Logical Drives disappear - how does this happen?

TVeblen · 27 Jan 2015

My wife tells me this morning that her data drive disappeared. I check out her laptop and sure enough, her data drive D: and her Image drive E: are not shown in Windows Explorer or My Computer.

I look in Disk Management and the space that was occupied by those 2 volumes is now a Green box and labeled: "Free Space". Right clicking gives only 2 options: delete volume and create new volume.
The Recovery Partition, the System Reserved Partition, and the C: drive are all there and healthy.

I fire up Partition Wizard and use the Partition Recovery Wizard. It finds both missing volumes. Apply changes, and everything is back to normal.

My question is "how does this happen"? Any guesses as to what could have caused this?

dsperber · 27 Jan 2015

The use of the word "drive" is really ambiguous and generic, rather casually imprecise. You talk about a "data drive", but it's not clear if this is a physical second hard drive in the laptop, or maybe an external USB drive with two partitions, or what.

More precisely we're of course actually talking about "partitions", which are the one or more sub-divisions on a physical hard drive.

Adding to the confusion, these partitions receive Windows "drive letters" (as people call them), again mixing terminology ambiguously.

And finally, your subject of this thread has introduced yet another ambiguous and/or incorrect term... "logical". When used in conjunction with "partition", it is used to distinguish between the two different partition types: "logical partition" and "primary partition". And this distinction refers to exactly how the partitioning structure "boundary box" on the physical hard drive has carved out the one or more sub-divisions into partitions. There are rules and specifications for how "logical partition" and "primary partition" are created, specified, and located, not to mention how many of them are allowed.

So... back to your wife's laptop. Seems it probably has only one physical hard drive (or SSD) in it, although there's actually a chance it might have actually have two (if there is an extra second drive bay or possibly a caddy for holding a removable drive in the CD/DVD drive location). Or, perhaps you're referring to an external USB drive which you think of as a "data drive" for backups.

Your reference to drive letters D and E is "ambiguous", since while it obviously describes two separate partitions it's not clear that those partitions were actually "logical partitions with drive letters D and E", or "primary partitions with drive letters D and E", or maybe even a hybrid mix of one logical partition and a second primary partition. And again, we don't have a clear picture of the physical hard drives on the laptop.

My point is that it wasn't the disappearance of "logical drives D and E" that you ask about, which is just full of ambiguous casual terminology. It was more specifically the surprising disappearance of these two partitions (logical or primary, we don't know because you haven't told us) which had drive letters D and E.

And who knows how this happened? Did DISKMGMT.MSC get run, to delete these two partitions? How else could they just vanish? Don't know.

Fortunately, you were able to use Partition Wizard to recover them. WHEW!!! Lucky. That's all that really matters now, that you have them back.

Just for closure now that these two partitions are back on the laptop with drive letters D and E as they originally had, I'd really like to now see a screenshot from DISKMGMT.MSC to show your one (or two or three) hard drives, and all of the partitions on them. This would tell us exactly what D and E actually each are, logical or primary, and exactly how you've partitioned your hard drive(s).

TVeblen · 27 Jan 2015

There is a single hard disk drive in the laptop.

It is divided up into 5 partitions: Recovery Partition(Primary), System Reserved Partition (Active, Primary), C: partition (Primary, Boot), and an extended partition with two Logical drives: D: (Data, Logical), and E: (Images, Logical)

The two logical drives in the extended partition on the single internal hard drive are the ones that disappeared.

Nothing was run that could explain changes to the disk structure. Just email, browser, and Word.

Golden · 27 Jan 2015

Thats a really strange problem for a very common partition layout. Is there some sort of maintenence software running in the background that might explain that?

TVeblen · 27 Jan 2015

No! It is really surprising to me.
If it were my computer I might suspect something because I'm always screwing around testing something, but not her laptop.

The one thing that she was doing the day before that is out of the ordinary (for her) was transferring files from one of my W7 PCs to hers. But that was not a cut and paste operation. She opened them, then Save As to a new file on her laptop.
Can't see how something so common as that would be the cause.

Golden · 27 Jan 2015

Yeah. That is quite odd. Maybe she decided to play with PW without telling you

whs · 27 Jan 2015

1. This is indeed an unusual case. I could see 1 partition where the MFT was corrupted, bur 2 partitions at the same time is odd.

2. The images on the same physical disk is not such a swift idea. I would put them on an external disk.

3. Just to be sure, I would scan for malware. It is unlikely that this was a virus, but then you never know.

dsperber · 27 Jan 2015

whs said:

1. This is indeed an unusual case. I could see 1 partition where the MFT was corrupted, but 2 partitions at the same time is odd.

Probably somehow lost the "extended partition" itself (and it's really just one of the four primary partitions on the drive, re-purposed to hold "logical partitions" inside of it), or its own internal logical partition table. That would lose all of the imbedded logical partitions, however many there were.

whs · 27 Jan 2015

dsperber said:

whs said:

1. This is indeed an unusual case. I could see 1 partition where the MFT was corrupted, but 2 partitions at the same time is odd.

Probably somehow lost the "extended partition" itself (and it's really just one of the four primary partitions on the drive, re-purposed to hold "logical partitions" inside of it), or its own internal logical partition table. That would lose all of the imbedded logical partitions, however many there were.

If I understand you right you figure that the damage was done to the extended partition and that dragged the dependent logical partition along - I guess that's possible.

TVeblen · 27 Jan 2015

whs said:

1. This is indeed an unusual case. I could see 1 partition where the MFT was corrupted, bur 2 partitions at the same time is odd.

2. The images on the same physical disk is not such a swift idea. I would put them on an external disk.

3. Just to be sure, I would scan for malware. It is unlikely that this was a virus, but then you never know.

I did all the virus and malware scans (clean). I'm running Data Lifeguard Diagnostics now (short test: good - extended test still going)

The images are on the laptop's hard disk AND an external drive.
A few reasons why I do this:

Images write faster to the internal drive when using the imaging program.
The image file can then be copied to external drive anytime the laptop is not in use. The laptop and the external drive are USB 2 and painfully slow doing a 20GB file. Best to do that overnight.
The image on the external would be used in the case of hard drive failure, but the image on the hard disk can be used to restore the OS if there were a corruption or virus infection, and can be done if you are away from the external drive (on the fly).

Might not be best for everyone, but works for me.