Partition Recovery - Some Questions Please

[risk_reversal]

I deleted a primary partition from one of my HDD1 with a view to copying back a saved version which I had (saved & hidden) on HDD2. Unfortunately, HDD2 (a 2 week old HDD) has developed sector errors and I cannot copy the saved partition back. All my partitions are FAT32.

I tried to Undelete the partition which I deleted from HDD1 by using BiNG. However, the Undelete function does not find the partition in the void space. BiNG only finds a Logical Partition which I created prior to moving it a little higher on my disk (HDD1).

I have searched in order to find another utility which could restore my deleted partition and ran across TestDisk.

I basically need some help with how to proceed with TestDisk.

I ran TestDisk and get to the first screen ie current partition structure as per photo below.

http://www.photos.desertdune.com/testdisk/currentpartitionstructure.jpg

The partition which is missing from my original set up is a 16Gb primary partition in between item 2 and 3 from above screenshot.

I then ran quick search and got the following:
http://www.photos.desertdune.com/testdisk/quicksearch_1.jpg

The primary partition that I want to recover is the one labelled FW AV TEST ie third one in the list.

I selected Delete for the Acronis S2 partition (I did try out this product about 18 months ago) and also Delete for the first FAT32 logical partition labelled DATA which starts at 14314. This partition is the same as the other DATA partition which starts at 17563, its just that I moved it higher up on the disk a while back.

Apart from these 2 deletes I left everything else unchanged. I then pressed Enter to continue and got the following.
http://www.photos.desertdune.com/testdisk/selectenter_1.jpg

Now my question:

The original Extended partition (& Logical partition) from screenshot 1 both start at 17563 and end at 20729. After I added the lost Primary partition (on screenshot 3) the Extended partition now begins at 11342 ie just after the 'recovered' primary partition and ends at 30400 ie end of disk. The Logical Partition starts at 17563 and ends at 20729 ie same as it was before.

I am a bit worried about the new size of the Extended Partition covering the rest of the HDD. Is this ok.

Is there another prog ie PTTD (partition table doctor) http://www.ptdd.com/ Partition Recovery http://www.partition-recovery.com/ which may be more obvious to use.

I hope that I have explained myself clearly.

Many thanks for any info provided

Cheers

[Ghost_Hacker]

You should be fine. The extended partion should take up the rest of the hard drive space left over after the deletion of the other logicals. Because of disk errors the extended partion was not being displayed as containing all the logical partions (you have 3 logicals within the extended but only one was showing in your first screen shot)

The PC guide explains it here (http://www.pcguide.com/ref/hdd/file/structPartitions-c.html)

Hope this helps :)

[Paul Komski]

I agree you should be fine but I think there is an alternative reason (also noting that the bad sectors were also on the other disk) that the extended partition had to be redrawn.

Originally there were only two primaries listed along with the extended primary and they occupied tables 1, 2 and 3; one logical in 5. After the initial changes/searches made by TestDisk there were too many (6) partitions to fit into the available primary partition tables so three had to be given logical status and the extended (primary) partition have its geometry redrawn to accommodate them. You then deleted a logical partition each side of the partition starting at sector 17563 leaving an extended with unallocated space each side of it; it being the remaining logical.

If you want to get a free graphical display of the geometry then you could do worse than try out GParted (http://gparted.sourceforge.net/download.php) on its own Live CD or bundled with various Linux distros or wander through its now recovered partition tables with PTEdit (http://www.paulski.com/zpages.php?id=2103).

As things stand, with three primary partition tables occupied in front of the extended, the space at the end can only be utilised by a logical partition; the space at the start of it could be used by a logical or the extended be redrawn and partition 3 then resized into it.

I'm surprised that BiNG didn't find them but its instructive to know it had problems. Possibly it will only find deleted primary partitions. Its just possible that if you had used BiNG to first delete the extended partition that it would have then done the daisy-chaining search for logicals because it will only hunt through unallocated space and not the whole drive - but that's for future testing/confirmation. TestDisk is indeed a premier application that has saved many peoples bacon.

[risk_reversal]

Many thanks for your replies.

I managed to locate a copy of the MBR (made with MBRWork) for that HDD which I had taken in Nov-07. Since no changes to the partitions had been made from that MBR save, I decided to restore that way.

The end result was that although the lost / deleted partition was restored, it had been corrupted. I guess that when I tried to copy back the saved partition from HDD2, the copy process started but then aborted and it probably started overwriting the space which had beed occupied by the oriiginal deleted partition.

Perhaps that is why BiNG could not Undelete. Still, it has taken a bit of time but I have rebuild the lost partition.

My newly purchased HDD which had bad sectors on it has been zero filled and is now not showing any errors, so the errors detected must have been logical (rather than physical) ones. So I am not back to my starting point. I hope that I can now conclude what I set out to do which was merely to replace my sound card.

Nevertheless many thanks for the info.

Cheers

[Paul Komski]

errors detected must have been logical (rather than physical) onesIn my book a bad sector is a bad sector - the way they differ is whether they can't be read-from or can't be written-to or both as well as the way they are "mapped".

ALL HDDs have bad sectors on them right from the factory. On modern hard drives these are mapped by the HDD controllers into a database and thus excluded from use. It's only when this becomes full that the bad sectors start to appear to the systems using the drive. File systems and their error checking utilities can also "remap" bad sectors and whether data loss results or not depends on whether they were read or write bad sectors. Read errors get lost but write errors can be remapped and relocated - within the partition itself. Bad sectors affecting the metadata cannot generally be remapped. If the partition boot sector or part of the MFT (regardless of the MFTMirror) are bad that can be end of story.

Running chkdsk or similar and reformatting (slow not quick) can hide away most of such bad sectors. A better approach is to wipe the hard drive because this resets the firmware's database and allows all surface defects to be stored away "from scratch". Just be very wary of keeping any serious data on any HDD that is developing any and especially more and more defects.

I managed to locate a copy of the MBRThat copy will only let you restore the primary partitions in the MBR and not any logical partitions in any EPBRs. Having the output of PQ's PartitionInfo can be invaluable regarding locical volumes and these can be manually reinstated with PTEdit at any later stage.