Partition Trouble, Data There But Not Accessible

[Charlie Deuce]

I have looked through other posts on similar topics and can't seem to figure out what to do.

I have 1 TB WDC Physical Drive. It is partitioned into E and F.

Windows 7 can see and Utilize E. But asks me to format F.

Afterward F is not able to be viewed in Computer Management/Disk Management. However E shows up as the full formatted NTFS drive capacity of 931.51 GB.

I've run DMDE and selected the appropriate drive and the following 2 screens resulted along with a hex page that didn't stay up long. I'm not sure what to do next to fix the partition.

http://

http://

 

[lantrich]

Your hard drive has a partition that holds the boot record. That is your drive f. Leave it alone. Think about it. Drive E is 931.51 GB. That is the entire drive minus the part you can't access. There is no problem.

 

[Charlie Deuce]

Your hard drive has a partition that holds the boot record. That is your drive f. Leave it alone. Think about it. Drive E is 931.51 GB. That is the entire drive minus the part you can't access. There is no problem.

No. With all due respect, before I couldn't access drive F, drive E was partitioned at 576 GB and drive F had the remainder. There is data in drive F that I've saved there.

 

[ArtPog]

Just to clarify the situation & problem...

1. You originally multi-partitioned the 1 TB HDD which you're using as a storage device, yes?

2. The system contains another HDD/SSD which serves as the boot drive?

3. Apparently at one point in time you were able to use the storage HDD with no problem at all since you've indicated you were able to store data on both of the two partitions, yes?

4. Something later impacted the storage HDD because while now the system detects both partitions "it asks me to format F:". Could you explain just how this Windows query arises?

5. In any event the first (E partition now reflects the entire available disk space of the 1 TB HDD. Yet an F: partition still exists?

6. When you access the contents of the E: partition can you discern whether or not it contains the data you previously stored on the F: partition? Are you reasonably certain that data is not included in the E: partition?

7. Perhaps you could include a screen shot of Disk Management with any response you care to make.

 

[Charlie Deuce]

1. Correct
2. Correct
3. Correct
4. Upon initial diagnostics I removed the physical drive from chassis, and instead put it into an enclosure to load as a USB, External drive to more easily troubleshoot the issue. So upon plug in of drive, the E partition connects and when the F partition attempts to do the same, the Format F window pops up.

5. Correct
6. The E partition does not reflect the data previously stored on the F partition. I am reasonably certain that the data is NOT included on the E partition.
The DMDE scan (included as link in original post) shows the "original" partition size of E as 576 GB.
7. I will post the Disk Management as soon as im back home. But for the sake of info as of right now: the F partition does not show and E partition shows full 931.51 GB which does not reconcile with DMDE scan.

Just to clarify the situation & problem...

1. You originally multi-partitioned the 1 TB HDD which you're using as a storage device, yes?

2. The system contains another HDD/SSD which serves as the boot drive?

3. Apparently at one point in time you were able to use the storage HDD with no problem at all since you've indicated you were able to store data on both of the two partitions, yes?

4. Something later impacted the storage HDD because while now the system detects both partitions "it asks me to format F:". Could you explain just how this Windows query arises?

5. In any event the first (E partition now reflects the entire available disk space of the 1 TB HDD. Yet an F: partition still exists?

6. When you access the contents of the E: partition can you discern whether or not it contains the data you previously stored on the F: partition? Are you reasonably certain that data is not included in the E: partition?

7. Perhaps you could include a screen shot of Disk Management with any response you care to make.

 

[ArtPog]

It really would be helpful to see what Disk Management reflects at this time. It certainly appears that at the moment only a single volume (partition E has been created encompassing the entire disk space of the 1 TB WD HDD. But why you should be rec'g a message to format an F: partition is puzzling to say the least. Assuming for just a moment that the HDD does in fact contain only a single partition and the data you previously stored in a second partition of that disk is gone...would you have any idea at all as to how this situation might have arose? For example, had you been going through some processes of one kind or another involving the manipulation of volumes on that HDD before this problem surfaced?

Anyway, let's see what DM reflects and we can go on from there.

 

[Charlie Deuce]

Disk Management as per your request.

http://

Just to clarify the situation & problem...

1. You originally multi-partitioned the 1 TB HDD which you're using as a storage device, yes?

2. The system contains another HDD/SSD which serves as the boot drive?

3. Apparently at one point in time you were able to use the storage HDD with no problem at all since you've indicated you were able to store data on both of the two partitions, yes?

