Vista 64 Restore, ATI 2009 and MBR

Discussion in 'Acronis True Image Product Line' started by Harry230, Dec 20, 2008.

Thread Status:
Not open for further replies.
  1. Harry230

    Harry230 Registered Member

    Joined:
    Dec 20, 2008
    Posts:
    12
    Location:
    Australia
    Hi, I am new to this forum and hoping you may be able to help me restore data.

    I have recently downloaded ATI to trial and also am running Vista 64 Ultimate with Complete PC Restore option.


    I have just done a Vista 64 complete image restore so I could rollback my computer to an earlier time to get rid of some cr$p programs and drivers.


    I have done this before, restoring the c: partition and it has worked ok.


    I have 4 drives in this computer and the Vista 64 OS is on a 100gb partition of a 750gb disk. I have four other partitions on that disk which contain (containedo_O ) other data such as videos etc.


    In this instance Vista complete restore has restored the c: partition but deleted the files in the other four partitions. The partitions can still be seen but contain no data. I would desperately like to restore this data. Could this have occurred due to an overwritten MBR.

    As stated above I am trialling ATI as Vista 64 complete image backup has some shortcomings, not transferable to other computers etc.

    Before doing the complete pc restore with vista this morning, I did an image backup with both Vista and Acronis TI. I am sure the ATI backup also included the MBR and Track 0.

    If I was to use the image made this morning to try and get back to "pre-rollback" that is where I started, is it possible if I also choose the MBR restore option in ATI2009 I will (hopefully should) get all files back?? on that drive. All the partitions are still there just can't see any files.. Haven't formatted or defragged, just left as is. Not sure if Vista 64 formatted the other partitions as it is hard to see what it is doing.

    Your help would be really appreciated as I have data I do not want to lose.

    regards,



    Harry.
     
  2. MrMorse

    MrMorse Registered Member

    Joined:
    Jun 12, 2008
    Posts:
    737
    Location:
    Germany
    Hi Harry,

    I cannot imagine that a Vista-restore deletes all other files on the other partitions.
    But you explain it here that it is fact.

    ok, I think, the raw-data is present on the other partitions.

    I suggest:
    Create and use a BartPE-CD/DVD to start an own Windows environment.
    There you can look into the partitions whether they are empty.

    Then you have to use a 'data-rescue-program' to restore the files.

    With a little bit hope you can restore it all.

    BTW:
    To create a BartPE CD you can use a manual from MudCrab (one of the brilliant member here).
    Here is the link: Click
     
  3. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    For this to happen, the Vista Complete Restore would have had to overwrite the partition table. I can't imagine them coding it this way.
    No, when you restore the MBR with TI it will replace everything in the first track of the disk except the partition table. If your PC boots correctly into Vista now then there is nothing wrong with your MBR. You could replace it with the MBR from your TI backup but it probably won't change a thing.

    By any chance did your TI backup include all of the other partitions on the disk? If so, just restore each of them to get your data back. Or, you could try the Recovery Expert in Acronis Disk Director to see if it can reconstruct your partition table. Or, you may have to resort to data recovery techniques as suggested by MrMorse.

    However, I'm curious about the sequence of events that could have resulted in a loss of your data partitions:

    1. Did you originally create the data partitions using Vista Disk Management?
    2. Did you ever restore any of these partitions using TI (during your testing and evaluation)?
    3. If (1) is true have you ever used any other partitioning tools on this disk, like XP Disk Management, Acronis Disk Director, gParted, etc?
     
  4. Harry230

    Harry230 Registered Member

    Joined:
    Dec 20, 2008
    Posts:
    12
    Location:
    Australia
    Thank you both K0lo & MrMorse.

    Apologies for the delay in reply but have been trying a few different things as suggested and also trying to deal with xmas events :)

    In regard to above questions:
    1. Yes, only Vista Disk Management
    2. Yes, I had restored an image on the c: partition trialling ATI2009 just prior to the final rollback with Vista Restore.
    3. No

    I tried rollback to the original state (that is prior to this current debacle) with ATI2009 restoring the MBR/track0 as well as partition info but to no avail still can't read the other partitions.

