cgsecurity.org

Hi,

Yesterday I suddenly lost the single volume in an Extended LBA partition (I think this is what they call a logical partition?)
After the first panic and madly searching for anything to recover this partition, my son pointed me this TestDisk page, bless him for that.
After reading through it I ran the TestDisk executable and at first got a bit scared because it listed heads/cylinder mismatches, number of sectors per track mismatches and space conflict between two partitions. (the primary partition and the extended LBA partition following it)

With dread I started the Quick Search and after some time it listed all of the 4 partitions but each one had a D (Deleted) in front, which surprised me because the first 3 were still intact according to Disk Management console.
So at first I had missed the bit about the left/right arrow keys and selected the missing partition and pressed P.
To my delight it listed the complete contents of the missing partition. So the next thing I did was to copy all of the folders/files to another HD.
Obviously this took some time but after it had finished, it turned out everything was recovered/copied without any obvious data loss. Programs worked, images were intact, documents readable, etc.

At this point I intended to just delete the extended partition in Disk Management and recreate the thing from scratch.
However I suddenly noticed the left/right arrow bit and thought I'd give that a go as this would save me a lot of work if it worked.
At this point things went above and beyond me as I couldn't change the prefix of the last partition to an E, the bootable one easily changed to an * and the two primaries effortlessly changed to a P but when I changed the 4th to an L (an E wouldn't show up), this red text showed up at the bottom mentioning Structure: Bad.

So now I'm lost, pressing enter proceeded to the next screen which just said Invalid partition structure. and >[Ok] at the bottom, hitting Enter again then just brought me back to the main menu with Analyze, Advanced, etc.
As said before, I could just delete the partition in Disk Management, recreate it and be done with it, but...
Those mismatch errors give me the heebie-jeebies even though these partitions seem to be perfectly fine, Windows10 boots normally and ChkDisk doesn't show any errors on it.

Please post a log file and upload screenshots of what you are doing to this site using the "Attachment tab" on the bottom of the page.

This is what I am working with, the volume that was in the green area just up and disappeared out of the blue.


Stage 1


Stage 2


Stage 3 - Partition to be recovered outlined in red


Stage 4 - All folders/files in the bottom partition were still there so went and copied the lot to another HD


Stage 5 - At this point I became aware of the left/right arrow options and tripped here, could not set it to E (extended).


Stage 6 final screen, pressing Enter just brings me back to the main screen.


LOG File, zipped and attached, images were limited to max 3 so placed these on imgur.

Stages 1, 2 and 5 is what gives me the creeps... other than that I could recover the contents of this partition and the first 3 partitions seem to be error free according to Windows10

There is no space between partition 3 and 4.
You must set the last partition as P(rimary).

Won't that make it unrecoverable? Since it's actually an Extended with a logical Volume inside (at least before it vanished)

Would it make a difference if I used something like Reflect Macrium to put a bit of space between or would that destroy the partition and make it definitely unrecoverable? Mind you, since I have successfully recovered the content I wouldn't be too bothered by it... but if I can recover it in whole with content that would save a me a lot of extra work

And what about the mismatches?

Addict wrote: 08 Aug 2020, 12:20 Won't that make it unrecoverable? Since it's actually an Extended with a logical Volume inside (at least before it vanished)

It has never been an "Extended with a logical Volume inside" as there is no space for an extended one.
Looking at the partition table strongly suggests that you have put that "Extended with a logical Volume inside" in there.

Just follow the advice given by cgrenier.

Would it make a difference if I used something like Reflect Macrium to put a bit of space between

There is no need to shoot nuclear warheads at sparrows.

or would that destroy the partition and make it definitely unrecoverable? Mind you, since I have successfully recovered the content I wouldn't be too bothered by it... but if I can recover it in whole with content that would save a me a lot of extra work

No.

And what about the mismatches?

They don't play a role for your operating system.

recuperation wrote: 08 Aug 2020, 14:53

Addict wrote: 08 Aug 2020, 12:20 Won't that make it unrecoverable? Since it's actually an Extended with a logical Volume inside (at least before it vanished)

It has never been an "Extended with a logical Volume inside" as there is no space for an extended one.
Looking at the partition table strongly suggests that you have put that "Extended with a logical Volume inside" in there.

Not sure what you mean, the currently unallocated space was occupied by a recovery partition in case of boot failures, the extended LBA used to contain both since only 4 can exist on a single drive. I've not changed or 'put' that in there, there simply was no other way to get 5 partitions on a single drive without putting the last two in an Extended or whatever it is called partition containing these last 2. Since the recovery disk is now external I've shrunk the LBA and just didn't bother with the remaining space anymore
The fact that there's no space in between it and the preceding partition may just be because I fiddled with Reflect in the past trying to swap the order of the 2nd and 3rd partition, without success.

recuperation wrote: 08 Aug 2020, 14:53 Just follow the advice given by cgrenier.

Addict wrote: 08 Aug 2020, 12:20 And what about the mismatches?

They don't play a role for your operating system.

Alright, that's one plus, but on the partition type of that vanished one I'm not sure it'll work... I know what it was since I created it myself... so I am not all comfortable with 'converting' it to a primary...
I will do so however since the content is recovered anyways...

Anyways, thanks for the assistance, just wasn't sure those mismatches might bite me in the behind later on

Just to let you, and everyone else reading this topic, know that setting the last partition to primary saved the day, even though it wasn't a primary before (see screenshot, simple volumes do not live in primary partitions) This leaves me with one final question, but probably unrelated.

After first having copied the content of this partition to another HD, I noticed that the $Recycle.bin folder contained a few subfolders with files that weren't visible in the 'Recycle Bin' (and still aren't after recovering the partition). Anyone know a good way to remedy this?

I guess solving this issue is outside the scope of this forum, but thought to ask anyway.

Rests me to thank recuperation for the final answer and cgrenier for making this tool, without which things might have looked a whole lot bleeker.
You both have my gratitude and I will try my damnedest to make a donation. (might be a while because I'm currently unemployed and on welfare)

Addict wrote: 08 Aug 2020, 15:49 Not sure what you mean, the currently unallocated space was occupied by a recovery partition in case of boot failures, the extended LBA used to contain both since only 4 can exist on a single drive. I've not changed or 'put' that in there, there simply was no other way to get 5 partitions on a single drive without putting the last two in an Extended or whatever it is called partition containing these last 2. Since the recovery disk is now external I've shrunk the LBA and just didn't bother with the remaining space anymore
The fact that there's no space in between it and the preceding partition may just be because I fiddled with Reflect in the past trying to swap the order of the 2nd and 3rd partition, without success.

You are most probably right with the issue of the 5th partition. I think I am wrong, will have to test that!