4. Something later impacted the storage HDD because while now the system detects both partitions "it asks me to format F:". Could you explain just how this Windows query arises?

5. In any event the first (E partition now reflects the entire available disk space of the 1 TB HDD. Yet an F: partition still exists?

6. When you access the contents of the E: partition can you discern whether or not it contains the data you previously stored on the F: partition? Are you reasonably certain that data is not included in the E: partition?

7. Perhaps you could include a screen shot of Disk Management with any response you care to make.

 

[Charlie Deuce]

After I sent you the DM screen shot. I read your reply below. After reading it, I ejected the usb to the E/F physical drive. I then reconnected it and the following link is what occurred. I'm not sure why it's asking to format F if DM isn't registering the partition. However it is apparent that in some capacity, it sees the F partition.

http://

I do not recall how I originally caused the issue with the drive. In previous attempts to figure it out I believe I saw some info regarding a corrupted file system or some other such term the eluded to the partition needed to be repaired or how on the on disk system needed to see the F drive. I've backed up the original physical disk to preserve everything, and then began trying to recover some of the data. This has yielded little to know recovered data.

It really would be helpful to see what Disk Management reflects at this time. It certainly appears that at the moment only a single volume (partition E has been created encompassing the entire disk space of the 1 TB WD HDD. But why you should be rec'g a message to format an F: partition is puzzling to say the least. Assuming for just a moment that the HDD does in fact contain only a single partition and the data you previously stored in a second partition of that disk is gone...would you have any idea at all as to how this situation might have arose? For example, had you been going through some processes of one kind or another involving the manipulation of volumes on that HDD before this problem surfaced?

Anyway, let's see what DM reflects and we can go on from there.

 

[ArtPog]

I'm really at a loss to advise you. It's quite a puzzle I guess to both of us.

Have you noticed that while DM reports total capacity of your 1 TB WD HDD as 931+ GB it reports capacity of 536 GB in the volume report?
I note a dynamic disk is in the mix here. Any idea of the role it may play in this situation? Why did you create a dynamic disk in the first place?

I just don't know any simple solution to recovering your lost data other than using one of the data recovery programs that are so available on the net. We've had such mixed results with them that I'm loathe to recommend any specific program. Perhaps you can try one or more trial versions of these programs and/or use your DMDE program (which I'm not familiar with) if it can serve that purpose.

 

[Charlie Deuce]

Ok. I want you to first look at this link.

http://

I'm not sure what all of it means but I will give you this much that I've figured out.

The physical drive is 0 to 1.9 billion sectors. The original E is the Volume labeled as Operations. It's size was 576 GB and went from sector 63 to 1.124 billion. The F partition took up whatever was left.

As you can see from the pic there is also an ex'd out Volume and also a superior Operations Volume that has a total sector capacity from 63 to 1.953 billion sectors.

What I believe is the issue:

The 1.00 TB Operations Volume is Erroneous and part of the problem. And the $Volume 02 is the F partition which should be on the same level of hierarchy as the 576 GB Operations. "$Volume 2" is a designation the program used to name the missing F volume. I do not recall the name I gave it initially.

How I believe the levels should be:

Physical Drive 2 1.00 TB
|
|____Operations ..... 576 GB
|
|____Volume 02....... 424 GB (Approx)


I further believe that the 1.00 Operations Volume is the reason DM is listing the incorrect Drive size info. To me it's a corrupted partitions system and is causing all types of havoc as we've seen.

I'm really at a loss to advise you. It's quite a puzzle I guess to both of us.

Have you noticed that while DM reports total capacity of your 1 TB WD HDD as 931+ GB it reports capacity of 536 GB in the volume report?
I note a dynamic disk is in the mix here. Any idea of the role it may play in this situation? Why did you create a dynamic disk in the first place?

I just don't know any simple solution to recovering your lost data other than using one of the data recovery programs that are so available on the net. We've had such mixed results with them that I'm loathe to recommend any specific program. Perhaps you can try one or more trial versions of these programs and/or use your DMDE program (which I'm not familiar with) if it can serve that purpose.

 

[fzabkar]

The partition table lives in sector 0. Sector 63 is the boot sector of the first partition. The information in the boot sector should match the corresponding entry in the partition table. If it does not, then Windows will offer to format the offending partition.

ISTM that the original partition table has been deleted and the drive has then been re-initialised with a single partition. If so, then the solution would be to delete the 1TB partition table entry and reinstate the first 576GB entry.