    Interestingly when looking at the drive after booting with ATIBoot disk (which I believe is linux) it shows the other four partitions with data in them.

    Just can't read them under Vista. Also did not back up those partitions, only the OS on c: partition.

    I have now downloaded a couple of data recovery programs, both freeware but seem to have reasonable reviews and initial results look like I may be able to restore data, but may need a bit of work to re-establish file structures/folders etc. Wonderful exercise for this time of the year :oops:

    So I don't know what has gone wrong, as stated I have used Vista complete restore before and never a problem, exactly same drive, maintained data etc.

    Not sure how ATI could affect it.

    I hope it never happens again, but I guess the positive is I now have to learn to recover data.

    NOT sure if I will use ATI2009 if you think this may have corrupted the disk prior to Vista Restore. Thanks both for your help, if you have any suggestions on cause please let me know, or maybe acronis may advise.

    I will let you know how my data restore turns out, fingers crossed at moment.

    best regards and seasons greetings,

    Harry..
     
    Last edited: Dec 21, 2008
  5. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    Harry:

    At the moment I can't see that you did anything wrong, nor can I come up with a theory about how Vista Complete Restore could have caused the loss of your data partitions. However, maybe a clue will become evident with further exploration.

    I was wondering if you would be willing to post a picture of your partition table? To do this, download the application PTEDIT32 from Symantec here: ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/PTEDIT32.zip. Unzip the file and put it on your desktop. Right-click on the application ptedit32.exe and choose "Run as administrator". When the file opens, choose your disk from the drop-down list at the top of the window and the partition table for the disk will be displayed, similar to the following:

    PTEDIT.PNG

    Attach a screen shot of the window to your reply. Also, a screen shot from Vista Disk Management may be very helpful. Maybe we can figure out how to restore the partitions without resorting to file recovery software.
     
    Last edited: Dec 21, 2008
  6. Harry230

    Harry230 Registered Member

    Joined:
    Dec 20, 2008
    Posts:
    12
    Location:
    Australia
    Thanks, I am happy to do that and if we can recover data that would be great.

    I downloaded your link and put "ptedit" on my desktop, ran as administrator but get message will not run on my OS, check for 64bit version.

    Do you have a link for a Vista 64 bit version?

    thanks for your help,

    Harry..
     
  7. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    Harry:

    Rats, that's right; you're running Vista64. I can't find a 64-bit version of the utility. I'm not familiar with settings in 64-bit operating systems; can you change a setting to force a 32-bit utility to run in a compatibility mode? If so, try that.

    If not, Symantec also has a 16-bit DOS version of the partition table editor here. If you have a bootable DOS floppy around and can boot it on your machine, try running this version instead. You won't be able to do a screen shot, but will have to either use a digital camera or else copy down the info manually.

    Meanwhile, the screen shot from Vista Disk Management would still be very informative.
     
  8. Harry230

    Harry230 Registered Member

    Joined:
    Dec 20, 2008
    Posts:
    12
    Location:
    Australia
    I have now downloaded PTEDIT32.exe as opposed to your original PTEDIT.exe and the 32 bit attempts to run but I now get message "Error #5 starting the Powerquest engine", any clues?

    I will download the dos version, but I have a problem as no floppy in current computer. Is there any recovery disk version for Vista I can use, maybe a PE version? so I can boot into a command prompt and and run ptedit?

    I will have to sort this out as I am very keen to recover data as whole partitions if possible. Any suggestions welcome.

    BTW, your help is appreciated.

    Harry.
     
  9. Brian K

    Brian K Imaging Specialist

    Joined:
    Jan 28, 2005
    Posts:
    8,646
    Location:
    NSW, Australia
  10. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    Harry:

    My apologies for posting the wrong link. I've corrected the link in the previous post.

    You could try running the PE recovery environment from your Vista DVD, if you have one. If not, you can download an iso image of the PE recovery environment from here.

