Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Recover a GPT Partition that became RAW in 3T Internal HDD

30 Mar 2019   #31
RFG

Windows 7 Ultimate x64
 
 

hello jumanji, good afternoon/eve :)




Quote   Quote: Originally Posted by jumanji View Post
The devil returns.
...

Check sector 0 of your 3TB drive with bootice. If it is not the same edit the fields as in the above screenshot and save it to disk. Save the sector before editing so that you can restore it if need be.

Using bootice: My post #7 here: Lost partitions!

( I would think that your disk's protective MBR is not corrupted. To my knowledge if the protective MBR is corrupted the whole disk will become RAW.)

Exercise caution to perform this on the correct disk.

To be continued after a break.



OK, i've never used bootice or any other software to edit sectors from HDDs so this is gonna take a while. Let me read your topic about it. I'll return here everytime i have a doubt before i make a new move.


Thanks again for all the explanation, things are more clear to me now. Even so, what do you think that could have caused this corruption?


If this dont work i'll make an approach with a linux distro.


Brb...




OK so the sector 0 of my drive is the same as yours




Attached Thumbnails
Recover a GPT Partition that became RAW in 3T Internal HDD-bootice.jpg  
My System SpecsSystem Spec
.
30 Mar 2019   #32
RFG

Windows 7 Ultimate x64
 
 

I forgot to mention that bootice only detects my HDD with ~800G... not the full size of 3T


Initial screenshot of Bootice Sector Editor (it's the last pic. of the following uploaded screenshot series)

Next i'm posting screenshots of my 1st and last sectors respectively.

Also the screenshots of my 2nd sector where i can only see MSR Partition table plus 2 data partitions (i cant recognize the 3rd...) and its backup n-33

Then yet the screenshot of sector 264192 that should be the VBR of 1st data partition... but mine looks very different from yours. maybe the size of the disk detected by bootice has some influence in the shown results...

At this stage i am a bit lost...


Attached Images
Recover a GPT Partition that became RAW in 3T Internal HDD-bootice_1st-sector.jpg Recover a GPT Partition that became RAW in 3T Internal HDD-bootice_last-sector.jpg Recover a GPT Partition that became RAW in 3T Internal HDD-bootice_2nd-sector-partition-tables.jpg Recover a GPT Partition that became RAW in 3T Internal HDD-bootice_2nd-sector-partition-tables-backup-n-33.jpg Recover a GPT Partition that became RAW in 3T Internal HDD-vbr-1st-data-partition.jpg Recover a GPT Partition that became RAW in 3T Internal HDD-bootice1.jpg 
My System SpecsSystem Spec
30 Mar 2019   #33
jumanji

Windows 7 Home Premium 32 bit
 
 

"Even so, what do you think that could have caused this corruption? " If only I know that I would have resolved the problem in a jiffy In most cases we do not know what caused the problem. I have searched the whole web and haven't come across anyone having the same problem. So no precedent also.

Referring to your post #31 sector 0, the circled field in screenshot is 01.

If you look at my screenshot in post #28 (Initialised with Windows Disk Management) and post #29 ( as initialised in the factory) that field is 02. I don't know how significant it is but let us change it. Make sure you are doing it on the right disk - always, always.

Recover a GPT Partition that became RAW in 3T Internal HDD-30-03-2019-21-36-52.jpg

So you will change 01 to 02, editing and writing it with bootice Click on that field. If 0 flashes move it to 1 with right arrow key. Now 1 should flash. Type 2 to overwrite 1. Then click on Save changes icon in the top menu bar. Done. Close bootice and then run it again. View sector 0. Do you see 02 now? Close bootice.

Shut down your PC and then restart to stop all disk processes that may be running. ( if it is an external drive we safely remove it and plug it in again)

Now has that made any difference in your situation?

This is my last post for the day. Rest I shall look tom morning. That will also give time for you read my writeup on using bootice.Good day


My System SpecsSystem Spec
.

30 Mar 2019   #34
RFG

Windows 7 Ultimate x64
 
 

Quote   Quote: Originally Posted by jumanji View Post

...


So you will change 01 to 02, editing and writing it with bootice Click on that field. If 0 flashes move it to 1 with right arrow key. Now 1 should flash. Type 2 to overwrite 1. Then click on Save changes icon in the top menu bar. Done. Close bootice and then run it again. View sector 0. Do you see 02 now? Close bootice.

Shut down your PC and then restart to stop all disk processes that may be running. ( if it is an external drive we safely remove it and plug it in again)

Now has that made any difference in your situation?

This is my last post for the day. Rest I shall look tom morning. That will also give time for you read my writeup on using bootice.Good day



OK. All done, nothing changed... The problem remains as it was even after change the value from 01 to 02 and reboot.
Should i restore it to the previous state again?

