DD10.0.2160 won't recover lost partitions

[Kritker]

I deleted (foolishly using Windows Disk Management) the first partition of several on a disk (created using DD10) on a Windows XP Pro SP2 system - initially created as

• Primary,
• LOGICAL (accidentally created as Logical - had initially been Primary),
• Primary,
• Extended with 6 logical partitions (D, E, F, G, H and I)

and converted via DD 10 to

• Primary, (this is the one that was deleted intentionally)
• PRIMARY,
• Primary,
• Extended with 6 logical partitions (D, E, F, G, H and I)

and as a result of deleting the first primary partition, partitions E, F, H and I also disappeared and Window now shows the total capacity of the disk far exceeding its actual capacity - the 500 GB drive is shown as occupying about 1.5 TB.

Both DD 10 and Recovery Expert now hang - neither will run fully - when the affected hard disk (SATA2) is attached to the computer. They run fine when it is not. I can start each and get through a couple of screens and then DD10 disappears completely and Recovery Expert's window indicates it is "not responding". In both cases diskdirector.exe keeps running at 50 % utilization.

Acronis tech support has had me run several other versions of DD 10 to no avail. I am waiting, impatiently, for tech support to explain what happened and perhaps help me to recover the deleted partitions.

I am wondering if anyone can shed any light on what happened? I know that DD 10 can create a wider range of partitions than Windows XP Pro's Computer Management Disk Management can properly handle and that despite having created what looked like valid Windows partitions I must have ended up with something that Windows only seemed to recognize.

Any insights, anyone? Perhaps a similar experience? Thanks.

[MudCrab]

Whenever you have mixed Primary and Logical partitions, Disk Management will not show them correctly. It will double or triple the actual hard drive space because it shows the same partitions several times, usually with at least one of them being unallocated space.

I suspect that you are correct and the problem was from deleting the partition using Disk Management.

When you tried DD to recover the partition, was it from Windows, from the DD CD (Full Mode, Safe Mode, etc.)?

Can you post a screenshot of what Disk Management shows for your drive?

Can you post a screenshot of what DD (in Manual Mode) shows for your drive?

If you have TI (or another imaging program), can it see the partitions correctly? If so, can you create a backup?

[frustrated2today]

I apologize for interrupting here but may some one please tell me which screen to go to post a new thread?

thanks

[MudCrab]

When you're in the main forum section thread lists, there is a "new thread" button in the top left just above where the thread lists begins. For example, at the top of this page for the Disk Director forum.

[frustrated2today]

thank you so much. I am pleased to have a fellow Californian respond.

[Kritker]

Originally Posted by MudCrab

When you tried DD to recover the partition, was it from Windows, from the DD CD (Full Mode, Safe Mode, etc.)?

All three

Can you post a screenshot of what Disk Management shows for your drive?

Will do later today.

Can you post a screenshot of what DD (in Manual Mode) shows for your drive?

Can't - DD10 wouldn't run with the disk connected, but I'll try again, just in case anything has changed.

If you have TI (or another imaging program), can it see the partitions correctly? If so, can you create a backup?

This is an excellent idea that I hadn't considered. I'll try this too. Thanks, once again!!!

[Kritker]

DD10 still won't run. The full version from the CD doesn't see the drives and the safe version hangs on its scan of the 8th partition of the affected drive.

The affected drive is Disk2 in the Disk Management screen shot and it is the two partitions that came after "Media" (the so-called 319 GB of free space) that are of concern to me. The partitions between "Programs" and "Media" were backed up and recovered.

It was the OSS partition that was, at one time a primary partition which I converted to logical so I could have three primary partitions ahead of it. I changed that back to two primary partitions and then made the mistake of deleting the first using Windows instead of DD10.

TI doesn't see the partitions correctly. I have included what it sees too. Here the affected Drivbe is Disk 3.


Thanks.

[K0LO]

Kritker:

One thing that may help MudCrab is if you could re-post your last picture showing the disk layout as seen by TI. Before capturing the screen shot of the "Partitions Selection" window, click on the control that lets you add columns to the display and add the column "Number". Then click on the heading "Number" to sort in that order. This will give Paul information about how the partition table is seen on the disk (Numbers 1 - 4 are primary partitions; logical partitions are numbered starting at 5). Here's a representative image from my machine:



You can infer from the above picture that the logical partition container occupies slot 2 in the partition table.

[Kritker]

Great idea Mark. Thanks.
Here is one error (of several) encountered along the way (by DD10, TI11 and Recovery Expert from DD10)

and here is the TI listing with a few columns added

[K0LO]

Kritker:

Wow. This may be an interesting one to untangle if it's even possible. The simplest solution that comes to mind would be if you had a full-disk image that you could restore, but obviously you would have already done that if you had the image.