    I have run ptedit from DOS, but never from the Vista PE environment, so I don't know if it will work or not. I have VistaPE on this machine, so I will reboot and give it a try and report back later.

    ***Edit*** Sorry; it does not run from a command prompt in VistaPE or WinRE. Try Brian K's link to dsrfix.

    Do you have Acronis Disk Director?
     
    Last edited: Dec 21, 2008
  11. Harry230

    Harry230 Registered Member

    Joined:
    Dec 20, 2008
    Posts:
    12
    Location:
    Australia
    Thanks Brian, Mark,

    I downloaded drsfix but not a dos bootable disk, needs to be used after booting into dos, according to instruction and no boot info on the iso.

    So same problem, maybe I can get a 98, 2000 CD boot disk so that I can add ptedit to it.

    Will Acronis disk director help?? I can download a 15 day trial. Please advise.

    At this stage I will load anything if it will help. When I recover data I will do a complete fresh install, decide whether to stick to Vista CompPCrestore or ATI and reimage backup.

    thanks again,

    Harry..
     
  12. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    Harry:
    All you need is a way to view the partition table, so the trial version of DD should be fine. The trial will not let you make changes, other than letting you create a small (7.8 MB) partition, but you don't need to do anything but use it to view your disk.

    When you install, do not activate OS Selector. Start the program in manual mode. Click on a disk (not a partition) to select it and then choose "Edit" to open the hex editor. Choose "As partition table" from the "View" menu. Drag the window border to the right until you can see the entire graphic view of the partition table, then create a screen shot. It should look something like this:

    PTable.PNG

    It's getting late here, maybe Brian K can take over; he's on Oz time.
     
  13. Harry230

    Harry230 Registered Member

    Joined:
    Dec 20, 2008
    Posts:
    12
    Location:
    Australia
    Thanks Mark, not sure whether Brian is on board with this problem but if he is that would be good.

    Attached is the graphic as requested. I am not sure what to do now but I can afford to wait for your response.

    Thanks,


    Harry.

    Acronis DD and Vista DiskManager.jpg
     
  14. MudCrab

    MudCrab Imaging Specialist

    Joined:
    Nov 3, 2006
    Posts:
    6,483
    Location:
    California
    Harry,

    Does DD in Windows show data in any of the partitions? Or are they shown empty like Disk Management shows?

    If you Explore the partitions using DD, does DD show any data?

    Since TI showed data in the partitions when you booted to the TI CD, do you have room to create backup images of the partitions (make the backups from the TI CD, not from Windows)? If so, you could then Mount them and see if the data is intact. It may be the quickest way to recover the data.
     
  15. Harry230

    Harry230 Registered Member

    Joined:
    Dec 20, 2008
    Posts:
    12
    Location:
    Australia
    Thanks Mudcrab,

    DD sees a small amount in some of the affected partitions on Disk 2.
    DD Disk Status.jpg

    I will try and write an image of one of the effected partitions and see if I can mount under windows, probably a little later today. It would be very good if that is all that it takes.

    I have data program by Paretologic (free download) which is currently analysing my archive drive O, and it is finding the missing files, so the data appears to be still there and intact. Problem is I will end up with thousands of recovered files with no structure which could be extremely tedious.

    So if your suggestion works it will be great, or if not Mark comes back with some helpful anaylysis on how to recover the file partitions I would be a very happy camper.

    Let you know how the image and remount works in a few hours time. From what I remember from the ATI boot disk, it did report the partitions empty but the graphic showed the approx correct amounts of data, so fingers crossed..

    regards,

    Harry..
     
    Last edited: Dec 22, 2008
  16. Brian K

    Brian K Imaging Specialist

    Joined:
    Jan 28, 2005
    Posts:
    8,646
    Location:
    NSW, Australia
    Harry,

    After you unzip, the only file you need is dsrfixcd.iso. Delete the others. Burn dsrfixcd.iso to a CD with ImgBurn. It's a DOS bootable CD.

    If you use Nero instead of ImgBurn, click Cancel on the New Compilation Window. Then click Recorder, Burn Image. Browse to dsrfixcd.iso, etc.
     
