A computer components & hardware forum. HardwareBanter

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

Go Back   Home » HardwareBanter forum » General Hardware & Peripherals » Homebuilt PC's
Site Map Home Register Authors List Search Today's Posts Mark Forums Read Web Partners

Best app for partition recovery



 
 
Thread Tools Display Modes
  #1  
Old February 16th 14, 01:51 PM posted to alt.comp.hardware.pc-homebuilt
Jim[_38_]
external usenet poster
 
Posts: 58
Default Best app for partition recovery

Any suggestions for a decent app to recover lost partitions?
  #2  
Old February 16th 14, 02:08 PM posted to alt.comp.hardware.pc-homebuilt
Flasherly[_2_]
external usenet poster
 
Posts: 2,407
Default Best app for partition recovery

On Sun, 16 Feb 2014 12:51:44 +0000, Jim
wrote:

Any suggestions for a decent app to recover lost partitions?


Easeus
  #3  
Old February 16th 14, 04:26 PM posted to alt.comp.hardware.pc-homebuilt
Mr. Man-wai Chang
external usenet poster
 
Posts: 697
Default Best app for partition recovery

On 16/2/14 8:51 PM, Jim wrote:
Any suggestions for a decent app to recover lost partitions?


SUGGESTION:

Don't try to do two things at the same time and with one single tool.

First, restore the partition table.

Then you restore the data inside the partition.

Whatever you do, **DO NOT** directly modify the content of the hard disk
in question. Files restored should be copied to another hard disk. Tools
like Recuva does this.

--
@~@ Remain silent. Nothing from soldiers and magicians is real!
/ v \ Simplicity is Beauty! May the Force and farces be with you!
/( _ )\ (Fedora 19 i686) Linux 3.12.9-201.fc19.i686
^ ^ 23:18:03 up 2 days 3:05 1 user load average: 0.20 0.13 0.08
¤£*ɶU! ¤£¶BÄF! ¤£´©¥æ! ¤£¥´¥æ! ¤£¥´§T! ¤£¦Û±þ! ½Ð¦Ò¼{ºî´© (CSSA):
http://www.swd.gov.hk/tc/index/site_...sub_addressesa
  #4  
Old February 16th 14, 04:27 PM posted to alt.comp.hardware.pc-homebuilt
Mr. Man-wai Chang
external usenet poster
 
Posts: 697
Default Best app for partition recovery

On 16/2/14 11:26 PM, Mr. Man-wai Chang wrote:
Whatever you do, **DO NOT** directly modify the content of the hard disk
in question. Files restored should be copied to another hard disk. Tools
like Recuva does this.


A simpler way is to clone the hard disk first, then use recovery tools
on this copy of the hard disk.

--
@~@ Remain silent. Nothing from soldiers and magicians is real!
/ v \ Simplicity is Beauty! May the Force and farces be with you!
/( _ )\ (Fedora 19 i686) Linux 3.12.9-201.fc19.i686
^ ^ 23:24:02 up 2 days 3:11 0 users load average: 0.05 0.06 0.06
¤£*ɶU! ¤£¶BÄF! ¤£´©¥æ! ¤£¥´¥æ! ¤£¥´§T! ¤£¦Û±þ! ½Ð¦Ò¼{ºî´© (CSSA):
http://www.swd.gov.hk/tc/index/site_...sub_addressesa
  #5  
Old February 16th 14, 04:29 PM posted to alt.comp.hardware.pc-homebuilt
Paul
external usenet poster
 
Posts: 13,364
Default Best app for partition recovery

Jim wrote:
Any suggestions for a decent app to recover lost partitions?


There are "two levels of lost".

If the MBR is damaged or overwritten, then the individual
partitions can no longer be found. For that, you use TestDisk.

TestDisk computes new values for the partition table, based
on the file system headers it finds. The method is problematic,
in that a deleted partition can be relocated. And, the tool
doesn't necessarily check for or detect overlap in the
definition of partitions. It's up to the human operator,
to judge whether the new, proposed, MBR value is any good.
So in a sense, it's far from fool proof. You have to eyeball
the results, and decide whether "the disk originally had
two partitions, a small one and a big one".

