If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
Best app for partition recovery
Any suggestions for a decent app to recover lost partitions?
|
#2
|
|||
|
|||
Best app for partition recovery
On Sun, 16 Feb 2014 12:51:44 +0000, Jim
wrote: Any suggestions for a decent app to recover lost partitions? Easeus |
#3
|
|||
|
|||
Best app for partition recovery
On 16/2/14 8:51 PM, Jim wrote:
Any suggestions for a decent app to recover lost partitions? SUGGESTION: Don't try to do two things at the same time and with one single tool. First, restore the partition table. Then you restore the data inside the partition. Whatever you do, **DO NOT** directly modify the content of the hard disk in question. Files restored should be copied to another hard disk. Tools like Recuva does this. -- @~@ Remain silent. Nothing from soldiers and magicians is real! / v \ Simplicity is Beauty! May the Force and farces be with you! /( _ )\ (Fedora 19 i686) Linux 3.12.9-201.fc19.i686 ^ ^ 23:18:03 up 2 days 3:05 1 user load average: 0.20 0.13 0.08 ¤£*ɶU! ¤£¶BÄF! ¤£´©¥æ! ¤£¥´¥æ! ¤£¥´§T! ¤£¦Û±þ! ½Ð¦Ò¼{ºî´© (CSSA): http://www.swd.gov.hk/tc/index/site_...sub_addressesa |
#4
|
|||
|
|||
Best app for partition recovery
On 16/2/14 11:26 PM, Mr. Man-wai Chang wrote:
Whatever you do, **DO NOT** directly modify the content of the hard disk in question. Files restored should be copied to another hard disk. Tools like Recuva does this. A simpler way is to clone the hard disk first, then use recovery tools on this copy of the hard disk. -- @~@ Remain silent. Nothing from soldiers and magicians is real! / v \ Simplicity is Beauty! May the Force and farces be with you! /( _ )\ (Fedora 19 i686) Linux 3.12.9-201.fc19.i686 ^ ^ 23:24:02 up 2 days 3:11 0 users load average: 0.05 0.06 0.06 ¤£*ɶU! ¤£¶BÄF! ¤£´©¥æ! ¤£¥´¥æ! ¤£¥´§T! ¤£¦Û±þ! ½Ð¦Ò¼{ºî´© (CSSA): http://www.swd.gov.hk/tc/index/site_...sub_addressesa |
#5
|
|||
|
|||
Best app for partition recovery
Jim wrote:
Any suggestions for a decent app to recover lost partitions? There are "two levels of lost". If the MBR is damaged or overwritten, then the individual partitions can no longer be found. For that, you use TestDisk. TestDisk computes new values for the partition table, based on the file system headers it finds. The method is problematic, in that a deleted partition can be relocated. And, the tool doesn't necessarily check for or detect overlap in the definition of partitions. It's up to the human operator, to judge whether the new, proposed, MBR value is any good. So in a sense, it's far from fool proof. You have to eyeball the results, and decide whether "the disk originally had two partitions, a small one and a big one". http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step At the next level, is Disk Management shows the partitions OK, but one of the partitions doesn't have any type information. Perhaps the partition will no longer mount. In that case, you need something to recover the partition. The only free one I know of, with initial NTFS support, is Drive Rescue. Which is ancient. http://web.archive.org/web/200701010...rescue19d.html This is a screen shot of Drive Rescue at work. http://imageshack.us/a/img822/1299/evie.gif ******* For forensic work, you need two hard drives. One hard drive, holds an exact sector-by-sector copy of the damaged disk. The second spare hard drive, is where DriveRescue is going to save the recovered files. ******* There are many $39.95 recovery softwares. And some of them are designed to show the file names, as a teaser, to prove the tool can find them. (That's the "trial mode" of the product.) You then pay your $39.95, and see whether the tool actually works and can recover them. I have no experience with any of these, because I don't have N * $39.95 to waste :-) Good luck, Paul |
#6
|
|||
|
|||
Best app for partition recovery
On 16/02/2014 15:29, Paul wrote:
Jim wrote: Any suggestions for a decent app to recover lost partitions? There are "two levels of lost". If the MBR is damaged or overwritten, then the individual partitions can no longer be found. For that, you use TestDisk. TestDisk computes new values for the partition table, based on the file system headers it finds. The method is problematic, in that a deleted partition can be relocated. And, the tool doesn't necessarily check for or detect overlap in the definition of partitions. It's up to the human operator, to judge whether the new, proposed, MBR value is any good. So in a sense, it's far from fool proof. You have to eyeball the results, and decide whether "the disk originally had two partitions, a small one and a big one". http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step At the next level, is Disk Management shows the partitions OK, but one of the partitions doesn't have any type information. Perhaps the partition will no longer mount. In that case, you need something