To do this you would r-click the Primary (A) Operations volume and select Remove the Partition. Then r-click the 576GB Operations volume and select Insert the Partition (Undelete). Select Drive -> Apply Changes and reboot to allow the OS to re-examine the file system. You may need to select Edit -> Edit Mode beforehand.

That said, I would do some preliminary investigation before applying the above procedure. Firstly I would examine sector 63.

Select Editor -> Goto Offset

Sector = 63
Sector offset = 0
From Start/End
Dec

Then I would examine sector 1124489664. This should be a copy of the boot sector.

If everything is OK, I would then double-click the 576GB volume. Do you see your files and folders? If you recover a selected file to another drive, does it open OK (r-click and select Recover Files)?

Assuming all is OK, I would then apply the abovementioned partition repair. Our next step would be to rebuild the second partition.

 

[Charlie Deuce]

Sector 63: http://

Sector 1124489664: http://

Sectors 63 and 1124489664 Match exactly.

Sector 0: http://

I'm not sure what I'm looking for in Sector 0, if anything, to see if it corresponds to the info in the boot sector. I also can not tell if anything was deleted.

Upon double-clicking the 576 GB volume, I say that is indeed the E drive currently actively being used on my PC. I did a test by creating a new folder, and in DMDE when I re-selected the drive it confirmed there was a new folder.
I also completed a diagnostic recovery and the recovered file worked.

I implemented the steps you prescribed and will now restart the PC.

The partition table lives in sector 0. Sector 63 is the boot sector of the first partition. The information in the boot sector should match the corresponding entry in the partition table. If it does not, then Windows will offer to format the offending partition.

ISTM that the original partition table has been deleted and the drive has then been re-initialised with a single partition. If so, then the solution would be to delete the 1TB partition table entry and reinstate the first 576GB entry.

To do this you would r-click the Primary (A) Operations volume and select Remove the Partition. Then r-click the 576GB Operations volume and select Insert the Partition (Undelete). Select Drive -> Apply Changes and reboot to allow the OS to re-examine the file system. You may need to select Edit -> Edit Mode beforehand.

That said, I would do some preliminary investigation before applying the above procedure. Firstly I would examine sector 63.

Select Editor -> Goto Offset

Sector = 63
Sector offset = 0
From Start/End
Dec

Then I would examine sector 1124489664. This should be a copy of the boot sector.

If everything is OK, I would then double-click the 576GB volume. Do you see your files and folders? If you recover a selected file to another drive, does it open OK (r-click and select Recover Files)?

Assuming all is OK, I would then apply the abovementioned partition repair. Our next step would be to rebuild the second partition.

 

[fzabkar]

You are viewing sector 0 as a boot sector. That's why the data make no sense. You need to view it as a partition table / MBR. To this end select Mode -> Partition Table or Mode -> Hexadecimal.

 

[Charlie Deuce]

After restarting the computer, the updated Partitions window looks like this:

http://

 

[Charlie Deuce]

Mode > Partition Table:
http://

Mode > Hexadecimal:
http://

You are viewing sector 0 as a boot sector. That's why the data make no sense. You need to view it as a partition table / MBR. To this end select Mode -> Partition Table or Mode -> Hexadecimal.

 

[fzabkar]

It appears that DMDE cannot find the second partition. Normally there would a boot sector at 1124489665, ie the first sector after the end of the previous partition. Assuming it was an NTFS volume, then there should also be a copy of the boot sector at the end of the partition.

Firstly let me say that working with live data is not a good idea. Until now, all we have done is edit the partition table in sector 0. These changes are easily reversible.

Before proceeding, I would first examine the drive's SMART report to make sure it has no serious physical problems. You could use a tool such as CrystalDiskInfo.

http://crystalmark.info/software/CrystalDiskInfo/index-e.html

Look for reallocated, pending, or uncorrectable sectors.

I would also verify the integrity of the file system on drive E: by running CHKDSK against it in readonly mode (not repair mode). I would avoid the "/r" or "/f" modifiers. It would be advisable to backup your files to another drive and confirm that they are OK.

Next I would examine sector 1124489665 in Mode -> Hexadecimal.

I would then type Ctrl-End to position DMDE at the last sector of the physical drive, and then perform a backward search for an NTFS boot sector. This should require less than 1 minute.

Tools -> Search for Special Sector
- NTFS boot sector
- Backward

 

[fzabkar]

The dump of sector 0 confirms that DMDE has kept a disabled backup copy of the original 1TB partition.