The error message in your screen shot refers to sector 1,281,996,429. Since each sector is 512 bytes then DD is attempting to read from a sector that is offset (1,281,996,429 * 512 /1024/1024/1024) = 611.3 GB from the start of the disk. Of course that's impossible on a 500 GB disk; that sector doesn't even exist! So why does DD try to read that sector? The answer is found by examining your partition table, which you can't display in DD but can be inferred from your last picture.

If TI is properly reading the partition table entries then you've got a really badly messed-up partition table. If we take the picture as truth for a moment and arrange it in order then you can start to see the problem. Each entry lists the starting and ending sector. The ending sector should always be greater than the starting sector, and if you look at partition number 8 you can see a big problem - that entry is messed up. The same goes for #7.

If the TI data is correct, then here is what I am seeing if I arrange it in partition order. Keep in mind that there should be a gap of 63 sectors between each partition and they should be arranged in order of increasing sector number:

Number     Type     Start               End               Size     Comment
   1       NTFS     62,605,305         125,853,209      30.16 GB   K: SP3 (Primary)
   5       FAT16    125,853,273        126,881,369      502 MB     OSS partition
   6       NTFS     126,881,433        128,985,884      1 GB       L: (Programs)
 * 7       unknown  94,806,613         2,168,754,449    988.9 GB   bad entry!
 * 8       unknown  1,281,996,301      705,592,404                 bad entry also!
   9       NTFS     485,500,428        611,321,444      60 GB      M: (Media)

The 3rd and 4th logical partitions (#7 and #8 above) should be listed as:
   7       NTFS      128,985,948       ??
   8       NTFS      ??                485,500,364
but we don't know where #7 stopped or where #8 started.

You can see some of the issues here. #7 is bigger than the disk, and it starts below the first primary partition and overlaps all of the others. #8 starts well past the end of the disk and ends in the middle of the disk (the ending sector is probably an overflow from a calculation).

Also, there are only 5 logical partitions listed (#5 through #9). In your first post you mentioned having six logical partitions, so one is missing. Also, your first post mentioned having 3 primary partitions but there is only one listed above.

One of the real difficulties with logical partitions is that they are chained together. The starting sector of the first lists the starting sector of the second; the starting sector of the second lists the starting sector of the third; etc. If something happens to break the chain then you may have trouble reconstructing it, so as a result you lose track of partitions beyond the break.

Before going too much farther I'd like to see if a different tool sees the same thing that TI is seeing. Could you download the free PowerQuest partition table editor ptedit32.exe from this web site: ftp://ftp.symantec.com/public/englis...s/PTEDIT32.zip
Unzip the file, put it on your desktop, double-click on it and you should be able to view your partition table. Set the drop-down list to display the correct disk and then examine the entries to see if they agree with what TI is seeing. You will have to use the "Goto EPBR" button on the logical partition container (probably the second entry in the partition table, listed as Type 05) in order to follow the chain of logical partitions. Start at the beginning and follow it to the end, if you can, to see if the starting sectors agree with the TI data.

I'm not sure that you can recover this disk, but maybe it will be possible. If we can get DD to run then you may have a chance by running the Recovery Expert to see if it can sort out where the missing partitions are located. It would be tempting to manually edit the partition table to try to reconstruct the chain, but there is a risk that this may make things worse. If we could figure out, for example, either the starting sector of #8 or the ending sector of #7 then we could fix the table enough to perhaps satisfy DD and get it to run. You can do these manual edits with PTEDIT32 if it comes to that.

Could you post the image of the PTEDIT32.EXE screen displaying the problem disk? Here's an example:

[MudCrab]

Originally Posted by Kritker

The affected drive is Disk2 in the Disk Management screen shot and it is the two partitions that came after "Media" (the so-called 319 GB of free space) that are of concern to me. The partitions between "Programs" and "Media" were backed up and recovered.

Can you elaborate a little on this? I wonder if you "recovered" several of the partitions back to the original drive or if you restored them to another drive.

Can you list the partitions (with the name, size and type) in their original order (from just before you deleted the partition using Disk Management)?

The bottom line is that you may not be able to recover the partitions. And, in making any attempts, you may make it even more difficult. If it were me, this is what I would try:

1. Create a complete sector-by-sector backup of the drive. I don't know if TI can do this correctly because of the corruption. I doubt it. You'd have to use Linux (the dd command and copy the entire drive -- all 500GB of it).

2. Use DD and clear the drive of the existing partitions -- don't wipe anything.

3. Use DD's Recovery Wizard to see if it can now find the partitions.

I suspect that the "real" partitions are still there (at least most of them) and that Disk Management just screwed up a link. Once there are no partitions on the drive, DD should startup okay and should be able to scan the drive.

