Recovering from a deleted partition

[jur1st]

So last night I sat down to do a clean install on my laptop after the tremendous weekend in Las Vegas. I backed up all my data to my External Maxtor 250 gb HD that I needed and then tossed in the windows disc. I quickly looked at the list of hard drives to format, and picked the top one. Turns out, my external and internal drives had around the same amount of free space, so I stupidly picked the top option and deleted the partition.

At this point I realized I had fucked up. I turned off the external drive, reinstalled a copy of Partition Magic I had laying around, hoping that it would see the partition and be able to restore it. Alas, this was not the case.

I'll be going over the forensics presentation from Sunday morning again, but before I do I'd like to know which of those tools can actually allow me to recover the data.

Thanks for your insight..

[highwizard]

Thanks for your insight..

Here's my insight, if you want a real answer your going to have to provide more information.

Also you said "which tool should I use". Are you adverse to using other tools, cause I could give you one right now. And I wasn't at DC so I'm kinda unaware of what tools were given.

Oh, and in the interim while you're preparing the rest of the information that I need to provide you with a real answer, don't write over the data on that drive..

[nawcom]

are we speaking in windows terms? ive used active undelete many times when someone accidently deleted a partition and recovered their data. If they reinstalled over that partition, copy data over it, etc there were minimal chances of easily recovering it. i havent really done a search for a good free (freeware or gplish) partition recovery program though.

[converge]

This search brought about a decent doc that might be useful to you.

[jur1st]

While i'm not sure which details i left out, here's some more:

The hard drive is an external 250 GB Maxtor One-Touch which was originally formatted as NTFS. I deleted the partition using the reinstallation Windows XP Home Service Pack 1 disc that came with my Dell Inspiron 5100. The drive is unformatted (RAW). I did not create any new partitions on it, and the only time the drive has been accessed was when Partition Magic scanned it in the attempt to find something to restore.

There was only one partition, and the drive was named Ron, after my high school janitor (i'm well removed from high school at this point).

[EvilMoFo]

i am a fan of getdataback... it has saved my data many a time

[jur1st]

All my data is recovered and is moving from the HD I borrowed from my office back to Ron.

Many thanks for everyone's help in saving the day.

[skroo]

All my data is recovered and is moving from the HD I borrowed from my office back to Ron.

Ack. Somehow, I managed to miss this thread but am glad to hear you got it back.

For anyone who ever uses the search function in the future (there's always a first time!), I'd recommend getting your hands on a copy of Encase somehow and going from there. Damned useful tool.

[Grond]

Unfortunately Encase costs $5,000 (or $200,000+ for Enterprise Edition). But almost everything it can do you can also do with the wonderful Helix. Its a CD-bootable Knoppix distribution custom-built for forensic analysis, and it has all sorts of useful tools on it.

http://www.e-fense.com/helix/

[Jizzle]

All my data is recovered and is moving from the HD I borrowed from my office back to Ron.

Many thanks for everyone's help in saving the day.

Mind telling us which tool or method you ended up using? Was it a simple matter of rewriting the MBR or did you have to carve raw data out?

[jur1st]

sorry about that...I ended up using getdataback. Copying the files took a while, around 12 hours all together. I did get everything back, though.

[lukeles]

real partition recovery tool: partition table doctor

So last night I sat down to do a clean install on my laptop after the tremendous weekend in Las Vegas. I backed up all my data to my External Maxtor 250 gb HD that I needed and then tossed in the windows disc. I quickly looked at the list of hard drives to format, and picked the top one. Turns out, my external and internal drives had around the same amount of free space, so I stupidly picked the top option and deleted the partition.

At this point I realized I had fucked up. I turned off the external drive, reinstalled a copy of Partition Magic I had laying around, hoping that it would see the partition and be able to restore it. Alas, this was not the case.

I'll be going over the forensics presentation from Sunday morning again, but before I do I'd like to know which of those tools can actually allow me to recover the data.

Thanks for your insight..

I suggest you use Partition Table Doctor to resolve your
problem.The software provides very useful functions:
Backup partition table, Restore partition table, Rebuild
partition table, undelete partition, Fix boot sector,
rebuild mbr,etc.

First thing I recommend you download the demo version of
Partition Table Doctor.( http://www.ptdd.com/download.htm )

Run the program and select "Rebuild Partition Table",
then choose "Interactive" mode.

See more: http://www.ptdd.com/recoverylostpartition.htm
http://www.ptdd.com/recoverdeletedpartition.htm
http://www.ptdd.com/partition-recovery.htm
http://www.ptdd.com

[Dutch]

I suggest you use Partition Table Doctor to resolve your
problem.The software provides very useful functions:
Backup partition table, Restore partition table, Rebuild
partition table, undelete partition, Fix boot sector,
rebuild mbr,etc.

First thing I recommend you download the demo version of
Partition Table Doctor.( http://www.ptdd.com/download.htm )

Run the program and select "Rebuild Partition Table",
then choose "Interactive" mode.

See more: http://www.ptdd.com/recoverylostpartition.htm
http://www.ptdd.com/recoverdeletedpartition.htm
http://www.ptdd.com/partition-recovery.htm
http://www.ptdd.com

Which part of the sentence "All my data is recovered and is moving from the HD I borrowed from my office back to Ron. " didn't you get ?
See post # 7 in the thread.

Dutch

[Macavity]

Which part of the sentence "All my data is recovered and is moving from the HD I borrowed from my office back to Ron. " didn't you get ?
See post # 7 in the thread.

Dutch

I have to admit, it'd be useful for future reference.

I know I'm going to be making a note of it, just in case I wind up in jur1st's position.

[converge]

yer one of those guys that sells his fire extinquishers because he's never had a fire, aren't you :p