The MBR code is consistent with a Windows XP system:

http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm

 

[Charlie Deuce]

I'm am currently backing up the E Drive using Acronis True Image. Approx 1 hour.

I also ran the SMART Report:
http://

I then ran chkdsk:
http://

And also examined sector 1124489665:
http://

I then went to the very last sector 11953525167, and took a capture of that, just in case it may be useful:
http://

And finally did the Search for Special Sector from that last sector, backward and the following turned up:
Hex - http://
Boot Record - http://

It appears that DMDE cannot find the second partition. Normally there would a boot sector at 1124489665, ie the first sector after the end of the previous partition. Assuming it was an NTFS volume, then there should also be a copy of the boot sector at the end of the partition.

Firstly let me say that working with live data is not a good idea. Until now, all we have done is edit the partition table in sector 0. These changes are easily reversible.

Before proceeding, I would first examine the drive's SMART report to make sure it has no serious physical problems. You could use a tool such as CrystalDiskInfo.

http://crystalmark.info/software/CrystalDiskInfo/index-e.html

Look for reallocated, pending, or uncorrectable sectors.

I would also verify the integrity of the file system on drive E: by running CHKDSK against it in readonly mode (not repair mode). I would avoid the "/r" or "/f" modifiers. It would be advisable to backup your files to another drive and confirm that they are OK.

Next I would examine sector 1124489665 in Mode -> Hexadecimal.

I would then type Ctrl-End to position DMDE at the last sector of the physical drive, and then perform a backward search for an NTFS boot sector. This should require less than 1 minute.

Tools -> Search for Special Sector
- NTFS boot sector
- Backward

 

[Charlie Deuce]

I'm not sure what this, quoted info, means.

The dump of sector 0 confirms that DMDE has kept a disabled backup copy of the original 1TB partition.

The MBR code is consistent with a Windows XP system:

http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm

 

[fzabkar]

My comments in regard to the dump of sector 0 were just to reassure you that the changes were easily reversible, if need be.

Your CrystalDiskInfo screenshot is indicating that your drive has serious physical problems. :-( That's probably the root cause of your problems. There are 1465 (= 0x5B9) bad sectors that are waiting to be replaced with spares (Current Pending) and almost as many Uncorrectable Sectors.

Fortunately CHKDSK has found no errors, so hopefully Acronis will be able to clone your data. If not, then ddrescue would be a better DIY tool. Ddrescue understands how to work with bad media.

Sector 1124489665 is all zeros, so I'm wondering whether there was actually a second partition or whether it has been zeroed. If you position DMDE at this sector and then drag the vertical scrollbar downwards, do you see any data, or do you just see zeros?

The last sector of the physical drive has a PRIVHEAD header which suggests that the drive was originally set up as a dynamic volume.

LBA 1953523119 contains a copy of the boot sector at sector 63. Therefore I'm wondering whether the dynamic volume consisted of a single 576GB partition plus 424GB of reserved space.

 

[Charlie Deuce]

If my summation is correct the below pic shows all zeros from 1124489665 until 1124491263. and the subsequent 1124491264 begins data. http://

I may have converted the drive to dynamic in an attempt to recover some data. I don't believe dynamic would have been its original state unless it was like that upon first formatting.

Acronis will not make an image of the drive. I'm going to have to make a live disc for ddrescue since it's not for windowns

My comments in regard to the dump of sector 0 were just to reassure you that the changes were easily reversible, if need be.

Your CrystalDiskInfo screenshot is indicating that your drive has serious physical problems. :-( That's probably the root cause of your problems. There are 1465 (= 0x5B9) bad sectors that are waiting to be replaced with spares (Current Pending) and almost as many Uncorrectable Sectors.

Fortunately CHKDSK has found no errors, so hopefully Acronis will be able to clone your data. If not, then ddrescue would be a better DIY tool. Ddrescue understands how to work with bad media.

Sector 1124489665 is all zeros, so I'm wondering whether there was actually a second partition or whether it has been zeroed. If you position DMDE at this sector and then drag the vertical scrollbar downwards, do you see any data, or do you just see zeros?

The last sector of the physical drive has a PRIVHEAD header which suggests that the drive was originally set up as a dynamic volume.

LBA 1953523119 contains a copy of the boot sector at sector 63. Therefore I'm wondering whether the dynamic volume consisted of a single 576GB partition plus 424GB of reserved space.