[K0LO]

Originally Posted by MudCrab

...If it were me, this is what I would try:...2. Use DD and clear the drive of the existing partitions -- don't wipe anything...

This is a good suggestion but Kritker may need a different tool to clear the partition table because he is unable to get DD to run. But before clearing the table I have an idea that may work. If not, we can try clearing the partition table.

I would like to see the screen shot from PTEDIT before jumping to conclusions, but I believe that it will show the logical partition container in slot 2 of the partition table with incorrect size. What I am thinking is that you can change the ending sector of the logical partition container to a reasonable value (actually, I would change it to the ending sector of the #9 partition) and this MAY allow DD to start up correctly. If so, the rest will be up to DD's Recovery Expert to sort out.

After reflecting on this overnight I am somewhat more optimistic that the drive may be recoverable.

[Kritker]

Originally Posted by k0lo

Kritker:
Before going too much farther I'd like to see if a different tool sees the same thing that TI is seeing. Could you download the free PowerQuest partition table editor ptedit32.exe from this web site: ftp://ftp.symantec.com/public/englis...s/PTEDIT32.zip
...
Could you post the image of the PTEDIT32.EXE screen displaying the problem disk? Here's an example:

Wow, what a blast from the past!! I had been a very happy Powerquest customer all the way through Drive Image 7 and Partition Magic 8 and only switched to Acronis DD and TI after DI and PM stopped working reliably some time after Symantec's takeover of Powerquest. Hmm, I wonder if Boot Magic would be compatible with Win XP Pro SP3?? Anyway, here are the PTEdit screen shots.
PTEdit1:

PTEdit2:

PTEdit3:

PTEdit4"

PTEdit5:

[Kritker]

PTEdit6:

Originally Posted by MudCrab

Can you elaborate a little on this? I wonder if you "recovered" several of the partitions back to the original drive or if you restored them to another drive.

Can you list the partitions (with the name, size and type) in their original order (from just before you deleted the partition using Disk Management)?

The partitions were, as near as I can remember):
1. Hidden primary, System (~30 GB)
2. Hidden primary, System, (~30GB, at one time two 15 GB primaries and once a Logical, by mistake)
3. Logical, OSS (!512MB, initially primary, converted to logical by DD10)
4. Logical, Programs (~1GB) Still intact
5. Logical, Data (~60GB) Gone but I recovered it from an image to a new HD
6. Logical, Photos ~60GB) Gone but I recovered it from an image to a new HD
7. Logical, Media (~60GB) Still intact but I recovered it from an image to a new HD
8. Logical, Work (~60GB) Gone but only temporary files on it. Not needed
9. Logical, Backups (remainder, ~160GB) This may have been two partitions. I cannot remember. If I had kept it only for Backups I'd have been OK but I was running out of room on the other partitions so I started storing some other data here (without adding it to my imaging schedule) and it's that which I am trying to recover.

[Kritker]

Originally Posted by MudCrab

1. Create a complete sector-by-sector backup of the drive. I don't know if TI can do this correctly because of the corruption. I doubt it. You'd have to use Linux (the dd command and copy the entire drive -- all 500GB of it).

I have made an image of the drive using Active Undelete (not sure whether it was sector by sector) and also used it to scan the drive and pull off the files it can recover. If all else fails I can scan through that and see what it found BUT the folder structure is gone. I haven't tried the TI sector by sector imaging. I can do that. I haven't run Linux on my PC for many years now.

2. Use DD and clear the drive of the existing partitions -- don't wipe anything.

Therein lies the problem. DD won't run with this drive attached to the system. We've come full circle. Or are you suggesting I try to run DD against the recovered drive instead of the original?

3. Use DD's Recovery Wizard to see if it can now find the partitions.

I suspect that the "real" partitions are still there (at least most of them) and that Disk Management just screwed up a link. Once there are no partitions on the drive, DD should startup okay and should be able to scan the drive.

I too suspect that everything needed for DD is still there. I just can't get DD or its Recovery Wizard to run with this drive attached to the system.

[MudCrab]

Originally Posted by k0lo

This is a good suggestion but Kritker may need a different tool to clear the partition table because he is unable to get DD to run.

Yes, I forgot about that.

What I am thinking is that you can change the ending sector of the logical partition container to a reasonable value (actually, I would change it to the ending sector of the #9 partition) and this MAY allow DD to start up correctly. If so, the rest will be up to DD's Recovery Expert to sort out.

To me, this would be risky. If this change is made, make sure to keep track of what the existing values are so they can be restored. And that still leaves the other partitions with incorrect values, doesn't it?