I already have an Ubuntu Live USB distro, i'm going to boot through there and see whats the output from that approach. i'll keep you informed about my results.



Thanks again jumanji for being patient and for all the help


Attached Thumbnails
Recover a GPT Partition that became RAW in 3T Internal HDD-dskmng2.jpg  
Attached Images
Recover a GPT Partition that became RAW in 3T Internal HDD-changed-sector.jpg 
My System SpecsSystem Spec
30 Mar 2019   #35
RFG

Windows 7 Ultimate x64
 
 

I've comeback with a few more infos...


Finally i've ran Ubuntu Live USB that i already had in a pendrive and it came up with a few errors when running GParted. Meanwhile i'll get the Lucy distro yer suggesting and make the same moves as you suggest. I'll post some shots of that when i've done it.

I had some issues with saving the printscreens so i've took a few shots with my phone, not best quality but i think its enough for the purpose.


After logon with Ubuntu the 1st thing i noticed was that the partition also wasn't listed under the Devices menu.



Next thing i did was to start GParted to analyse my discs. immediatly after open it a first error message poped up claiming "The backup GPT table is not at the end of the disk as it should be. This might mean that another OS believes the disk is smaller. Fix by moving backup to the end and removing the older?" - At this stage i've selected the Ignore option







After this, another pop up window show with the message "Not all of the space available to /dev/sda appears to be used, you can fix the GPT to use all the space or continue with the current setting?" - At this stage i've selected the Ignore option again



Gparted finally opened and detected all my 3T disk as unallocated space. The partition info makes reference to the previous warning messages.








At this time i feel that i should give a try with the fixes proposed by GParted, but before i make a move i'll wait for a few opinions more about this...
My System SpecsSystem Spec
30 Mar 2019   #36
jumanji

Windows 7 Home Premium 32 bit
 
 

"OK. All done, nothing changed... The problem remains as it was even after change the value from 01 to 02 and reboot.
Should i restore it to the previous state again?"


No need to restore Sector 0, where we changed 01 t0 02 for that is the way Sector 0, the protective MBR should be.

Yesterday night, I only examined the Sector 0 screenshot and put off examining the the other screenshots for this morning since it was already time to retire.

This morning I examined the the other Bootice screen shots you had put on your screenshots in post#32

My God! Sector 1565565871 - the last sector in the truncated RAW partition shows the presence of a backup of a new GPT header. How come!!!!

Sector n-32, 15655565839 sector shows the presence of a new backup of the partition tables at sector 2. How come!!!!

I am of the opinion that this couldn't have happened on its own accord. To me it would appear that when your first partition turned RAW, an attempt was made to reinitialise it as a GPT drive.

Yes, when you try to access a RAW partition and it is because sector o is corrupted, it would ask you initialise it as an MBR/GPT drive.And it was initialised as a GPT drive.

If you hadn't done it, then forget my accusation

I shall continue after a short break. I am still responding to post #32. I shall now look into your other posts after the break.
My System SpecsSystem Spec
30 Mar 2019   #37
jumanji

Windows 7 Home Premium 32 bit
 
 

I will still take some more time. Do not use Gparted to shift the wrong partition tables backup and wrong Header backup to the end of the drive.That will kill the original correct backups and if that happens or has happened it will be the end of the story.
My System SpecsSystem Spec
31 Mar 2019   #38
jumanji

Windows 7 Home Premium 32 bit
 
 

I have gone through your post#35 now.

As stated earlier Bootice showed bakups of the partition tables and the header. As I said it is an anamoly which needs an explanation.

Gparted also saw that anamoly and since the backups are always at the end of the disk, offered to shift them to the end. It also specified that doing so will remove the old backups. Actually the old backups at the end of the drive are the right ones. Since those are the valid ones you were seeing the second and third partitions.

I only hope that you haven't accepted the fix offered by gparted. If you had done that fix my comment in the previous post holds.

If you confirm that you haven't done the fix, only then we can proceed further.

Linux is used only check whether we could see and access a disk/partition when Windows is not able to see, not to make any fix.
My System SpecsSystem Spec
31 Mar 2019   #39
RFG

Windows 7 Ultimate x64
 
 

Quote   Quote: Originally Posted by jumanji View Post
"OK. All done, nothing changed... The problem remains as it was even after change the value from 01 to 02 and reboot.
Should i restore it to the previous state again?"


No need to restore Sector 0, where we changed 01 t0 02 for that is the way Sector 0, the protective MBR should be.

Yesterday night, I only examined the Sector 0 screenshot and put off examining the the other screenshots for this morning since it was already time to retire.

This morning I examined the the other Bootice screen shots you had put on your screenshots in post#32

My God! Sector 1565565871 - the last sector in the truncated RAW partition shows the presence of a backup of a new GPT header. How come!!!!

