Hard Drive Partition

[brigdh]

Hey, I've got a problem and I'm hoping someone can help me out.

I was trying to fix a detachable drive by running my computer in knoppix and deleting the drive's partition. Unfortunately, I think I deleted my hard drive's partition instead (I know, I know: I'm an idiot. You don't need to tell me, losing all of my files and programs got the message across clearly enough). Now, whenever I turn on the computer, I just get a message that there's "no bootable device". I can still run knoppix because I had it burned to a CD, but I can't do anything else. I have a Dell Latitude, and I was running Windows XP on it.

1. Is there any way to get back the information I've lost?
2. If I have deleted my hard drive partition, what type of partition should I create for it? I've got it set to NTFS now, but unfortunately I have no idea what it was orginally.
3. Will reinstalling Windows let me use the computer again?

Thanks for any help you can offer.

[Harry Kuhman]

...... Unfortunately, I think I deleted my hard drive's partition instead ... I'm an idiot. ....

1. Is there any way to get back the information I've lost?
2. If I have deleted my hard drive partition, what type of partition should I create for it? I've got it set to NTFS now, but unfortunately I have no idea what it was orginally.
3. Will reinstalling Windows let me use the computer again?
1) You might be in luck, Linux (and Knoppix) has a utility called gpart that will look over the entire hard disk and try to guess what the partition table should look like. Assuming that all you did was delete the partition and not overwrite any of the data that used to be in the partition, Knoppix may be able to recover it. See man gpart in Knoppix for details.

2) If you are trying to recover the old partition and data it will need to be the same as the old partition, and if you plan on using gpart you would be wise to stop continuing to make changes, and of which might stop gpart from saving you. Once you realize you had destroyed the old partition you should have asked this then, before you made the NTFS partition.

If gpart can no longer help you, you can use FAT or, if you use XP, NTFS. NTFS is the default for XP, but Knoppix can not safely write to NTFS partitions (by Microsoft's design). XP can also use FAT partitions, but be aware that FAT will not let you have files 4 gig in size or over and will not support the user-by-user access that NTFS does. Win98 must use FAT, it does not natively support NTFS. Many of us here who do use XP use either FAT or a combination of a NTFS and a FAT partitions so that we can write to the FAT partition with both OSs.

3) Well, it will let you use Windows again, how useful that is is subject to debate around here. Just doing a fresh install will start you back at zero and anything on the disk will be lost, I would at least give the gpart thing a try fisrt.

[rcook]

I overwrote the front of my NTFS partition on a notebook about Christmas time. I ended up using Knoppix to copy the entire partition to another computer networked to my notebook. I was then able to use NTFS recovery tools ( http://www.nucleustechnologies.com/NTFS-Data-Recovery.html ) to recover the files on the partition, in spite of the fact the first sectors had been overwritten. Look at a forensics book or pesentation for details on how to copy the partition. It is something like

dd if=/dev/hda1 bs=1k | gzip | netcat 192.168.n.nn:12379 on the stricken machine

and

nc -l -p12397 -w30 | gzip -d > /dev/hdbn on the recovery box. where the hdbn is a partition large enough to receive the notebook partition.

Check man pages and the like. I am at work and not able to access a Linux box or my references. If I remember this evening, I will post a more accurate command list.

There are a multitude of tools available for file recovery. Most permit a free download and scan of your stuff to see what you will get from their software before investing, you then purchase, register and are able to save the files. I tried about 3 before using the one I used. The others found files, jpegs etc.
This one recovered directories. and directory trees.

If all else (gpart, etc) fails to locate the partition on the stricken drive, use fdisk and make the drive a single partition, tag it as Fat32 or NTFS as appropriate and then copy the thing off.

There are permutations of the commands above, where you can zip the partition, split it into CD or DVD sized files and save them on a portable drive and burn them elsewere, reassemble them into a partition and attempt file recovery on a remote non networked machine.

Some of the small distros can be copied and run from ram, freeing the drive of your notebook to burn CD's or whatever to salvage the data from the damaged drive. It depends on how much it is worth to you. I had pictures of my first grandchild and to keep peace with my wife, it was worth jumping through all necessry hoops.

Lengthy and I nee to get to work.

Dick

[/i]

[brigdh]

1) You might be in luck, Linux (and Knoppix) has a utility called gpart that will look over the entire hard disk and try to guess what the partition table should look like. Assuming that all you did was delete the partition and not overwrite any of the data that used to be in the partition, Knoppix may be able to recover it. See man gpart in Knoppix for details.

Thanks! I've tried running gpart, but unfortunately I keep getting the same error message: /sbin/gpart: Input/output error.
Do you know what's causing the problem?


Just doing a fresh install will start you back at zero and anything on the disk will be lost, I would at least give the gpart thing a try fisrt.

Yeah, I knew that would erase any chance of me getting my data back. I just wanted to make sure that, if the data was irrecoverable anyway, I could at least use my computer again.

[Harry Kuhman]

Thanks! I've tried running gpart, but unfortunately I keep getting the same error message: /sbin/gpart: Input/output error.
Do you know what's causing the problem?
No, I don't. I was rather concerned when you talked about making a NTFS partition that you were going to over write the disk, and that might be the issue. If you just made the NTFS partition then you should be OK, but if you formatted it, as is the likely next step after defining a partition, then you likely overwrote the data that gpart needs. On the other hand, I have no idea what command you typed in to run gpart, so if the command was wrong then an error mesage certainly doesn't prove that the data is now lost. I'm far from a gpart expert, just know it exists, so I'll leave this to man gpart and anything that you can find with Google, or anyone else here who wants to join in.

[brigdh]

I've gotten gpart to work by entering the command "sudo gpart /dev/hda" instead of simply "gpart /dev/hda" (hda is my harddrive, by the way).

I get a result of:

Primary partition(1)
type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
size: 19077mb #s(39070016) s(63-39070078)
chs: (0/1/1)-(1023/15/63)d (0/1/1)-(38759/15/62)r

As well as three other "Primary Partitions", all of which are blank: unused, and with a size of 0 mb. This sounds like a right guess to me- as far as I know, I only had one partition, and as I mentioned, I accidently rewrote it to NTFS before I knew what I was doing. Reading the gpart man pages, it sounds like my next step is to write the guessed partition by entering "gpart -W /dev/hda /dev/hda". Is that right, or will that write over the data I'm trying to recover? Do I need to save that data in a new place before writing the guessed partition? Unfortunately, I can't burn to a disk, since I only have one CD drive and I need to use that to run Knoppix, but I could either try saving the partition on some webspace of mine, or to a USB drive.

I'm sorry to ask so many questions, but I'm afraid of making a mistake and losing whatever chance I have of recovering the data. And if you don't know the answer, I'm posting this in the hope that someone who does will stumble across it.

[Harry Kuhman]

it sounds like my next step is to write the guessed partition by entering "gpart -W /dev/hda /dev/hda". Is that right, or will that write over the data I'm trying to recover? Do I need to save that data in a new place before writing the guessed partition? Unfortunately, I can't burn to a disk, since I only have one CD drive and I need to use that to run Knoppix, but I could either try saving the partition on some webspace of mine, or to a USB drive.
It sounds right to me (although I would prefix it with the sudo) , as the partition table was bad and needs to be repaired. As I said, I only knew gpart existed, so having studied the man pages recently you likely know more about gpart than I do.

After this is done, if it works and the partition can be recovered then you might just be able to boot XP again. If not see answer #5 (http://www.knoppix.net/wiki/User:Harry_Kuhman) in my list of common responses for ideas on how to recover data if Knoppix can see files on the recovered partition..