It may not make a difference, but in my experience with using the Recovery Wizard, it doesn't do well with finding any partitions inside existing partitions. Once a partition has be recreated or changed, it probably won't find anything. That's why I was thinking of clearing the partitions and letting DD scan the drive as all unallocated space. It may find several "sets" of partitions. Hopefully, one of them would be the correct one.

If DD can run on the drive, you may be able to find the start and end of the last Logical partition by manually scrolling (or searching) through the drive using the Disk Editor. I've done that before. It helps to have a rough idea where to start (searching a large drive can take a long time).

[Kritker]

Is there a backup of the partition table anywhere that I could restore?

[K0LO]

The main partition table in sector 0 is OK. Restoring it won't help.

I'm writing a response to your earlier post now. I have an idea. Back in a few minutes.

[K0LO]

This is like solving a Sudoku puzzle - the information is there but it's tricky to untangle.

The PTEDIT screen shots in posts 13 and 14 tell the story:

1. The first image looks totally correct. The logical partition container is indeed in slot #2 of the partition table and even its size looks correct. It starts at sector 125,853,210 and ends 850,914,855 sectors later, or at 976,768,066. This ending sector corresponds to 500.15 GB (not GiB) offset from the start of the drive. This is reasonable for a 500 GB drive, so I think the main partition table is correct.

2. The second image looks correct. The logical partition chain links ahead to the third image correctly. This one is the OSS partition, which works.

3. The third image is where things go wonky. The entries on the first line are OK and correctly locate the L: drive and correctly describe its size. The error is on the second line of this figure. The box "Sectors Before" should say 3,132,675. This location is the link to the starting sector of the next partition.

This is calculated by taking the starting sector of the current partition and adding to it the # sectors before the current partition plus the number of sectors in the current partition. So here it is (126,881,370 + 63 + 2,104,452) which equals 128,985,885. Note in the 3rd figure that this number is entered as 128,985,889, or 4 sectors later than it should be. This is where the link is "broken".

4. The fourth image illustrates what happens when the previous logical partition references the wrong sector on the next logical partition. Nothing makes sense on the first line because the values are being read from the wrong sector. The header at the top of the figure also has a clue that the sector is off by 4 because it references cyl 8029, head 0, sector 5 instead of sector 1. This is one of the "unknown" partitions with the impossible parameters (size = 988.9 GB)

5. The fifth image is also wrong because it is also incorrectly linked from the fourth. It is the other "unknown" partition with the ending sector occurring before the starting sector.

6. This is what I don't understand -- the last image is correctly linked from the previous partition! Somehow this portion of the logical "chain" survived. This is the Media partition and is correctly displayed.

What to do about this is an interesting question. If you "fix" the entry where the link is broken maybe the rest of the links will magically reappear. In this figure:



The highlighted boxes are the ones in error. The "Sectors Before" entry can be edited but I don't know what to do with the "Sectors" entry, which is supposed to be the size of the NEXT logical partition in sectors, but we don't know what that is because the next partition is the one that's messed up. The number currently in the box corresponds to 90 GB; does that sound right?

I might be tempted to edit the "Sectors Before" entry only and see what happens. You can always return to this screen and change it back if it doesn't work.

Let us know what this does. If it doesn't work then we can consider deleting the entire logical partition container and letting DD try to recover the partitions that were in it.

[Kritker]

Looks very interesting, Mark. I'll examine your procedure in detail. I am just about ready to try something like that. I'll report back what I find. Incidentally, which markup program do you use to annotate images etc.? (The last one I tried was PenSuite 2.12 a number of years ago.)

[K0LO]

I'm using the Snipping Tool, which is part of Windows Vista. I should do the markup on my Tablet PC so that it is legible; this was done with a mouse and looks pretty bad!

[Kritker]

Originally Posted by k0lo

If you "fix" the entry where the link is broken maybe the rest of the links will magically reappear. In this figure:
...
I might be tempted to edit the "Sectors Before" entry only and see what happens. You can always return to this screen and change it back if it doesn't work.

Ok, I have tried it and the results are shown below. Undoing it gives me back the original PTEdit screens I posted above.

PTEdit3Revised:

PTEdit3Revised:

PTEdit5Revised:

PTEdit6Revised:


I'll check now to see if DD can run.

[K0LO]

Looking encouraging so far. At least all of the partitions are detected as NTFS and have reasonable sizes.

[Kritker]

Mark, after your change DD10 runs again and, not only that, the Data and Photos partitions are now accessible again. Only the last part of the disk is still inaccessible.


and, for reference, Computer Management Disk Management sees:

[K0LO]

Great! I love a good puzzle.

Hopefully now the Recovery Agent can locate your missing partitions at the end of the drive.