Partition Recovery

RewiredRewired Member
edited August 2006 in Hardware
Hello folks. I made a bad mistake on a client’s machine. I was going to reformat Windows XP and booted the Windows XP CD. I got to the dialogue where it allows you to create or delete hard disk partitions. Anyway I deleted the wrong partition. I realized this right away and quickly quit the setup without formatting anything. The partition now is obviously not available in the Windows explorer. I must have deleted the whole file system but the files should still be intact. Does anyone know any good free partition recovery tools? I lost 20 gigs of my client’s media. :werr: And felt like a jackass. It all happened so quickly. Does anybody have any advice at all? I'm out of my comfort zone here and I'd like to recover the partition and/or files ASAP. Thanks a great deal for anyone and everyone’s help here. You've always been great.

Comments

  • botheredbothered Manchester UK
    edited August 2006
    From what I've seen in these forums for similar problems it has been suggested to take the drive out and maybe put it in another PC to recover the files you need.
  • RewiredRewired Member
    edited August 2006
    Botherered, the drive in question is actually a secondary drive. WinXP:Pro is installed on the primary drive and operational. So the scenario is almost as you've proposed, except without having to swap drives. Thank you and I hope you can continue to help.
  • ThraxThrax 🐌 Austin, TX Icrontian
    edited August 2006
    Get a copy of TestDisk (You want the DOS/Win9x version), and run it. It will allow you to test your disks for bad partitions, and recreate them when it finds some.
    What TestDisk Does:
    TestDisk queries the BIOS or the OS in order to find the Hard Disks and their characteristics ( LBA size and CHS geometry). TestDisk does a quick check of your disk's structure and compares it with your Partition Table for entry errors. If the Partition Table has entry errors, TestDisk can repair them. If you have missing partitions or a completely empty Partition Table, TestDisk can search for partitions and create a new Table or even a new MBR if necessary.

    However, it's up to the user to look over the list of possible partitions found by TestDisk and to select the one(s) which were being used just before the drive failed to boot or the partition(s) were lost. In some cases, especially after initiating a detailed search for lost partitions, TestDisk may show partition data which is simply from the remnants of a partition that had been deleted and overwritten long ago.

    TestDisk has features for both novices and experts. For those who know little or nothing about data recovery techniques, TestDisk can be used to collect detailed information about a non-booting drive which can then be sent to a tech for further analysis. Those more familiar with such procedures should find TestDisk a handy tool in performing onsite recovery.
  • RewiredRewired Member
    edited August 2006
    Thrax, why don't I want the Windows NT/XP/2000/2003 version of TestDisk?
  • ThraxThrax 🐌 Austin, TX Icrontian
    edited August 2006
    You do. It was 7 AM for me, and I misread. ;D
  • RewiredRewired Member
    edited August 2006
    THRAX, you're the man. It was a nerve wracking process cause the documentation on TestDisk kind of sucks. First I did an analysis and than a deep analyses and I located the deleted partition by name [Music]. It took about 30 minutes and I was able to salvage all the data. Now if someone could explain to me how partitions and file systems work and why it is so easy to delete and recover them I'd be more knowledgably for it. :D

    Anyway Thrax, you should continue recommending TestDisk to people because if it could work for me it could work for anyone. Cheers friend! :beer:
  • ThraxThrax 🐌 Austin, TX Icrontian
    edited August 2006
    Partitions are coupled to the Master File Table, which sits at the beginning of the hard disk. The MFT is an invisible listing of where every file is physically located on the drive, how big it is, and what it is (Is it an EXE? DLL? How many bits?). Partitions are low-level software overlays to a physical hard drive, telling the MFT that this physical hard disk is divided into virtual sections, and to treat the two sections as their own drives and provide them a letter.

    Now, when a partition goes bad, it simply means that the dividing structure of the partition has gone bad on a software level. The MFT can still identify all your files as being in x physical location on the drive. It's a bit like putting two balls next to one another, and then penning them off. You are the MFT because you can see both balls, so even if you kick down one of the walls, you know that the ball is still physically there. By that effect, a hard disk can be read and a partition can be recreated from the information stored in the MFT.

    Furthermore, programs can look at something called the geometry of the drive, which is "Are there any tell-tale signs (at a mechanical level) that data has been stored here?" Programs can go through a disk and look for signs of data being written just like you can flip over a CD-R and see the colour differentiation to notice that something has been written. Comparing the drive geometry to the MFT, a truly accurate partition can be created.

    No files are truly ever deleted unless new data has been written over the top, and even then, there are magnetic ghosts of the old, old data lingering on the disk.
Sign In or Register to comment.