to recover the partition. The only free one I know of, with initial NTFS support, is Drive Rescue. Which is ancient. http://web.archive.org/web/200701010...rescue19d.html This is a screen shot of Drive Rescue at work. http://imageshack.us/a/img822/1299/evie.gif ******* For forensic work, you need two hard drives. One hard drive, holds an exact sector-by-sector copy of the damaged disk. The second spare hard drive, is where DriveRescue is going to save the recovered files. ******* There are many $39.95 recovery softwares. And some of them are designed to show the file names, as a teaser, to prove the tool can find them. (That's the "trial mode" of the product.) You then pay your $39.95, and see whether the tool actually works and can recover them. I have no experience with any of these, because I don't have N * $39.95 to waste :-) Good luck, Paul Hi guys thanks for your replies so far i'm in a real pickle here. The drive is a new WD3TB Black, however it is only showing up in recover software as 747GB, i need it to be able to show me what is on the whole 3TB drive any idea folks? I love these fat drives but when you loose em it's a nightmare. Jim |
#7
|
|||
|
|||
Best app for partition recovery
Jim wrote:
Hi guys thanks for your replies so far i'm in a real pickle here. The drive is a new WD3TB Black, however it is only showing up in recover software as 747GB, i need it to be able to show me what is on the whole 3TB drive any idea folks? I love these fat drives but when you loose em it's a nightmare. Jim Piece of cake. I've seen this, but it's a function of the OS you're using. I get similar symptoms in Win2K. (I have a 3TB WD Black.) It also depends, on what you used to prepare the drive. Western Digital provides a free copy of Acronis TIH, suitable for installing the Extended Capacity Manager. Only problem is, at some point in the past, I installed some other Acronis software, it installed a driver, and the driver was not removable. So the new software, could not install its driver. This complicates the process of getting the Extended Capacity Manager working. I can promise you, that the data is still accessible. I was able to access the upper 747GB, using a loopback mount in Linux, using a little-known offset parameter. That allows me to get to the partitions that might be hiding up near the end. But to do that, I had a fairly good idea, what the offset should be. It only took a little bit of searching, by taking snapshots with "dd", to figure out where the file system header was. I doubt one of the older data recovery programs is going to be entirely happy working on your problem. So perhaps you can provide a few details of what you've tried, and I'll see if I can jog my memory as to what I did to fix it. I've worked with the Extended Capacity Manager twice, and both experiences were horrible (blinding rage horrible). The Acronis TrueImage Cleanup Utility is here. It can remove the old driver, if one is present. The Acronis staff thought you could not successfully write one of these, but a user in one of their forums, showed them how. (If the driver is uninstalled in the wrong order, it would cause the OS to blue screen.) http://kb.acronis.com/content/34876 A standalone driver package exists. When I installed this in Windows 8.1 Preview for example, I was able to use the entire 3TB of disk, just as I see it in WinXP today. But the required metadata was already on the disk, for that driver to use. https://kb.acronis.com/system/files/...ksetup2013.zip But what that doesn't do, is it doesn't do the Extended Capacity Manager step. ECM writes a 256KB chunk of metadata, at the 2TiB mark. The upper virtual disk, appears just after that point. And both times I worked with ECM, it *refused* to allow me to click the button, and install. And I didn't keep careful notes, with all the flailing I was doing, of what fixed it. So bottom line is: 1) Your data isn't lost. It can be accessed from Linux, for free, with a bit of work. The upper 747GB or whatever, is treated like a big bitmap. The -o loop option in the Linux mounter, allows a file system to be mounted on a mount point. Even though Linux would not normally allow access above 2TiB on an MBR disk, the offset in the loopback mounter supports 64 bit numbers. 2) Depending on OS, the OSes behave stupidly, even when you do things mostly right. I've tried cranking down the first 2TB partition by small amounts, to get them to behave better. But I think what was really ****ing off the OS, was cylinder offsets (WinXP style) versus megabyte offsets (Windows 7 style). The Extended Capacity Manager, was using one style on the lower disk, and another on the virtual disk. Acronis should be soundly whipped, for the mess they made there. Not a pleasant experience at all, and double the work for me that it should have been. Thank God they made that Cleaner utility, or I'd still be swearing and tearing out my hair! Paul |