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

At the next level, is Disk Management shows the partitions
OK, but one of the partitions doesn't have any type information.
Perhaps the partition will no longer mount. In that case,
you need something to recover the partition.

The only free one I know of, with initial NTFS support,
is Drive Rescue. Which is ancient.

http://web.archive.org/web/200701010...rescue19d.html

This is a screen shot of Drive Rescue at work.

http://imageshack.us/a/img822/1299/evie.gif

*******

For forensic work, you need two hard drives. One
hard drive, holds an exact sector-by-sector copy
of the damaged disk. The second spare hard drive,
is where DriveRescue is going to save the recovered
files.

*******

There are many $39.95 recovery softwares. And
some of them are designed to show the file names,
as a teaser, to prove the tool can find them.
(That's the "trial mode" of the product.)
You then pay your $39.95, and see whether the tool
actually works and can recover them. I have no
experience with any of these, because I don't
have N * $39.95 to waste :-)

Good luck,
Paul
  #6  
Old February 16th 14, 09:24 PM posted to alt.comp.hardware.pc-homebuilt
Jim[_38_]
external usenet poster
 
Posts: 58
Default Best app for partition recovery

On 16/02/2014 15:29, Paul wrote:
Jim wrote:
Any suggestions for a decent app to recover lost partitions?


There are "two levels of lost".

If the MBR is damaged or overwritten, then the individual
partitions can no longer be found. For that, you use TestDisk.

TestDisk computes new values for the partition table, based
on the file system headers it finds. The method is problematic,
in that a deleted partition can be relocated. And, the tool
doesn't necessarily check for or detect overlap in the
definition of partitions. It's up to the human operator,
to judge whether the new, proposed, MBR value is any good.
So in a sense, it's far from fool proof. You have to eyeball
the results, and decide whether "the disk originally had
two partitions, a small one and a big one".

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

At the next level, is Disk Management shows the partitions
OK, but one of the partitions doesn't have any type information.
Perhaps the partition will no longer mount. In that case,
you need something to recover the partition.

The only free one I know of, with initial NTFS support,
is Drive Rescue. Which is ancient.

http://web.archive.org/web/200701010...rescue19d.html


This is a screen shot of Drive Rescue at work.

http://imageshack.us/a/img822/1299/evie.gif

*******

For forensic work, you need two hard drives. One
hard drive, holds an exact sector-by-sector copy
of the damaged disk. The second spare hard drive,
is where DriveRescue is going to save the recovered
files.

*******

There are many $39.95 recovery softwares. And
some of them are designed to show the file names,
as a teaser, to prove the tool can find them.
(That's the "trial mode" of the product.)
You then pay your $39.95, and see whether the tool
actually works and can recover them. I have no
experience with any of these, because I don't
have N * $39.95 to waste :-)

Good luck,
Paul

Hi guys thanks for your replies so far i'm in a real pickle here.
The drive is a new WD3TB Black, however it is only showing up in recover
software as 747GB, i need it to be able to show me what is on the whole
3TB drive any idea folks?
I love these fat drives but when you loose em it's a nightmare.

Jim
  #7  
Old February 16th 14, 09:48 PM posted to alt.comp.hardware.pc-homebuilt
Paul
external usenet poster
 
Posts: 13,364
Default Best app for partition recovery

Jim wrote:

Hi guys thanks for your replies so far i'm in a real pickle here.
The drive is a new WD3TB Black, however it is only showing up in recover
software as 747GB, i need it to be able to show me what is on the whole
3TB drive any idea folks?
I love these fat drives but when you loose em it's a nightmare.

Jim


Piece of cake. I've seen this, but it's a function of
the OS you're using. I get similar symptoms in Win2K.
(I have a 3TB WD Black.)

It also depends, on what you used to prepare the drive.
Western Digital provides a free copy of Acronis TIH, suitable
for installing the Extended Capacity Manager. Only problem is,
at some point in the past, I installed some other Acronis
software, it installed a driver, and the driver was not
removable. So the new software, could not install its driver.
This complicates the process of getting the
Extended Capacity Manager working.

