Fuck, Fuck, Fuck (recovering a deleted partition) [solved]

Raggaholic

So, there I was, ready to do a fresh install of Windows XP on my dad's laptop. I had backed everything up to an external drive and was ready to go. When it got to where to install, I saw there were two partitions. Thinking it was the normal "recover" partition BS they put on new systems, I deleted it. Then I got to looking at the size of the partition.

That's right. I deleted the partition for the external drive.

I've connected that external to my laptop and... nothing. In disk management, it says that it's all unpartitioned space. It's hard for me to believe that 40GB of stuff was deleted permanently in the blink of an eye, but I know it's possible.

So, PA, how do I recover this drive?

*****I ended up using TentDisk 6.9 and it worked like gangbusters. It restored the partition system and all the files are there. Thanks to all that gave advice. Now, to install WinXP.*****

Ganluan

The data is more than likely still there - although I am not sure of a tool that will help you recover it. Assuming you didn't do a full format (which would've taken time), it most likely just deleted the master file table and partition allocation, which can usually be restored. Do you have any of the Norton tools available? I think one of them had a partition restore functionality.

saggio

Download yourself a copy of Ubuntu LiveCD, burn it to a CD, and then pop it in.

You will be able to access all connected harddrives and (hopefully) get the data off, if it is indeed still there. Just becareful not to select "install" - you will end up getting rid of all of the data on there.

starlancerii

there's this program that I used when I was in a similar situation - I think it was GetMyFilesBack or something. I had managed to use a recovery CD to delete partition, create partition, then install a new OS. it got all my files back, though wiht some corrpution

Silvoculous

Google "Drive Rescue." If you plug that external drive into another Windows PC and double-click on it, and it gives you the "This disk is not formatted" message, Drive Rescue is a really good program that ought to make it easy to get that stuff back off of there. I did it for a corrupt flash drive and it saved my hide.

Actually, don't be fooled by what pops up on Google, this is the site:

http://skyscraper.fortunecity.com/amd/887/rescue/e_index.html

mspencer

I'm interested in seeing the outcome here -- I can offer more help if you need it.

You weren't clear about what happened between when you deleted the partition and when you connected the drive to your laptop for inspection. Did you do anything else, like create another partition?

Raggaholic

Thanks for the quick replies, all.

starlancerii wrote:

there's this program that I used when I was in a similar situation - I think it was GetMyFilesBack or something. I had managed to use a recovery CD to delete partition, create partition, then install a new OS. it got all my files back, though wiht some corrpution

I think I know what you're talking about (GetbackNTFS) as I used it to recover files off a drive that was dying. Unfortunately I don't think it will work for this.

Silvoculous wrote:

Actually, don't be fooled by what pops up on Google, this is the site:

Thanks for that, but the guy has taken the program off of the site.

mspencer wrote: »

You weren't clear about what happened between when you deleted the partition and when you connected the drive to your laptop for inspection. Did you do anything else, like create another partition?

I haven't done anything so far. I've checked on my laptop (not my dad's) in disk managment and I see the drive as unpartitioned space. Using a file recovery program, I can see that the files are still on the disk. Right now, I'm looking at different freeware that claim to be able to restore the partition, although I'd like to go with something that someone is familiar with.

I'm working to make something happen over here, but I'm still willing to take all suggestions.

mspencer

The first option that comes to mind involves Linux and a second hard disk with enough free space to hold the one you're trying to recover.

Idea the first: if the data on that hard disk really is irreplacable, NEVER use unknown programs to operate on your original, only copy of the data. Use a program like 'dd' under Linux to copy the entire disk to a new hard disk of equal or greater size and let the unknown programs operate on that disk instead. I think there's enough criminals out there that someone would have the bright idea to trick you into running some shareware, encrypt or hide something critical, and charge you extra to unencrypt it.
Idea the second: Linux can mount a file as if it were a partition, and you can use the 'dd' command to copy disk sectors into a file on a filesystem.
Idea the third: you can attempt to mount a partial filesystem and you'll get interesting error messages. If you picked the wrong place as the start of the filesystem, you'll get different errors than if you have the correct beginning of the filesystem but the end is missing.

Based on the above, I'd do the following -- just because I trust a Linux boot CD or boot floppy more than I'd trust some random shareware.

First, pick a starting sector of the hard disk and at random decide that will be my sector 1.
Second, use dd to copy the first GB of that disk (starting at my arbitrary sector 1 and ending 1 GB later) into a file on another disk.
Third, making use of the loop device as required, mount that file as a filesystem with maximum verbosity and see what error messages you get. Not a filesystem? Go back to step 1 and pick a different starting sector. It is a filesystem but warning-warning-sizes-do-not-match? Continue to step 4.
Fourth, use dd again to make another copy, but this time start at the beginning sector you identified and specify no end, so it copies the entire original disk to a HUGE file.
Fifth, mount that as a filesystem and copy your files out.
Optionally:
Sixth, once you've confirmed all your files are there (really there, as in you can copy them and see them) repartition the drive and create another partition of the exact size of the one you just killed, and copy the data back.

Or instead: (but I'm not confident I know how to do this)
Fifth, recreate the partition table on the drive once you've identified the beginning and end sector of the partition.