  17. Harry230

    Harry230 Registered Member

    Joined:
    Dec 20, 2008
    Posts:
    12
    Location:
    Australia
    Thanks Brian, you are correct, my mistake.

    It has worked a treat, and as I can only run this in DOS I have taken digital camera shots as Mark suggested above. They seem to have turned out quite well.

    I have included Disk1, 2 & 3. Disk 2 & 3 (both 500Gb WD) seem to report their capacity ok while Disk 1 (which I am sure is the troubled disk - Samsung 750Gb as the other two report the same capacity) seems to have an incorrect capacity of 201322Mb, for a 750Gb disk this seems odd.

    PT Disk1.jpg

    PT Disk2.jpg

    PT Disk3.jpg

    So any help you can offer at this point Mark or Brian would be a step forward. I plan on trying Mudcrabs suggestion a little later this evening. I was thinking that coincidental to my rollback maybe the 750 gb disk is faulty, BUT the system was all running great before my intervention.

    regards,

    Harry..
     
  18. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    Harry:

    Thank you for posting the information in your partition table. I had wanted to verify that no alterations were made to partitions 2, 3, and 4. In looking at the partition table as shown by DD, only the first partition has been modified, and it looks like it was done correctly.

    When you installed Vista and set up the other partitions using Vista Disk Management they were done according to the newer partition standard used by Vista. In other words the first partition starts at sector 2048, all primary partitions have an offset of 2048 sectors from the adjacent partition, and all partition sizes are multiples of 2048 sectors.

    When you restored the first primary partition with TI it was done using the older partitioning standard where the offset is 63 sectors and all sizes are multiples of 63 sectors. This indeed happened, and happened correctly. To confirm that the second partition is still located in the exact same spot we would first figure out the former location of partition 1. It would have started at sector 2048 and extended 100.0 GB, or 209,713,152 sectors beyond the starting sector, thus ending at sector 209,715,200. Then partition 2 would have started 2048 sectors later, or at sector 209,717,248. If you look at the entry in the partition table for sector 2, that is exactly where it is currently located. Partition 3 and the extended partition container are also located exactly where I would expect to see them.

    So I don't see anything wrong with your partition table and, apparently, no modifications seem to have been made to partitions 2, 3, and 4. So why don't they appear to have any data in them? I am also curious to see if you've tried MudCrab's suggestion to explore the partition contents with DD. What happens when you double-click on one of the data partitions? Do you see the files and folders on the partition?

    I note that PTEDIT shows the exact same thing as DD for the partition table. The incorrect size of Disk 1 is just because PTEDIT is an older DOS program and must use a 16-bit number for the # of cylinders field. Your photo shows 25,665 cylinders. Adding 65,535 to account for the overflow of a 16-bit number gives the real value of 91,200 cylinders. 91,200 * 255 * 63 * 512 bytes/sector = 750 GB. So there is nothing wrong there either.

    So, I think that we can rule out low-level changes to the partition table; everything seems to be correct. I would be curious to see if any other methods show files present in the data partitions. Can you boot with your Vista DVD and go to a command prompt? If you don't have a Vista DVD can you download the ISO of the Window Recovery Environment (WinRE) mentioned in post #7 and try from there? From a command prompt if you change directory to one of the partitions and try to list contents can you see anything? If you run chkdsk on one of the partitions does it report any problems?
     
  19. Harry230

    Harry230 Registered Member

    Joined:
    Dec 20, 2008
    Posts:
    12
    Location:
    Australia
    Thanks for the reply,

    I did try DD and cannot see a thing using explore. Also tried to image a partition from ATI boot disk but nothing in it. Also boot disk view of disks shows no data, whereas I am sure the graphic showed data, may have been before I reimaged back to "original" condition with ATI.

    Definately data in the partitions as I have data recovery programs showing many files, have actually restored some video and they work ok. But many files and not much file structure so will be very tedious to sort out.

    It is after midnight here now so will try your other suggestions in the morning.