I can promise you, that the data is still accessible. I was
able to access the upper 747GB, using a loopback mount in
Linux, using a little-known offset parameter. That allows
me to get to the partitions that might be hiding up near
the end. But to do that, I had a fairly good idea, what
the offset should be. It only took a little bit of searching,
by taking snapshots with "dd", to figure out where the file
system header was.

I doubt one of the older data recovery programs is going
to be entirely happy working on your problem. So perhaps
you can provide a few details of what you've tried, and
I'll see if I can jog my memory as to what I did to fix it.

I've worked with the Extended Capacity Manager twice,
and both experiences were horrible (blinding rage horrible).

The Acronis TrueImage Cleanup Utility is here. It
can remove the old driver, if one is present. The Acronis
staff thought you could not successfully write one of these,
but a user in one of their forums, showed them how.
(If the driver is uninstalled in the wrong order, it
would cause the OS to blue screen.)

http://kb.acronis.com/content/34876

A standalone driver package exists. When I installed
this in Windows 8.1 Preview for example, I was able
to use the entire 3TB of disk, just as I see it in
WinXP today. But the required metadata was already on
the disk, for that driver to use.

https://kb.acronis.com/system/files/...ksetup2013.zip

But what that doesn't do, is it doesn't do the
Extended Capacity Manager step. ECM writes a 256KB
chunk of metadata, at the 2TiB mark. The upper virtual
disk, appears just after that point. And both times I
worked with ECM, it *refused* to allow me to click the
button, and install. And I didn't keep careful notes,
with all the flailing I was doing, of what fixed it.

So bottom line is:

1) Your data isn't lost. It can be accessed from Linux, for
free, with a bit of work. The upper 747GB or whatever,
is treated like a big bitmap. The -o loop option in the
Linux mounter, allows a file system to be mounted on a
mount point. Even though Linux would not normally allow
access above 2TiB on an MBR disk, the offset in the loopback
mounter supports 64 bit numbers.

2) Depending on OS, the OSes behave stupidly, even when you
do things mostly right. I've tried cranking down the
first 2TB partition by small amounts, to get them to behave
better. But I think what was really ****ing off the OS,
was cylinder offsets (WinXP style) versus megabyte offsets
(Windows 7 style). The Extended Capacity Manager, was using
one style on the lower disk, and another on the virtual disk.

Acronis should be soundly whipped, for the mess they made there.
Not a pleasant experience at all, and double the work for
me that it should have been. Thank God they made that
Cleaner utility, or I'd still be swearing and tearing
out my hair!

Paul
  #8  
Old February 16th 14, 11:06 PM posted to alt.comp.hardware.pc-homebuilt
Jim[_38_]
external usenet poster
 
Posts: 58
Default Best app for partition recovery

On 16/02/2014 20:48, Paul wrote:
Jim wrote:

Hi guys thanks for your replies so far i'm in a real pickle here.
The drive is a new WD3TB Black, however it is only showing up in
recover software as 747GB, i need it to be able to show me what is on
the whole 3TB drive any idea folks?
I love these fat drives but when you loose em it's a nightmare.

Jim


Piece of cake. I've seen this, but it's a function of
the OS you're using. I get similar symptoms in Win2K.
(I have a 3TB WD Black.)

It also depends, on what you used to prepare the drive.
Western Digital provides a free copy of Acronis TIH, suitable
for installing the Extended Capacity Manager. Only problem is,
at some point in the past, I installed some other Acronis
software, it installed a driver, and the driver was not
removable. So the new software, could not install its driver.
This complicates the process of getting the
Extended Capacity Manager working.

I can promise you, that the data is still accessible. I was
able to access the upper 747GB, using a loopback mount in
Linux, using a little-known offset parameter. That allows
me to get to the partitions that might be hiding up near
the end. But to do that, I had a fairly good idea, what
the offset should be. It only took a little bit of searching,
by taking snapshots with "dd", to figure out where the file
system header was.

I doubt one of the older data recovery programs is going
to be entirely happy working on your problem. So perhaps
you can provide a few details of what you've tried, and
I'll see if I can jog my memory as to what I did to fix it.

