Question Restore Partition after Delete Volume

[rgupta9400]

I've been really stuck and over my head here (as evidenced by my bad decisions). Any help is much appreciated!

Long story short, I accidentally ran Diskpart Clean on my drive (virtual drive mounted on Google Cloud). Panicking and being an idiot, I tried to recreate my first partition out of twenty via Windows Disk management. I saw it asking to format, and did have the foresight to not run Quick Format at this time. Obviously, this meant that my partition was just shown as RAW, and so, my biggest mistake was to "Delete Volume". After doing some research, I realized there were tools like MiniTool Partition Wizard that could undo my Diskpart clean command, and I was able to use it to instantly recover Partitions 2-20 after skipping Partition 1 sectors. However, running it on the messed up Partition 1 is taking forever...at this rate it will take over 100 days and may not restore the partition anyways. Now, this is Cloud storage, so I have around 43TB stored in Partition 1. The data is still there since my storage space shows it being used, and when using data recovery tools, I can recover my files. But it is not at all feasible to really recover all 43TB this way.

I was hoping there was a reasonable way to restore the partition itself rather than going through data recovery. I did run GetDataBack on Level 3 (thorough file system scan), and within a few minutes, even after cancelling the scan, it picked up all the filesystem info for Partition 1 (see below). Everything, the space used, file tree, modified dates, etc. is all there and completely accurate, demonstrating that my partition should theoretically be restoreable. GetDataBack is a read-only data recovery tool though, so I can't just write this data back onto the drive. Is there a way to maybe use this information to manually restore the partition?

CAPTURE 6/8/2019 11:16:52 AM
File System Properties
File system: NTFS
Size: 52.5 TB
Location: Sector 32,768_T_
Cluster0: Sector 32,768_T_
Cluster size: 64 sectors
Phys. sector size: 4096 bytes
Total sectors: 112,640,004,096_T_
Total clusters: 1,760,000,064
Data matches/rel:217/0
Source details:M@6324224
Source: M1
Recovery tree:Tree NTFS, 56086 entries
Total files: 51,761
Total directories: 4,322
Total file size: 43.2 TB
# dirhash entries: 56,086
MFT cluster: 98,304
MFTMirr cluster: 1
MFT size: 1024 bytes
INDX size: 4096 bytes
# Mft:0
Explicit Mft no:True
Area: Mft
Created: 7/14/2018 2:03:26 AM

 

[USAFRet]

1. Most data recovery tools require the data be retrieved/recovered to some other drive. Not 'in place'
2. 43TB? Really?
3. That the metadata for those files exist does not mean the actual files exist.
4. 20 partitions?
5. This is specifically what backups are for.

 

[rgupta9400]

1. Right, I was hoping to restore the partition versus actually doing data recovery, if possible. In other words, do not modify the actual data, just the partition and filesystem tables.
2. Yeah, it is not super important data, but if it can be restored, I figured I should try.
3. Agreed, but I have not written to the partition since my mistakes. Doing a few previews of the files on disk does indicate that they are still there. Basically, as with 1, I was hoping I could just restore the metadata of the files since I think that is the only thing that has been disturbed.
4. I had created 20 earlier, but it's not relevant as the only one that was not restored was the first one.
5. I know, but in this scenario, if worst comes to worst, I will live with the loss of data. I just feel like the data is still all there, so I want to give it my best shot to restore it before doing so.

 

[USAFRet]

After diskpart /clean, and then Delete Volume....your options are severely limited.

 

[rgupta9400]

Ah dang. So I can better understand, the NTFS filesystem info GetDataBack was able to pull is basically useless then?

 

[USAFRet]

Ah dang. So I can better understand, the NTFS filesystem info GetDataBack was able to pull is basically useless then?

That is like the table of contents of a book.
The fact that something is listed to exist on Page 82 does ensure the existence of Page 82.

Not useless, but only an indicator.

 

[rgupta9400]

To continue with your metaphor: let's assume I do believe that Page 82 still exists, but I currently do not have any table of contents to point to that page. Is it possible to insert said table of contents, and then verify if Page 82 exists or not? If it does not, then I cut my losses and use Data Recovery tools to get only the important stuff. But after recovering more files using GetDataBack, it seems like all the data is actually intact. I have no idea if there is a way to just modify the filesystem info on the actual drive. The partition table was easy since I knew the exact beginning and ending LBA.

 

[USAFRet]

I'm still stuck on the "43TB", being a virtual drive linked to google.

This data presumably still lives on the google servers, linked to your account?

 

[rgupta9400]

I'm still stuck on the "43TB", being a virtual drive linked to google.

This data presumably still lives on the google servers, linked to your account?

Yes, I used a software called StableBit CloudDrive. This created a virtual hard disk that lived on Google, but was mounted and behaved like any other hard disk locally. On Google, all I see is blocks, but yes, all that data is still technically stored there.

 

[USAFRet]

I have no experience with that software, so can't recommend.

What would I do?
Get another blank drive.
Remove all physical drives in your system, and install this blank drive.
Do a clean install of Win 10. Activation status does not matter.
Install that software, and see if it still speaks to your google drive space.

 

[Antikapitalista]

No, what USAFRet says is nonsense. If the software you are using is a simple IP redirector, probably using TCP, then reinstalling everything from scratch locally is not going to help you at all.

(Only now have I realized how behind the times I am, still managing my network storage over fibre channel,)

Is it a GUID partition table? I assume so, as you were using it in Windows.

Why don't you recreate the partition table manually?
Have you tried it?
If you know the beginnings and ends of the partitions, then just enter them manually using GPT fdisk (gdisk).
If you do not know them, try discovering them using Testdisk.

 

[USAFRet]

No, what USAFRet says is nonsense. If the software you are using is a simple IP redirector, probably using TCP, then reinstalling everything from scratch locally is not going to help you at all.

I mentioned that full install, simply to verify the data still exists and is accessible at google.
It almost certainly is, but just to verify.

 

[rgupta9400]

I'm not sure as I'm not very versed in this stuff. I do think it is GUID as the disk is GPT, and Windows manages it as any other disk.

I've not tried manually doing it as I'm worried I'll mess it up even more if not done correctly. I did create a partition using Disk Management where it would belong, but didn't format it. So it's just a raw partition right now. Is that enough, and the next step is to work on the filesystem?

Data is accessible at Google. I've already recovered 100 GB just in case, and everything was recovered properly with all the metadata. I can also access the other partitions normally using the software

 

[Antikapitalista]

Of course, if you do not do it correctly, you may mess it up even more. However, Windows Disk Management is probably the worst tool to try, seriously. It is like using a machete instead of a scalpel. It is very rough and it gives you only a rather fuzzy idea about where exactly the partition start is created and how large the partition is, i.e., where exactly the end is created.

If the partition size does not match the filesystem size, Windows may display it as raw.
Of course, the data stored on the partition may still be accessible, up to the partition size, if it is too small.

By the way, thank you for this thread, rgupta9400, I had not known about Google Cloud before I came here.

 

[popatim]

Can't google restore from it's backup of your stuff?

 

[rgupta9400]

I think Google can restore the backup, but the problem is that this software is a bit of a black box. It is storing certain data about the chunks locally, and obviously storing the actual data on the Cloud. Some data is located in a cache locally. I am worried that if I restore the older versions, it may create some serious conflicts between the local version and the Cloud data, leading to more corruption.

GDisk seems like an excellent tool, and I used it to delete the RAW partition without any quick formats. I will have to see how to use it to restore the filesystem, which definitely seems intact the more and more I work on data recovery.