#8
|
|||
|
|||
Best app for partition recovery
On 16/02/2014 20:48, Paul wrote:
Jim wrote: Hi guys thanks for your replies so far i'm in a real pickle here. The drive is a new WD3TB Black, however it is only showing up in recover software as 747GB, i need it to be able to show me what is on the whole 3TB drive any idea folks? I love these fat drives but when you loose em it's a nightmare. Jim Piece of cake. I've seen this, but it's a function of the OS you're using. I get similar symptoms in Win2K. (I have a 3TB WD Black.) It also depends, on what you used to prepare the drive. Western Digital provides a free copy of Acronis TIH, suitable for installing the Extended Capacity Manager. Only problem is, at some point in the past, I installed some other Acronis software, it installed a driver, and the driver was not removable. So the new software, could not install its driver. This complicates the process of getting the Extended Capacity Manager working. I can promise you, that the data is still accessible. I was able to access the upper 747GB, using a loopback mount in Linux, using a little-known offset parameter. That allows me to get to the partitions that might be hiding up near the end. But to do that, I had a fairly good idea, what the offset should be. It only took a little bit of searching, by taking snapshots with "dd", to figure out where the file system header was. I doubt one of the older data recovery programs is going to be entirely happy working on your problem. So perhaps you can provide a few details of what you've tried, and I'll see if I can jog my memory as to what I did to fix it. I've worked with the Extended Capacity Manager twice, and both experiences were horrible (blinding rage horrible). The Acronis TrueImage Cleanup Utility is here. It can remove the old driver, if one is present. The Acronis staff thought you could not successfully write one of these, but a user in one of their forums, showed them how. (If the driver is uninstalled in the wrong order, it would cause the OS to blue screen.) http://kb.acronis.com/content/34876 A standalone driver package exists. When I installed this in Windows 8.1 Preview for example, I was able to use the entire 3TB of disk, just as I see it in WinXP today. But the required metadata was already on the disk, for that driver to use. https://kb.acronis.com/system/files/...ksetup2013.zip But what that doesn't do, is it doesn't do the Extended Capacity Manager step. ECM writes a 256KB chunk of metadata, at the 2TiB mark. The upper virtual disk, appears just after that point. And both times I worked with ECM, it *refused* to allow me to click the button, and install. And I didn't keep careful notes, with all the flailing I was doing, of what fixed it. So bottom line is: 1) Your data isn't lost. It can be accessed from Linux, for free, with a bit of work. The upper 747GB or whatever, is treated like a big bitmap. The -o loop option in the Linux mounter, allows a file system to be mounted on a mount point. Even though Linux would not normally allow access above 2TiB on an MBR disk, the offset in the loopback mounter supports 64 bit numbers. 2) Depending on OS, the OSes behave stupidly, even when you do things mostly right. I've tried cranking down the first 2TB partition by small amounts, to get them to behave better. But I think what was really ****ing off the OS, was cylinder offsets (WinXP style) versus megabyte offsets (Windows 7 style). The Extended Capacity Manager, was using one style on the lower disk, and another on the virtual disk. Acronis should be soundly whipped, for the mess they made there. Not a pleasant experience at all, and double the work for me that it should have been. Thank God they made that Cleaner utility, or I'd still be swearing and tearing out my hair! Paul Hi Paul thanks for the reply, boy is this a can of worms i wish i had never opened and stuck with my smaller 1TB Blacks. OK when i started using these 3TB drives i was coming up withthe 2.2TB issue and suggested to use GPT or something like that but what i didn't like was at the begining of the drive was a smaller 128mb hidden partition so i wanted to find a way round it and format the drive keeping it nice and clean and i used so many differnt apps to get it the way I wanted i thinkn i used a free app from Paragon called "Paragon partition manager free edition" but i can't be 100% to be hobnest on how it was formated it could have been a number of way. i was going to reformat it using GPT but thought better of it, as yet i have wrote nothing to the dud drive. I know my data is there but getting it is not straight forward. I am running a new instal of win 7 U x64 to be honest i should be able to get my hands on any of the latest software most offer shareware with option to upgrade to recover so i'm happy to do that, i'm willing to buy anything to get my data back. Jim |