I've worked with the Extended Capacity Manager twice,
and both experiences were horrible (blinding rage horrible).

The Acronis TrueImage Cleanup Utility is here. It
can remove the old driver, if one is present. The Acronis
staff thought you could not successfully write one of these,
but a user in one of their forums, showed them how.
(If the driver is uninstalled in the wrong order, it
would cause the OS to blue screen.)

http://kb.acronis.com/content/34876

A standalone driver package exists. When I installed
this in Windows 8.1 Preview for example, I was able
to use the entire 3TB of disk, just as I see it in
WinXP today. But the required metadata was already on
the disk, for that driver to use.

https://kb.acronis.com/system/files/...ksetup2013.zip


But what that doesn't do, is it doesn't do the
Extended Capacity Manager step. ECM writes a 256KB
chunk of metadata, at the 2TiB mark. The upper virtual
disk, appears just after that point. And both times I
worked with ECM, it *refused* to allow me to click the
button, and install. And I didn't keep careful notes,
with all the flailing I was doing, of what fixed it.

So bottom line is:

1) Your data isn't lost. It can be accessed from Linux, for
free, with a bit of work. The upper 747GB or whatever,
is treated like a big bitmap. The -o loop option in the
Linux mounter, allows a file system to be mounted on a
mount point. Even though Linux would not normally allow
access above 2TiB on an MBR disk, the offset in the loopback
mounter supports 64 bit numbers.

2) Depending on OS, the OSes behave stupidly, even when you
do things mostly right. I've tried cranking down the
first 2TB partition by small amounts, to get them to behave
better. But I think what was really ****ing off the OS,
was cylinder offsets (WinXP style) versus megabyte offsets
(Windows 7 style). The Extended Capacity Manager, was using
one style on the lower disk, and another on the virtual disk.

Acronis should be soundly whipped, for the mess they made there.
Not a pleasant experience at all, and double the work for
me that it should have been. Thank God they made that
Cleaner utility, or I'd still be swearing and tearing
out my hair!

Paul

Hi Paul thanks for the reply, boy is this a can of worms i wish i had
never opened and stuck with my smaller 1TB Blacks.

OK when i started using these 3TB drives i was coming up withthe 2.2TB
issue and suggested to use GPT or something like that but what i didn't
like was at the begining of the drive was a smaller 128mb hidden
partition so i wanted to find a way round it and format the drive
keeping it nice and clean and i used so many differnt apps to get it the
way I wanted i thinkn i used a free app from Paragon called "Paragon
partition manager free edition" but i can't be 100% to be hobnest on how
it was formated it could have been a number of way. i was going to
reformat it using GPT but thought better of it, as yet i have wrote
nothing to the dud drive. I know my data is there but getting it is not
straight forward.

I am running a new instal of win 7 U x64 to be honest i should be able
to get my hands on any of the latest software most offer shareware with
option to upgrade to recover so i'm happy to do that, i'm willing to buy
anything to get my data back.

Jim
  #9  
Old February 17th 14, 01:03 AM posted to alt.comp.hardware.pc-homebuilt
Flasherly[_2_]
external usenet poster
 
Posts: 2,407
Default Best app for partition recovery

On Sun, 16 Feb 2014 22:06:52 +0000, Jim
wrote:

I am running a new instal of win 7 U x64 to be honest i should be able
to get my hands on any of the latest software most offer shareware with
option to upgrade to recover so i'm happy to do that, i'm willing to buy
anything to get my data back.


Knowledge can be in a currency at times difficult to convert from
experience: what irony serves, in this case, that a 3T drive wouldn't
offhand avail itself any less readily to a larger function and
capacity of storage, at $30US a T, comparatively to $70 for an initial
entry offer to platters (or, hypothetically, in silicon SSDs for
eminent price-drops at usually some inevitable future point).

Right now, I've two docking stations limited to less than 2T drives,
and only one DS able to handle 2T. By formatting/partitioning my
physical 2T drives, at less than 2T, from a either a MB BIOS, or on
that 2T compliant DS, say, for being within a capacity for the
less-than-2T docking stations to indeed recognize (for established
storage data, copying/writing purposes).

