detrimental to data recovery?
What did you mean in your reply #3 when you said "When I did boot back into XP the E partition showed all of my data present and intact."?
I meant that I had my resized C:, a 15MB D:, and a 55GB E: with all my stuff.
I then deleted the D: and this immediately resulted in the screenshot posted.
I believe the D: and E: were the same logical drive, so when I tried to delete D: I did more damage than expected.
sm:
OK - I jumped to the wrong conclusion when reading your reply #3. It's getting late here, but my first suggestion is to make a backup of the disk in its current condition using your boot disk of Acronis True Image Workstation 9. A backup is necessary because some of the attemps at recovery may do further damage. Once you have the backup, we can go from there.
I booted up with my TIW9 CD and saw that it failed to read several sectors, many of them repeated and the last few in backwards order. I also saw that the backup would only back up my C: and that oddball 3.443 GB partition, that got created after I deleted D:, since it would take 3 hours I decided to wait until I go to bed and let it run overnight.
I then booted into my DD10 CD and took a look at the partition recovery, this is what it showed me:
Disk 1:
_____..........-..........Size..........-..........Type
None............-......3.443GB.......-.......0x37(???.....)
NTFS (C:).....-.......38.14GB......-.........NTFS
Unallocated..-......15.69MB......-........Unallocated
Unallocated..-........55GB.........-........Unallocated
Its partition recovery function is there for us, but in any case I will make that backup at bedtime, and come back to this tomorrow with fresh eyes and mind. No rush, and thanks again for walking me through this. Looking forward to the next step.
sm8000,
The reason TI W9 can't see the partition is because it doesn't have a drive letter at this moment.
As things stand you'd need to perform a sector by sector image, which will result in an image the size of your hard drive.
Mark may have a different view, but I think so long as you haven't physically deleted partitions, then assigning a drive letter to the 55GB partition, will allow you to view it in Windows Explorer and see if your data is still there. Just don't (for the moment) try to save, delete or use any files you may see. Just browse to see what there is.
If your data appears to be complete - then we can go forward.
What do you reckon Mark?
Colin:
I don't think it's as simple as assigning a drive letter since Windows doesn't see the partition correctly (see the screen shot attached to the first post).
sm8000:
Using the "Recovery Wizard" was where I was heading. I have a pretty high confidence that it will work since I think the root cause is that XP Disk Management messed up the partition table but not the actual contents of the partitions. My confidence is increased after seeing your report in reply #10 - it looks like Recovery Wizard has correctly identified the 55 GB partition.
But get that backup made first if possible. If you have a spare disk, the preferred forensic recovery technique is to make an image of the "hosed" disk and restore it as-is to a spare disk, then do all recovery attempts on the spare disk.
I got a sector-by-sector clone made to an external 120 I had lying around. Aside from the same handful of sectors it couldn't read, the operation finished successfully. I have to head out the door for work now, but I look forward to following up on this tonight. Here's a screenshot of what diskmgmt looks like now:
That looks encouraging. I would first try to let Recovery Expert re-create the 55 GB partition on the second (spare 120 GB) disk. If you get the choice, recover it as a primary partition. Then try booting into Windows XP on the first disk and it should assign a drive letter to the new partition. If it works, check to see if all of your data is intact.
If this goes well then you can remove the spare disk which will contain a backup copy of your data.
Try Recovery Expert on the main disk while booted to the DD10 CD. At this point if it succeeds you can finish repartitioning and be done. If it fails you can always delete everything but the main OS partition and start over. The steps outlined in my reply #4 should work, finishing by copying the data from the spare disk to the new data partition.
Posting from my Blackberry. DD10 CD couldn't find recoverable partitions on the spare disk, and on the source could only find the 15MB D:, after a couple of reboots the spare disk was mostly (or wholly?) unallocated space. I have reimaged and and am running a complete scan of the spare disk for anything recoverable.
sm8000:
The Recovery Expert works best when searching unallocated space. On the spare disk, use DD10 to delete all of the partitions except the first one that contains WinXP then try Recovery Expert again.
No good, I'm afraid - after I reimaged the 120, I deleted all partitions except C: so the remainder was unallocated space. Recovery Wizard could not find any deleted partitions.
sm8000:
I was hoping that the clone operation would have copied the source disk EXACTLY, including the partition table errors. Evidently it must have tried re-creating new entries. While I suspect that Recovery Expert will work on your source disk, given the result you show in reply #10, I tend to be a little hesitant to just jump in and try it since you don't have a recoverable backup on the spare disk. File recovery software will probably work on the spare, so it's a choice of last resort at this point.
