[SOLVED] NTFS partitions deleted by the Disk Utility of iPC OSx86 10.5.6

[antagoniser]

Hey guys,

 

My english is not so good, so i've translated my problem with google translate and edited it a little bit after. Here it is:

 

Yesterday I tried to install iPC OSx86 10.5.6 on my harddisk, but it went quite wrong. My harddisk is a Samsung SpinPoint F1 HD103UJ on which were initially 3 partitions in this order:

 

1. EXT3 55Gb -> Kubuntu 9.04

2. NTFS 15 Gb -> Windows XP Pro

3. NTFS + - 860Gb -> Important data (family photos, papers from school etc.)

 

The problem: I tried to install IPC OSx86 Univeral, but ended up losing all my partitions. I wanted to install OSx86 IPC on the first partition, where Kubuntu used to be. Before the installation I selected partition1 and formatted it with the included Disk Utility to the Mac OS Extended Journaled format (HFS +), as was stated in the manual. To my surprise, all other partitions were removed and there was only one partition of 55 Gb (the one that used to be kubuntu). I have tried to repair, but then got an error. See this screenshot: http://i.imagehost.org/t/0283/IMAG0014.jpg[/img]. It would not be wise to start the installation, so I closed the wizard...

 

Luckily I had an rescue live disk with TestDisk 6.11 and GParted. In GParted only one partition was recognized as unknown type and there was +- 875Gb unallocated space, this is where the lost ntfs partitions should be. According to many forums TestDisk seems to be a lifesaver for such problems, but I'm not really sure where to begin . Which choice should I make if I do not know what kind of partition table TestDisk should expect. Intel/PC, Mac, EFI GPT..?See screenshot:http://i.imagehost.org/view/0102/IMAG0011

When I use Intel / PC partition and then select the disk to analyze, after the analyse I get a message about a wrong number of heads per cylinder. See screenshot: http://i.imagehost.org/view/0264/IMAG0003

If I then click continue I get a list containing only one NTFS partition of 8Mb, thats not really much. See screenshot:http://i.imagehost.org/view/0395/IMAG0004

However, if I choose EFI GPT partition map in the menu, while analyzing I get a whole list of parts / remains of partitions. After analyzing an error comes back, this time about the size of the disk. When i click continue i get a list of found partitions and when selecting partition 2 I can recover the files, thats the partition with Windows XP on it. Partition 3 is the one with important data, but i cant find it See the screenshots, 3rd shot is the XP partition that i found.

http://h.imagehost.org/view/0887/IMAG0008

http://i.imagehost.org/view/0218/IMAG0009

http://a.imagehost.org/view/0468/IMAG0010

 

I've searched on Google all day, tweakers.net (a Dutch tech forum) and other forums, but never come to a solution to this problem.

 

My questions are; is it possible for the partitions, or at least for partition 3 with important data, to restore the disk as it was as previously? Since I did not write any files to the disk, I think there is no actual data lost. Can this be repaired with Test Disk? If not, should i buy an 1Tb disk and using a program like R-Studio disc bit-for-bit read and find the data to write to the new drive? Are there chances that most data has become corrupt? It would be nice if someone with some knowledge / experience of data recovery could help me with this problem or at least point me a step in the right direction.

[vilpostus]

There is a chance that restoring the MBR with XP install cd may solve the problem. http://www.tippscout.de/repair-and-restore..._tipp_3114.html

 

But be really careful, a wrong step may be lethal.

[antagoniser]

There is a chance that restoring the MBR with XP install cd may solve the problem. http://www.tippscout.de/repair-and-restore..._tipp_3114.html

 

But be really careful, a wrong step may be lethal.

Thanks for the hint! I will inform myself a bit more before i try this out.

 

Edit: The problem described in this topic is similar to mine if i'm correct. So it basically doesn't matter that the ntfs-partitions are gone and i only have one 'unknown' partition of 55 gb. By fixing the MBR/boot sectors the ntfs-partitions can be restored?

[vilpostus]

By fixing the MBR/boot sectors the ntfs-partitions can be restored?

Should be, unless you have formatted the drive and installed some other OS on top. Usually after formatting the disk the information on the disk is still recoverable to some state. So you should restore all the info.

[srs5694]

Thanks for the hint! I will inform myself a bit more before i try this out.

 

Edit: The problem described in this topic is similar to mine if i'm correct. So it basically doesn't matter that the ntfs-partitions are gone and i only have one 'unknown' partition of 55 gb. By fixing the MBR/boot sectors the ntfs-partitions can be restored?

 

Your link doesn't work for me.