    Really weird what has happened here, I had used vista complete restore many times in the past and ok. This situation only different because I used ATI first to trial a restore and then rolled back further with Vista Complete Restore.

    One of the data recovery apps I am trialling reports major corruption in the file structure of the effected partitions, but I guess we sorta know that already.

    I have a full version of Vista ultimate 64 (install/boot disks etc.) so I will try the extra tests you suggest, it would be great for this to fall back into place but I am starting to doubt it unless I get some really good recovery software.

    Let you know tomorrow,

    thanks,

    Harry..
     
  20. MudCrab

    MudCrab Imaging Specialist

    Joined:
    Nov 3, 2006
    Posts:
    6,483
    Location:
    California
    Harry,

    If you do run chkdsk on any of the problem partitions, I would recommend you don't use any options with it (don't use /f or /r). chkdsk can cause more corruption if it tries to fix something it doesn't understand. Running chkdsk without any options will just report problems (if found) and not make any changes.

    If you have the storage space, you could create sector-by-sector images of the partitions so you can return them to their current state if something gets further messed up in recovery attempts. That's probably what I would do, but you'd need a large backup drive.
     
  21. Harry230

    Harry230 Registered Member

    Joined:
    Dec 20, 2008
    Posts:
    12
    Location:
    Australia
    Hi again,

    Apologies for delay but final xmas shopping took precedence and I had to work around it. Also lot of time for disk diagnostic and data recovery analysis.

    I have now run a full disk diagnostic (dos based) on the hard drive, and after five or so hours doing a complete test all showed ok. So probably not HD..

    I also obtained a paragon HDM WinPE boot disk from a friend and booted up with that and it showed in order for each drive Total Size Gb, Used Space Gb and Free Space Gb.

    C: 99.9 62.3 37.6
    G: Games 79.9 1.6 78.3
    V: Videos 199.9 91.8 199.8
    O: Archive 199.9 1.9 197.9
    I: Image 118.6 89.2 118.5

    So that does show some drives with data, with weird results especially for V & I showing used space of 91.8 & 89.2 Gb respectively. Like I said above data recovery programs show plenty of data in partitions. I have actually restored 20 full videos from the video partition using recovery program. Unfortunately the data I really wanted to get was in the archive partition and that is proving difficult, lots of files and will need piecing back together. The videos came back in folders which was very nice.

    DD shows multiple system volume information in most partitions and in the image partition does show one of the original folders albeit without data..

    I have included a chkdsk for each of the affected drives below in case anyone can interpret a problem but essentially apart from the c: OS drive all report no errors. So c: has errors and everything else is ok, kinda weird.

    I thank you all for your help as I would like to get to the bottom of this especially for confidence in future restores, seems like all the file tables got wiped out.

    CDrivechkdsk.jpg
    Games_chkdsk.jpg
    Videos_chkdsk.jpg
    Archivedata_chkdsk.jpg
    Images_chkdsk.jpg

    You will see the drive letters have changed under dos but essentially in order the images are C: G: V: O: I:

    If there is anything you can make of this please let me know as I could still use the help to restore data. Just in case you are wondering my critical data is backed up daily from a mirrored drive, one of the 500gb shown in graphic above is mirrored, so I generally do not take chances. But I guess similar to a lot of people we build up(maybe hoard) a lot of other good stuff that it is very unpleasant to lose. The archive data still concerns me as that was sitting there in preparation to be sorted after building a new computer and copying it across. Hopefully I will be able to get most of that back with data recovery, but without file structures it is very tedious.

    So if there is still a silver bullet available, someone please shoot it this way..

    kind regards,

    Harry..
     
    Last edited: Dec 23, 2008
  22. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    Harry:

    I'm still puzzling over this. Are your last set of screen images from running the Windows Recovery Environment (WinRE) on a Vista DVD? If so, did you try listing contents of each drive, as in "I: <enter> dir <enter>, J: <enter> dir <enter>, etc."? If so, were there any files on the drives? I am interested in seeing if you can see the file structure from a Windows environment without your Vista64 OS running.

