Announcement

Collapse
No announcement yet.

Recovering from a deleted partition

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Recovering from a deleted partition

    So last night I sat down to do a clean install on my laptop after the tremendous weekend in Las Vegas. I backed up all my data to my External Maxtor 250 gb HD that I needed and then tossed in the windows disc. I quickly looked at the list of hard drives to format, and picked the top one. Turns out, my external and internal drives had around the same amount of free space, so I stupidly picked the top option and deleted the partition.

    At this point I realized I had fucked up. I turned off the external drive, reinstalled a copy of Partition Magic I had laying around, hoping that it would see the partition and be able to restore it. Alas, this was not the case.

    I'll be going over the forensics presentation from Sunday morning again, but before I do I'd like to know which of those tools can actually allow me to recover the data.

    Thanks for your insight..
    jur1st, esq.

  • #2
    Originally posted by jur1st

    Thanks for your insight..

    Here's my insight, if you want a real answer your going to have to provide more information.

    Also you said "which tool should I use". Are you adverse to using other tools, cause I could give you one right now. And I wasn't at DC so I'm kinda unaware of what tools were given.

    Oh, and in the interim while you're preparing the rest of the information that I need to provide you with a real answer, don't write over the data on that drive..

    Comment


    • #3
      are we speaking in windows terms? ive used active undelete many times when someone accidently deleted a partition and recovered their data. If they reinstalled over that partition, copy data over it, etc there were minimal chances of easily recovering it. i havent really done a search for a good free (freeware or gplish) partition recovery program though.
      Last edited by nawcom; August 4, 2005, 10:00.
      "And God said, 'Let there be vodka !'

      And He saw that it was good.

      Then God said, 'Let there be light !'

      And then He said, 'Whoa - too much light'."

      Comment


      • #4
        This search brought about a decent doc that might be useful to you.
        if it gets me nowhere, I'll go there proud; and I'm gonna go there free.

        Comment


        • #5
          While i'm not sure which details i left out, here's some more:

          The hard drive is an external 250 GB Maxtor One-Touch which was originally formatted as NTFS. I deleted the partition using the reinstallation Windows XP Home Service Pack 1 disc that came with my Dell Inspiron 5100. The drive is unformatted (RAW). I did not create any new partitions on it, and the only time the drive has been accessed was when Partition Magic scanned it in the attempt to find something to restore.

          There was only one partition, and the drive was named Ron, after my high school janitor (i'm well removed from high school at this point).
          jur1st, esq.

          Comment


          • #6
            i am a fan of getdataback... it has saved my data many a time

            Comment


            • #7
              All my data is recovered and is moving from the HD I borrowed from my office back to Ron.

              Many thanks for everyone's help in saving the day.
              jur1st, esq.

              Comment


              • #8
                Originally posted by jur1st
                All my data is recovered and is moving from the HD I borrowed from my office back to Ron.
                Ack. Somehow, I managed to miss this thread but am glad to hear you got it back.

                For anyone who ever uses the search function in the future (there's always a first time!), I'd recommend getting your hands on a copy of Encase somehow and going from there. Damned useful tool.

                Comment


                • #9
                  Unfortunately Encase costs $5,000 (or $200,000+ for Enterprise Edition). But almost everything it can do you can also do with the wonderful Helix. Its a CD-bootable Knoppix distribution custom-built for forensic analysis, and it has all sorts of useful tools on it.

                  http://www.e-fense.com/helix/
                  Jesus built my car
                  It’s a love affair
                  Mainly Jesus and my hot rod

                  Comment


                  • #10
                    Originally posted by jur1st
                    All my data is recovered and is moving from the HD I borrowed from my office back to Ron.

                    Many thanks for everyone's help in saving the day.
                    Mind telling us which tool or method you ended up using? Was it a simple matter of rewriting the MBR or did you have to carve raw data out?

                    Comment


                    • #11
                      sorry about that...I ended up using getdataback. Copying the files took a while, around 12 hours all together. I did get everything back, though.
                      jur1st, esq.

                      Comment


                      • #12
                        real partition recovery tool: partition table doctor

                        Originally posted by jur1st
                        So last night I sat down to do a clean install on my laptop after the tremendous weekend in Las Vegas. I backed up all my data to my External Maxtor 250 gb HD that I needed and then tossed in the windows disc. I quickly looked at the list of hard drives to format, and picked the top one. Turns out, my external and internal drives had around the same amount of free space, so I stupidly picked the top option and deleted the partition.

                        At this point I realized I had fucked up. I turned off the external drive, reinstalled a copy of Partition Magic I had laying around, hoping that it would see the partition and be able to restore it. Alas, this was not the case.

                        I'll be going over the forensics presentation from Sunday morning again, but before I do I'd like to know which of those tools can actually allow me to recover the data.

                        Thanks for your insight..
                        I suggest you use Partition Table Doctor to resolve your
                        problem.The software provides very useful functions:
                        Backup partition table, Restore partition table, Rebuild
                        partition table, undelete partition, Fix boot sector,
                        rebuild mbr,etc.

                        First thing I recommend you download the demo version of
                        Partition Table Doctor.( http://www.ptdd.com/download.htm )

                        Run the program and select "Rebuild Partition Table",
                        then choose "Interactive" mode.

                        See more: http://www.ptdd.com/recoverylostpartition.htm
                        http://www.ptdd.com/recoverdeletedpartition.htm
                        http://www.ptdd.com/partition-recovery.htm
                        http://www.ptdd.com

                        Comment


                        • #13
                          Originally posted by lukeles
                          I suggest you use Partition Table Doctor to resolve your
                          problem.The software provides very useful functions:
                          Backup partition table, Restore partition table, Rebuild
                          partition table, undelete partition, Fix boot sector,
                          rebuild mbr,etc.

                          First thing I recommend you download the demo version of
                          Partition Table Doctor.( http://www.ptdd.com/download.htm )

                          Run the program and select "Rebuild Partition Table",
                          then choose "Interactive" mode.

                          See more: http://www.ptdd.com/recoverylostpartition.htm
                          http://www.ptdd.com/recoverdeletedpartition.htm
                          http://www.ptdd.com/partition-recovery.htm
                          http://www.ptdd.com
                          Which part of the sentence "All my data is recovered and is moving from the HD I borrowed from my office back to Ron. " didn't you get ?
                          See post # 7 in the thread.

                          Dutch
                          All your answers are belong to Google. Search dammit!!!

                          Comment


                          • #14
                            Originally posted by Dutch
                            Which part of the sentence "All my data is recovered and is moving from the HD I borrowed from my office back to Ron. " didn't you get ?
                            See post # 7 in the thread.

                            Dutch
                            I have to admit, it'd be useful for future reference.

                            I know I'm going to be making a note of it, just in case I wind up in jur1st's position.
                            (We now return you to your regularly scheduled programming. Please, feel free to ignore this post if you so desire.)

                            Comment


                            • #15
                              yer one of those guys that sells his fire extinquishers because he's never had a fire, aren't you :p
                              if it gets me nowhere, I'll go there proud; and I'm gonna go there free.

                              Comment

                              Working...
                              X