I have another idea. I'd like to see the partition tables on each disk to see if they reveal any additional clues. Can you post screen shots? To do this, boot to Windows XP and start DD 10. Right-click on the graphic symbol of each disk and choose "Advanced" and then "Edit" as shown below:
Change the view menu to "As partition table" and then drag the window borders until all of the fields in the table are visible as shown below:
On your reply #10, was Recovery Expert running from the Windows version of DD 10?
Any time I've run DD10 it's always been from CD. I will post those screenshots tonight after work. Thanks again!
I only have the CD of DD10, no Windows install so you'll have to settle for phonecam pics:
Disk 1:
http://www.pictars.com/users/sm8000/disk1a.jpg
http://www.pictars.com/users/sm8000/disk1b.jpg
Disk 2:
http://www.pictars.com/users/sm8000/disk2a.jpg
http://www.pictars.com/users/sm8000/disk2b.jpg
Let me know if I missed anything.
sm8000:
Thank you for posting the screen shots. Could you add another set? When viewing the partition table on each disk, click on the "Enter" button that is to the left of the Extended Partition.
This will open another view of the extended partition container. Please post screen shots of those also.
From looking at the screen shots that you posted, Disk 1 has the extended partition container starting where you would expect it to be (immediately following the first partition). Disk 2 looks incorrect at first glance.
Hopefully I got these in the right order:
Disk 1:
http://www.pictars.com/users/sm8000/disk1c.jpg
http://www.pictars.com/users/sm8000/disk1d.jpg
Disk 2:
http://www.pictars.com/users/sm8000/disk2c.jpg
http://www.pictars.com/users/sm8000/disk2d.jpg
sm8000:
Both of these partition tables are really messed up, but I think that Recovery Expert should be able to sort them out. How about trying this as an experiment on your Disk #2.
View the partition table on this disk again. Note that it has an entry in the second "slot" of the table for an extended partition, Type 05 Extended. Using the drop-down box, change the Type to "Unused". Click anywhere else on the table and then save the sector using the Edit menu.
The graphic should now show the first partition (XP) and the rest of the disk as Unallocated. Now try running Recovery Expert again to see if it can find the 55 GB data partition.
Gave that a shot, still no luck. Re-cloned the spare disk again.
I've been simulating your situation in a VM and have not been able to duplicate the error that you encountered. I first created one primary and an extended partition container and then created two logical partitions in the extended partition. To try to duplicate the error you saw I then deleted the first logical partition using XP Disk Management console. When you do this with Disk Management it will delete only the logical partition, leaving the extended partition container in its original location. However, each time that I did this the operation completed successfully and the pictorial view of XP Disk Management looked correct. DD 10 also looked correct.
But in studying the partition table screen shots I do see an error on Disk 1 (Disk 0 in XP Disk Management). If you view the main partition table in sector 0, and then click on the the Enter button to view the partition table for the Extended Partition Container, the value Relative Sectors must be incorrect. I come to this conclusion based on the fact that XP Disk Management will always create partitions that start and end on multiples of 63 sectors, and have a size that is a multiple of 63 sectors. The value 32136 for "Relative Sectors" is inconsistent with this rule. Therefore it is probably pointing to the wrong sector.
Using the values in the partition table, the Extended Partition starts at sector 79,987,635. Your former Data partition should then start at sector (79,987,635 + 32136 + 63) = 80,019,834. Note that this number is not an integer multiple of 63, so I suspect that the Data partition starts at, perhaps, sector 80,019,828 or somewhere in the vicinity.
To find out can you search around this area for the telltale signs of an NTFS partition? If you start DD10's Disk Editor and choose As Hex from the View Menu, then on the Search menu choose Go To. Enter a starting sector of 80,019,000. Then scroll down until you see a sector that looks like the following one:
Write down the sector number listed at the bottom left corner of the window. Continue looking around plus or minus a few hundred sectors to see if there are others. If you find any, post their sector numbers in your next message.
Since Recovery Expert was unable to do this automatically, perhaps we can figure it out manually. Fixing would then consist of manually correcting the entries in the partition tables using the Disk Editor. This is a reversible process if you record the values before making a change, since you can always go change them back to what they are currently.