    It is odd that chkdsk does not find any problems on the empty drives, although it lists the number of data files as 10, 12, and 13 respectively, on the three partitions. I assume that you have many more files than that on the partitions.

    The error on your Vista64 partition seems real enough, so you should probably fix that some day by running chkdsk /f on the drive from the WinRE environment.

    I showed this thread to a pretty sharp IT person here at work and their comment was that you have all the symptoms of having performed a quick format on each of the partitions. A quick format would leave you with just a few files (recycler, system volume information, etc), and an otherwise empty partition. Data Recovery software would then be able to find your old files on the disks since nothing would have written over them. However, neither of us could figure out how that would happen from doing a CompletePC Restore unless the checkbox shown below "Format and repartition disks" had been checked:

    restore-erase-confirm.jpg
    (Graphic borrowed from http://www.bleepingcomputer.com/)

    Is there any chance that this may have happened accidentally?
     
  23. Harry230

    Harry230 Registered Member

    Joined:
    Dec 20, 2008
    Posts:
    12
    Location:
    Australia
    Thanks for your persistence Mark.

    Hmmm as much as I hate to admit it, you may be on to something. I remember I did receive a phone call about the time I committed to a PC Restore and I suppose with all of us interruptions at the critical moment can lead to errors. A longwinded way to say, yes it is possible.

    Now the graphic you show is not what appears in my Vista 64 sp1, and I just reloaded and took photos to show what mine looks like. Mine automatically includes reformatting everything UNLESS you exclude it. I remember now I always thought this was a dumb programming idea. I have showed this in the graphics below. Maybe in the haste to set it running I didn't tick the main drive, must have ticked the other drive (external mirrored) or I would probably have jumped off a bridge by now.

    VistaRestore1.jpg

    VistaRestore2.jpg

    So Vista Restore automatic selection to format everything may be the answer, I think this is very dangerous preselection to program and would prefer the option as per your graphic.

    This alone would lead me to purchase ATI2009 over Vista PC Restore as it doesn't have the same automatic format inclusions.

    Maybe you have found the answer, not sure if that is what I have done but seems to explain it pretty well.

    Unfortunately the data recovery programs are not pulling the data back as well as they advertise if indeed it just was a quick format. Has your IT friend any suggestions on a good recovery program??

    Thanks for your support, going to bed now, a little past 2am here...

    Harry...
     
    Last edited: Dec 23, 2008
  24. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    Harry:

    Judging from the date on the graphic in my post #22, this would have been the way Complete PC Backup and Restore worked with the Release Candidate of Vista, and you have the SP1 version. Boy, if Microsoft changed the default behavior to "Format and repartition disks" that is an incredibly stupid blunder on their part. It's a disaster waiting to happen.

    When I first saw the graphic (from Vista RC1) I thought that having a means to restore the OS partition and re-create the original partition layout on the disk was a nice option; that's a feature that TI lacks. Many users on the forum assume that they will get this behavior by restoring the MBR, but that isn't what happens (an MBR restore does not restore the original partition table).

    I had originally investigated Windows Complete PC Backup and Restore but chose instead to stay with TI. I believe that TI has more flexibility for restoring single or multiple partitions and it includes support for Linux, which of course is lacking in the Windows program.

    Our IT staff prefers GetDataBack as a file recovery program. Sorry to see this outcome, but hopefully you can recover most of your files.
     
  25. MudCrab

    MudCrab Imaging Specialist

    Joined:
    Nov 3, 2006
    Posts:
    6,483
    Location:
    California
    Harry,

    Do you know if the original partitions (as they were when you did the MS backup) were all created with Vista?

    I was thinking about this and wondering what would happen in a case where the partitions were not Vista-aligned and you did a MS restore that did a Reformat and repartition. I would assume that Vista would recreate the partitions using Vista's alignment method. This would be much different than a simple reformat and make recovery much more difficult.

    The fact that the screenshot says Reformat and repartition disks makes me think it's doing more than a simple quick format of the existing partitions. Depending on how it works, this may even be a problem if Vista's alignment was originally used.
     
Thread Status:
Not open for further replies.