#9
|
|||
|
|||
Best app for partition recovery
On Sun, 16 Feb 2014 22:06:52 +0000, Jim
wrote: I am running a new instal of win 7 U x64 to be honest i should be able to get my hands on any of the latest software most offer shareware with option to upgrade to recover so i'm happy to do that, i'm willing to buy anything to get my data back. Knowledge can be in a currency at times difficult to convert from experience: what irony serves, in this case, that a 3T drive wouldn't offhand avail itself any less readily to a larger function and capacity of storage, at $30US a T, comparatively to $70 for an initial entry offer to platters (or, hypothetically, in silicon SSDs for eminent price-drops at usually some inevitable future point). Right now, I've two docking stations limited to less than 2T drives, and only one DS able to handle 2T. By formatting/partitioning my physical 2T drives, at less than 2T, from a either a MB BIOS, or on that 2T compliant DS, say, for being within a capacity for the less-than-2T docking stations to indeed recognize (for established storage data, copying/writing purposes). Theoretically. Not sure I've back tested that line for a stratagem;- most certainly not at 3T, as I haven't that large of a drive yet. At USB2 10-12MByte transfer speeds, a travail of absurdity, perhaps over days to fill sizeable 3T drives. Reminds me of an early 20 Megabyte drive on dedicated controllers before hard drives were established for a BIOS function. To test 20MBytes of archived data in compression formats, before ZIPS, on a 4.7MHz 8088 or 6MHz NEC V20 necessitates 48 hours. Indeed, how time literally flies when you're having fun, yes? |
#10
|
|||
|
|||
Best app for partition recovery
Jim wrote:
On 16/02/2014 20:48, Paul wrote: Jim wrote: Hi guys thanks for your replies so far i'm in a real pickle here. The drive is a new WD3TB Black, however it is only showing up in recover software as 747GB, i need it to be able to show me what is on the whole 3TB drive any idea folks? I love these fat drives but when you loose em it's a nightmare. Jim Piece of cake. I've seen this, but it's a function of the OS you're using. I get similar symptoms in Win2K. (I have a 3TB WD Black.) It also depends, on what you used to prepare the drive. Western Digital provides a free copy of Acronis TIH, suitable for installing the Extended Capacity Manager. Only problem is, at some point in the past, I installed some other Acronis software, it installed a driver, and the driver was not removable. So the new software, could not install its driver. This complicates the process of getting the Extended Capacity Manager working. I can promise you, that the data is still accessible. I was able to access the upper 747GB, using a loopback mount in Linux, using a little-known offset parameter. That allows me to get to the partitions that might be hiding up near the end. But to do that, I had a fairly good idea, what the offset should be. It only took a little bit of searching, by taking snapshots with "dd", to figure out where the file system header was. I doubt one of the older data recovery programs is going to be entirely happy working on your problem. So perhaps you can provide a few details of what you've tried, and I'll see if I can jog my memory as to what I did to fix it. I've worked with the Extended Capacity Manager twice, and both experiences were horrible (blinding rage horrible). The Acronis TrueImage Cleanup Utility is here. It can remove the old driver, if one is present. The Acronis staff thought you could not successfully write one of these, but a user in one of their forums, showed them how. (If the driver is uninstalled in the wrong order, it would cause the OS to blue screen.) http://kb.acronis.com/content/34876 A standalone driver package exists. When I installed this in Windows 8.1 Preview for example, I was able to use the entire 3TB of disk, just as I see it in WinXP today. But the required metadata was already on the disk, for that driver to use. https://kb.acronis.com/system/files/...ksetup2013.zip But what that doesn't do, is it doesn't do the Extended Capacity Manager step. ECM writes a 256KB chunk of metadata, at the 2TiB mark. The upper virtual disk, appears just after that point. And both times I worked with ECM, it *refused* to allow me to click the button, and install. And I didn't keep careful notes, with all the flailing I was doing, of what fixed it. So bottom line is: 1) Your data isn't lost. It can be accessed from Linux, for free, with a bit of work. The upper 747GB or whatever, is treated like a big bitmap. The -o loop option in the Linux mounter, allows a file system to be mounted on a mount point. Even though Linux would not normally allow access above 2TiB on an MBR disk, the offset in the loopback mounter supports 64 bit numbers. 