Wow! Sounds like fun. I will give this a shot, but as Thursday is my busy night I probably won't be able to until Friday evening. Thanks again and stay tuned :)
The two sector numbers in that ballpark, starting from 80,019,000, are:
80,019,764
80,019,834
Both are ÙRÉNTFS (EB 52 90 4E 54 46 53). I'm curious as to how many times this sequence occurs on the disk - maybe more than it ought to?
EDIT: I checked and wrote them all down, 28 times. Some don't occur on line 0000: or if they do, not all begin in that line's first column.
EDIT: And I just noticed that 80,019,764 is a multiple of 63, according to the calculator on my Blackberry, however Windows' calc.exe insists that 80,019,765 is and not 764. WTF?
sm8000:
Sorry for the delay - I had to go to Baltimore today and just got back home.
Yes, the sequence (EB 52 90 4E 54 46 53) will occur in many locations on the disk, but the potential candidates for the beginning sector of an NTFS partition are only those locations where the bytes start at the beginning of a sector on line 0000, and where the rest of the sector looks like the screen shot in reply #25 with the boot code and the boot error messages "NTLDR is missing, NTLDR is compressed, etc....".
Sector 80,019,834 is the one that is currently referenced by the partition table so that's apparently not the one. Let's go on the assumption that the partition is really located at sector 80,019,764. As you've noted, this isn't a multiple of 63 (the Blackberry must not have enough digits of precision so it rounds off). So if this is the correct sector it is offset by 64 sectors from the reference in the partition table instead of being offset by 63 sectors. That may have happened when you resized the partition with DD - I've found that it sometimes chooses 64-sector offset for some unknown reason. As long as the partition table points to the correct sector the partition will work, but you may run into problems if you use another partition management program, like Windows Disk Management, which will assume 63-sector offset. This may be the root cause of the problem you experienced when deleting the small logical partition with Disk Management.
Let's try this. If the start of the logical partition is offset 64 sectors from the entry in the partition table, then the value Relative Sectors needs to be (80,019,764 - 64 - 79,987,635), or 32,065. If this assumption is incorrect and the offset is supposed to be 63 sectors, then Relative Sectors needs to be 32,066.
There's no harm trying both, right? Start DD10, view the partition table (for the first disk) in sector 0, click on the "Enter" button to go to the Extended partition at sector 79,987,635 and view the extended partition table. This view should correspond to your file "Disk1d.jpg" in reply #22. Change the value of Relative Sectors from 32,136 to 32,065 and save the sector. Reboot to Windows and see if your Data partition shows up. If not, repeat but change Relative Sectors to 32,066. If neither works, change it back to the original value.
Let me know if this makes the partition visible again.
Per your directions, I right-clicked on the 15MB partition, chose Edit and saw the Relative Sectors set at 32136. I changed it to 32066 first, booted into XP, and saw my C: as usual and the remainder as free/unallocated space. Same thing when I tried 32065. Going back to 32136 for now.
Unbelievable!
On a hunch, I changed the Relative Sectors value to 32130. Back into XP and I've got my C: as usual, my D: restored, and a 16MB piece of free space in between.
I think I'm going to back up my stuff now, then delete the D: and the 16MB free space, then make a new partition. After I upgrade to Vista :)
Thanks again for all your help!
Excellent! I wouldn't have expected 32,130 to work since it would be pointing to (79,987,635 + 32,130 = 80,019,765), which is 1 sector past where we thought the NTFS partition started. But I can't argue with success.
You have the right idea. I would highly recommend deleting all of the partitions (other than C:) on your disk after you remove the files from the data partition. I wouldn't trust that the partition table entries have been made correctly. You're much better off deleting everything, creating a new partition and then reformatting.
Based on one of your earlier comments about seeing sector errors, I would also recommend doing a slow format on the new partition so that Windows has the opportunity to mark any bad sectors if there are any.
I like a good ending to a saga. Isn't it amazing how one little error on the disk can make it seem like all is lost, when it really isn't?
BTW - a final recommendation. When you make a new partition for your data, create a primary partition. All of the pointers for primary partitions are in the partition table in sector 0 where it is relatively easy to fix one if something goes wrong. Logical partitions can be a bear to fix since the information is spread out across the disk in multiple partition tables. After helping a few people on this forum fix missing logical partitions and seeing how difficult it can be, I've seen the light and now only use primary partitions if at all possible.