 

Some basics: Partitions are just sections of the disk. Think of the partition table as being like the table of contents of a book, and the partitions as being chapters. If somebody tells you, "read Chapter 4 of this book," you can look in the table of contents to find the page number where Chapter 4 begins and then use the page numbers printed on each page to find Chapter 4. If your partition table (stored in the MBR) is trashed, though, it's like having the table of contents ripped out of the book. Now to find Chapter 4, you've got to page through the book until you find the identifying chapter heading. In the case of a trashed partition table on a disk, it's even harder, since you've got to search for the identifying data for the filesystem that the partition contains, potentially through the whole disk. Old data (from abandoned older partitions) or just plain random data that resembles real filesystem identifiers can complicate this search. Doing such a search requires special software.

 

Under Linux, GNU Parted contains a feature to search for trashed filesystem data. This feature has never worked for me, but you might get lucky with it. It sounds as if you've located another such program, but it's not working too well for you.

 

My recommendation is to do this:

 

1. Do a low-level copy of the disk to another disk of equal or larger size, as in "dd if=/dev/sda of=/dev/sdb" under Linux to copy /dev/sda to /dev/sdb. Be sure to get the device IDs right! If you reverse them, you'll never recover your data!
   
2. Remove either the original or the backup disk from the computer, so you'll have it in case your repair attempts make matters worse.
   
3. Search for Windows emergency recovery tools. One I found that sounds promising is Partition Table Doctor. Note that I've never used it, though, so I can't promise that it'll work. You may want to post to a Windows-specific forum or Usenet newsgroup for advice on what to use, since it's Windows data you're trying to recover.
   
4. If necessary, install Windows to a third hard disk so you can use the tool(s) you've acquired in the previous step.
   
5. Use your recovery tools to attempt to recover your important data. Your description sounds like nothing got written to the areas used by the important lost partitions, so in theory it should be possible to recover all your data; but I can't make any promises about this.
   

 

In the future, you may want to keep a record of your partition table layouts. Under Linux or Mac OS X, you can use dd to copy the MBR on MBR-partitioned disks (as in "dd if=/dev/sda of=sda-backup.mbr bs=512 count=1"), which will enable easy restoration if something like this happens again. (You'd obviously store the backup data on a removable disk or another computer. You should also update these backups if/when you make partition table changes.) GPT disks are harder to back up, since their data appears at both the start and the end of the disk. My own GPT fdisk

program will do the job, though.

[antagoniser]

The link of the topic with similar problem: http://www.insanelymac.com/forum/index.php?showtopic=143345

[srs5694]

I believe your problem is entirely different, although I could be wrong. The problem in the post to which you linked was that the person accidentally formatted the partition. This doesn't affect the partition definition in the partition table, but it does overwrite at least some of the partition's data. It would be like painting the pages of a book with White-Out, but leaving the table of contents intact. Your problem is that you've accidentally deleted the partition from the partition table. As I said in my previous post, this is like ripping out (or painting over with White-Out) the book's table of contents, but leaving the chapters of the book intact. Your problem renders the data inaccessible because the filesystems in the partitions can't be found, but the data remain intact. If you can re-create your partition table, you'll be able to recover all your data.

 

This analysis, of course, assumes that both problems were accurately described and that I'm interpreting both descriptions correctly. For instance, in your original post, you specified that you ended up with one 55GB HFS+ partition, which suggests that the OS X installer wiped the Linux partition (which you don't care about) and left your Windows NTFS partitions untouched. If this analysis is incorrect, though, it could be that OS X laid out HFS+ data over the NTFS partitions, thus damaging them above and beyond deleting their partition table entries. With any luck, CHKDSK in Windows should be able to handle such problems after you've restored the MBR entries for your NTFS partitions. In any event, your first task must be to restore your partition table -- that is, to re-create the table of contents, to revisit the book analogy.

[antagoniser]

Thank you very much for the clear explanation. I am bit of a noob and don't know much about partitioning etc, so it's nice to have an expert like you to help me out. I think i begin to understand the situation. On other forums i've read several solutions, but many of them are unclear and not well documented. To increase the chance of getting back my data, i consider following your advice is the best option.

 

In short, the first thing to do is to backup the damaged disk and then install windows to a third disk with the tools you mentioned before. Then, with some luck, it's possible to restore the partition table. Once this is done, it should be easy to get the files back?

[srs5694]

Windows installation on a third disk will enable you to run Windows-based recovery tools. Other tools, such as GNU Parted, might work from a Linux emergency boot CD/DVD, but my own rate of success with such tools has been very low.

 

If you're successful in restoring the partitions, and if Disk Utility really did format just your former Linux partition, then there'll be no need to do more recovery; Windows should boot, or at the very least you'll have full access to the files from a fresh Windows installation, if you go that route. These are two rather big ifs, though. You'll just have to try it and see how it goes....

[antagoniser]

Great news: i've found the partitions! In Hiren's BootCD there is a program called Partition Find & Mount. With this tool i was able to mount the lost partitions. Then i copied all my important data to an external HDD and formatted the whole drive.