2) Depending on OS, the OSes behave stupidly, even when you do things mostly right. I've tried cranking down the first 2TB partition by small amounts, to get them to behave better. But I think what was really ****ing off the OS, was cylinder offsets (WinXP style) versus megabyte offsets (Windows 7 style). The Extended Capacity Manager, was using one style on the lower disk, and another on the virtual disk. Acronis should be soundly whipped, for the mess they made there. Not a pleasant experience at all, and double the work for me that it should have been. Thank God they made that Cleaner utility, or I'd still be swearing and tearing out my hair! Paul Hi Paul thanks for the reply, boy is this a can of worms i wish i had never opened and stuck with my smaller 1TB Blacks. OK when i started using these 3TB drives i was coming up withthe 2.2TB issue and suggested to use GPT or something like that but what i didn't like was at the begining of the drive was a smaller 128mb hidden partition so i wanted to find a way round it and format the drive keeping it nice and clean and i used so many differnt apps to get it the way I wanted i thinkn i used a free app from Paragon called "Paragon partition manager free edition" but i can't be 100% to be hobnest on how it was formated it could have been a number of way. i was going to reformat it using GPT but thought better of it, as yet i have wrote nothing to the dud drive. I know my data is there but getting it is not straight forward. I am running a new instal of win 7 U x64 to be honest i should be able to get my hands on any of the latest software most offer shareware with option to upgrade to recover so i'm happy to do that, i'm willing to buy anything to get my data back. Jim According to this, the partition type on the protective MBR would be 0xEE if you had set it up GPT. http://en.wikipedia.org/wiki/GUID_Partition_Table You can use PTEDIT32, to look at the MBR partition table. Even if it's the "fake" "protective" MBR, you can still look at it to verify you did set it up as GPT. You unzip that first. Then, right click on the ptedit32.exe program, and select "Run as Administrator". The program returns an Error 5 if you attempt to use it without the Administrator authority (since it accesses the raw disk). ftp://ftp.symantec.com/public/englis...s/PTEDIT32.zip Once you've got some positive feedback, as to what it is, you can try TestDisk, as a confidence builder. The idea would be, to see if TestDisk sees GPT or not. http://en.wikipedia.org/wiki/Testdisk "TestDisk recognizes the following disk partitioning: ... GUID Partition Table === GPT " Note that, most of the time, you get an "opinion" from TestDisk, and don't accept it's offer to write anything back. If you need to quit TestDisk, you can press control-C to stop it. It would probably take a long time, for it to scan the whole disk on 1MB boundaries or something, looking for file system headers. The reason for not immediately accepting an offer to write a new disk header, is because it doesn't do enough checks and balances. But still, it can be educational, to see what it is capable of digging up. TestDisk can display the file names in a partition it finds. Which would be another confidence builder. http://www.cgsecurity.org/mw/images/List_files.gif ( http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step ) ******* The article on "GUID_Partition_Table" says: "GPT also provides redundancy, writing the GPT header and partition table both at the beginning and at the end of the disk. " That suggests to me, if something has "gone missing", it's the file system header in the partition itself that got damaged somehow. You might also check Event Viewer, to see if the software that attempts to mount file systems, has left any error message(s) about what it found. Using CHKDSK, would be reserved for the home stretch, when the partition is mountable. CHKDSK is a double-edged sword, in that, if the disk is health, it's probably worth running. If the disk has problems with read/write or mechanical problems, CHKDSK can make things much worse than when you started. CHKDSK has been known to entirely trash a partition, when the disk itself is sick or an IDE cable is slightly loose. Paul |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
"OEM Partition" & Recovery partition on Dell Win7 PC | Timothy Daniels[_4_] | Dell Computers | 5 | May 7th 13 06:10 AM |
Partition Recovery | JohnB | Storage (alternative) | 2 | January 29th 12 07:10 AM |
Jsut bought a new Hard Drive. How do I copy both XP partition and Recovery Partition onto the new HD? | lee | Compaq Computers | 1 | August 1st 06 11:33 AM |
Partition File Structure Recovery: NTFS Partition | [email protected] | General | 1 | September 9th 05 06:02 AM |
Lost Partition/Data - Recovery? Partition? Filenames? | dave | Storage (alternative) | 1 | February 7th 05 05:37 PM |