Big partition became small partition and unallocated space.
Posted: 11 Apr 2012, 22:40
Hi Everybody,
First, thank you for a great tool! I didn't knew it before and I won't forget it, because it looks really helpfull.
So why I'm here? Like my topic title is my problem really confusing and strange. I wasn't sure if it fits under partition recovery or filesystem repair, because it's a little bit of both. I would like to ask for some advice.
But let's start at the beginning.
My patient:
- Data Disk, 500GB Western Digital, IDE (onboard controller).
- 1 Partition (465GB in Windows Explorer)
- NTFS
- Cluster Size 4KB (I think)
- Windows XP SP3
In short:
- I got some balloon notifications from windows xp, that it couldn't write data to the affected disk.
- I checked the windows event-log and saw controller-errors. One of the event log reccomended chkdsk.
- So I ran chkdsk /f. Chkdsk began fixing a lot of stuff, really a lot. I was getting nervous but didn't know if I break something when I cancel the process. So I let it finish.
- After it was done I checked the disk (didn't check it before chkdsk - my biggest mistake) and it shrinked from total size 465GB to 20GB. Shock!
- All the files and folders are still there, but 0KB.
What I think what happened:
- Because of the controller error (and not chkdsk I believe) the partition went from 465GB to 20GB.
- chkdsk f/ fixed the $MFT and removed all the links to the data which was not in the first 20GB and couldn't be found anymore. Result: 0KB files.
So how is it lookig now? (click for large screens)
Windows Disk Management (which says the 20GB are error free):
TestDisk (after deep scan):
and
Advanced (I checked advanced before I made the deep scan - does this make a difference in the advanced result?):
Boot:
List:
Rebuild BS:
Repair MFT:
Ontrack Easy Recovery shows in the disk overview
- F:\ NTFS (20GB)
- Unidentified (212.87 GB)
- Unidentified (232.89 GB)
which is also strange because it shows two unidentified.
MiniTool Partition Wizard Home:
- F:\ 20GB
- 445.76 Unallocated
What I already tried:
Different tools for raw data recovery. They find files, but the results don't really make sense because they don't have the original filenames and are not in the original folder anymore.
What I could try:
I could write the logical disk info which TestDisk found as second partition. But I don't believe there will be any data on this partition.
And try other tools for raw data recovery.
What I would like to do:
Modify the 20GB partition so it will be shown as 465GB partition again.
Try to fix the $MFT table again (chkdsk or TestDisk) so it relinks all the files.
So my question would be: Can I do one of the steps with TestDisk?
Thanks in advance for any advice or input.
Best regards,
Jimbo.
First, thank you for a great tool! I didn't knew it before and I won't forget it, because it looks really helpfull.
So why I'm here? Like my topic title is my problem really confusing and strange. I wasn't sure if it fits under partition recovery or filesystem repair, because it's a little bit of both. I would like to ask for some advice.
But let's start at the beginning.
My patient:
- Data Disk, 500GB Western Digital, IDE (onboard controller).
- 1 Partition (465GB in Windows Explorer)
- NTFS
- Cluster Size 4KB (I think)
- Windows XP SP3
In short:
- I got some balloon notifications from windows xp, that it couldn't write data to the affected disk.
- I checked the windows event-log and saw controller-errors. One of the event log reccomended chkdsk.
- So I ran chkdsk /f. Chkdsk began fixing a lot of stuff, really a lot. I was getting nervous but didn't know if I break something when I cancel the process. So I let it finish.
- After it was done I checked the disk (didn't check it before chkdsk - my biggest mistake) and it shrinked from total size 465GB to 20GB. Shock!
- All the files and folders are still there, but 0KB.
What I think what happened:
- Because of the controller error (and not chkdsk I believe) the partition went from 465GB to 20GB.
- chkdsk f/ fixed the $MFT and removed all the links to the data which was not in the first 20GB and couldn't be found anymore. Result: 0KB files.
So how is it lookig now? (click for large screens)
Windows Disk Management (which says the 20GB are error free):
TestDisk (after deep scan):
and
Advanced (I checked advanced before I made the deep scan - does this make a difference in the advanced result?):
Boot:
List:
Rebuild BS:
Repair MFT:
Ontrack Easy Recovery shows in the disk overview
- F:\ NTFS (20GB)
- Unidentified (212.87 GB)
- Unidentified (232.89 GB)
which is also strange because it shows two unidentified.
MiniTool Partition Wizard Home:
- F:\ 20GB
- 445.76 Unallocated
What I already tried:
Different tools for raw data recovery. They find files, but the results don't really make sense because they don't have the original filenames and are not in the original folder anymore.
What I could try:
I could write the logical disk info which TestDisk found as second partition. But I don't believe there will be any data on this partition.
And try other tools for raw data recovery.
What I would like to do:
Modify the 20GB partition so it will be shown as 465GB partition again.
Try to fix the $MFT table again (chkdsk or TestDisk) so it relinks all the files.
So my question would be: Can I do one of the steps with TestDisk?
Thanks in advance for any advice or input.
Best regards,
Jimbo.