Theoretically. Not sure I've back tested that line for a stratagem;-
most certainly not at 3T, as I haven't that large of a drive yet.

At USB2 10-12MByte transfer speeds, a travail of absurdity, perhaps
over days to fill sizeable 3T drives.

Reminds me of an early 20 Megabyte drive on dedicated controllers
before hard drives were established for a BIOS function. To test
20MBytes of archived data in compression formats, before ZIPS, on a
4.7MHz 8088 or 6MHz NEC V20 necessitates 48 hours.

Indeed, how time literally flies when you're having fun, yes?
  #10  
Old February 17th 14, 01:57 AM posted to alt.comp.hardware.pc-homebuilt
Paul
external usenet poster
 
Posts: 13,364
Default Best app for partition recovery

Jim wrote:
On 16/02/2014 20:48, Paul wrote:
Jim wrote:

Hi guys thanks for your replies so far i'm in a real pickle here.
The drive is a new WD3TB Black, however it is only showing up in
recover software as 747GB, i need it to be able to show me what is on
the whole 3TB drive any idea folks?
I love these fat drives but when you loose em it's a nightmare.

Jim


Piece of cake. I've seen this, but it's a function of
the OS you're using. I get similar symptoms in Win2K.
(I have a 3TB WD Black.)

It also depends, on what you used to prepare the drive.
Western Digital provides a free copy of Acronis TIH, suitable
for installing the Extended Capacity Manager. Only problem is,
at some point in the past, I installed some other Acronis
software, it installed a driver, and the driver was not
removable. So the new software, could not install its driver.
This complicates the process of getting the
Extended Capacity Manager working.

I can promise you, that the data is still accessible. I was
able to access the upper 747GB, using a loopback mount in
Linux, using a little-known offset parameter. That allows
me to get to the partitions that might be hiding up near
the end. But to do that, I had a fairly good idea, what
the offset should be. It only took a little bit of searching,
by taking snapshots with "dd", to figure out where the file
system header was.

I doubt one of the older data recovery programs is going
to be entirely happy working on your problem. So perhaps
you can provide a few details of what you've tried, and
I'll see if I can jog my memory as to what I did to fix it.

I've worked with the Extended Capacity Manager twice,
and both experiences were horrible (blinding rage horrible).

The Acronis TrueImage Cleanup Utility is here. It
can remove the old driver, if one is present. The Acronis
staff thought you could not successfully write one of these,
but a user in one of their forums, showed them how.
(If the driver is uninstalled in the wrong order, it
would cause the OS to blue screen.)

http://kb.acronis.com/content/34876

A standalone driver package exists. When I installed
this in Windows 8.1 Preview for example, I was able
to use the entire 3TB of disk, just as I see it in
WinXP today. But the required metadata was already on
the disk, for that driver to use.

https://kb.acronis.com/system/files/...ksetup2013.zip


But what that doesn't do, is it doesn't do the
Extended Capacity Manager step. ECM writes a 256KB
chunk of metadata, at the 2TiB mark. The upper virtual
disk, appears just after that point. And both times I
worked with ECM, it *refused* to allow me to click the
button, and install. And I didn't keep careful notes,
with all the flailing I was doing, of what fixed it.

So bottom line is:

1) Your data isn't lost. It can be accessed from Linux, for
free, with a bit of work. The upper 747GB or whatever,
is treated like a big bitmap. The -o loop option in the
Linux mounter, allows a file system to be mounted on a
mount point. Even though Linux would not normally allow
access above 2TiB on an MBR disk, the offset in the loopback
mounter supports 64 bit numbers.

2) Depending on OS, the OSes behave stupidly, even when you
do things mostly right. I've tried cranking down the
first 2TB partition by small amounts, to get them to behave
better. But I think what was really ****ing off the OS,
was cylinder offsets (WinXP style) versus megabyte offsets
(Windows 7 style). The Extended Capacity Manager, was using
one style on the lower disk, and another on the virtual disk.