Sector n-32, 15655565839 sector shows the presence of a new backup of the partition tables at sector 2. How come!!!!

I am of the opinion that this couldn't have happened on its own accord. To me it would appear that when your first partition turned RAW, an attempt was made to reinitialise it as a GPT drive.

Yes, when you try to access a RAW partition and it is because sector o is corrupted, it would ask you initialise it as an MBR/GPT drive.And it was initialised as a GPT drive.

If you hadn't done it, then forget my accusation

I shall continue after a short break. I am still responding to post #32. I shall now look into your other posts after the break.



Good afternoon jumanji!



OK, as i said, i have ignored the fix options presented by Ubuntu (at least i do think so :) ).

Although when i first noticed this problem, a couple of weeks ago or so, an auto chkdsk was launched by default after a reboot of windows and i haven't stopped it because the pc restarted and i moved away for a bit and when i looked again, chkdsk was already running. The only thing that happened at that ttime was that chkdsk couldnt finnish its task claiming that the disk was full and couldnt write/recover all the data because of lack of space on the drive, which was strange because the partition wasnt even half full... At that point i needed to do a reboot again. Do you think that in the middle of that procedure the PBR got even more corrupted?



I won't do anything else with linux for now. I've just ran it to check for errors which has only confirmed that something bad messed with my disk.


So, with the actual picture, what should i do next ? Can at least my data be recovered? At this point i'm almost preparing myself to resign...
My System SpecsSystem Spec
31 Mar 2019   #40
jumanji

Windows 7 Home Premium 32 bit
 
 

OK, we don't know what has happened actually that resulted in the new backups at the end of the current RAW partition. It was indeed a jolt for me. Anyway let us see. Worst comes to worst, we can format the entire Disk or only the the RAW partition and attempt data recovery. In such a case the original Master File Table is lost but still Photorec in TestDisk can rebuild the files abinitio. Since MFT is lost you will get only a bunch of files without the original filenames and folder structure if Photorec succeeds in rebuilding the files.that will be the last option.

1. Post a fresh screenshot of Windows Disk Management. ( Just to confirm that we are still in the same condition with which we started.)

2. I am now going back to Partition Wizard - your Post #21 with the screenshot of found partitions after a quick scan.Quick scan did find a valid VBR at sector 264192. ( This VBR could be a new VBR overwriting the original VBR)

Run a quickscan again. When it finds the partitions, please select the second partition by clicking on the square, double click on the second partition (starting LBA 264192 ending LBA 1565565871) that should open the explorer Window showing the files it could see. ( Please refer to image 5 and image 6 in dsperber's
post # 17)

If it shows the folders/files well and good. Post a screenshot. Close the explorer Window. Cancel and close Partiion Wizard.

Do it slowly at your leisure.Absolutely no need to do anything in a hurry. Absolutely no need to keep awake at night.
My System SpecsSystem Spec
Reply

 Recover a GPT Partition that became RAW in 3T Internal HDD




Thread Tools




Similar help and support threads
Thread Forum
Please Help Me To recover My data From internal Hard Disk
Hi there , can any one help me to fix my hard disk . my hard disk is St- 3500413as but now showing ST- M13fqbl ATA 500 gb . OS Windows 7 32 bit. Suddenly my pc won" t turn on & when I try to fix i find in disk manager my hard disk showing just 3.86 gb. & showing not initalized & unalocated. I try...
Hardware & Devices
Which tool is best for recover data from Phone internal memory
Hello everybody ! I have a Samsung Galaxy Grand Duos I9082. In this I have some Audio recording clips, these audio clips stored in the Phone internal memory but i lost all of these Due to a limitation of fix no. of clips mean only 40 no. of clips reside in this ,after 41 this delete No. 1 clip...
Software
How should I recover this partition?
Hi guys, I just used the Active@ Partition recovery on my computer in an attempt to find the recovery partition, and look what it's found!! It found the HDD recovery image, and it's around 10 gigabytes! I think that's it! Now, before I go messing around further when I recover it, what settings...
Installation & Setup
Recover OEM partition
I have an Lenovo Thinkpad t42p with a 4.72 gb OEM partition that sits between my C:Windows 7 121gb partition and E:106GB partition. I am not able to delete the OEM partition which contains my old XP system recovery files. I would like to merge E: with C: but OEM stands in the way. Any way to delete...
Hardware & Devices
Recover Second Partition
When I first started using Windows 7 I had a windows XP partition along with a windows vista. I had all 3 OS's running smoothly and of course fell in love with 7. After getting my hand on a copy of 7 Ultimate I decided to buh bye Vista and Hello 7 as a whole OS, mind you I kept the XP installation...
Installation & Setup


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 18:36.
Twitter Facebook