Acronis should be soundly whipped, for the mess they made there.
Not a pleasant experience at all, and double the work for
me that it should have been. Thank God they made that
Cleaner utility, or I'd still be swearing and tearing
out my hair!

Paul

Hi Paul thanks for the reply, boy is this a can of worms i wish i had
never opened and stuck with my smaller 1TB Blacks.

OK when i started using these 3TB drives i was coming up withthe 2.2TB
issue and suggested to use GPT or something like that but what i didn't
like was at the begining of the drive was a smaller 128mb hidden
partition so i wanted to find a way round it and format the drive
keeping it nice and clean and i used so many differnt apps to get it the
way I wanted i thinkn i used a free app from Paragon called "Paragon
partition manager free edition" but i can't be 100% to be hobnest on how
it was formated it could have been a number of way. i was going to
reformat it using GPT but thought better of it, as yet i have wrote
nothing to the dud drive. I know my data is there but getting it is not
straight forward.

I am running a new instal of win 7 U x64 to be honest i should be able
to get my hands on any of the latest software most offer shareware with
option to upgrade to recover so i'm happy to do that, i'm willing to buy
anything to get my data back.

Jim


According to this, the partition type on the protective MBR would be
0xEE if you had set it up GPT.

http://en.wikipedia.org/wiki/GUID_Partition_Table

You can use PTEDIT32, to look at the MBR partition table. Even if
it's the "fake" "protective" MBR, you can still look at it to verify
you did set it up as GPT. You unzip that first. Then, right click
on the ptedit32.exe program, and select "Run as Administrator". The
program returns an Error 5 if you attempt to use it without the
Administrator authority (since it accesses the raw disk).

ftp://ftp.symantec.com/public/englis...s/PTEDIT32.zip

Once you've got some positive feedback, as to what it is,
you can try TestDisk, as a confidence builder. The idea
would be, to see if TestDisk sees GPT or not.

http://en.wikipedia.org/wiki/Testdisk

"TestDisk recognizes the following disk partitioning:

...
GUID Partition Table === GPT
"

Note that, most of the time, you get an "opinion" from TestDisk,
and don't accept it's offer to write anything back. If you
need to quit TestDisk, you can press control-C to stop it.
It would probably take a long time, for it to scan the whole
disk on 1MB boundaries or something, looking for file system
headers. The reason for not immediately accepting an offer
to write a new disk header, is because it doesn't do enough
checks and balances. But still, it can be educational, to
see what it is capable of digging up.

TestDisk can display the file names in a partition it finds.
Which would be another confidence builder.

http://www.cgsecurity.org/mw/images/List_files.gif

( http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step )

*******

The article on "GUID_Partition_Table" says:

"GPT also provides redundancy, writing the GPT header and
partition table both at the beginning and at the end of
the disk.
"

That suggests to me, if something has "gone missing", it's
the file system header in the partition itself that
got damaged somehow.

You might also check Event Viewer, to see if the
software that attempts to mount file systems, has left
any error message(s) about what it found.

Using CHKDSK, would be reserved for the home stretch,
when the partition is mountable. CHKDSK is a double-edged sword,
in that, if the disk is health, it's probably worth running.
If the disk has problems with read/write or mechanical problems,
CHKDSK can make things much worse than when you started. CHKDSK
has been known to entirely trash a partition, when the disk itself
is sick or an IDE cable is slightly loose.

Paul
 




Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
"OEM Partition" & Recovery partition on Dell Win7 PC Timothy Daniels[_4_] Dell Computers 5 May 7th 13 06:10 AM
Partition Recovery JohnB Storage (alternative) 2 January 29th 12 08:10 AM
Jsut bought a new Hard Drive. How do I copy both XP partition and Recovery Partition onto the new HD? lee Compaq Computers 1 August 1st 06 11:33 AM
Partition File Structure Recovery: NTFS Partition [email protected] General 1 September 9th 05 06:02 AM
Lost Partition/Data - Recovery? Partition? Filenames? dave Storage (alternative) 1 February 7th 05 06:37 PM


All times are GMT +1. The time now is 11:24 AM.


Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Copyright ©2004-2024 HardwareBanter.
The comments are property of their posters.