3

I just rebooted into Windows (I dual boot with Ubuntu), and everything in my D: partition is gone!

First question: How do I best preserve the current state of the hard drive to maximize chances of recovery?

My most immediate priority is preserving what's left of may data until I figure out how to recover as much of it as possible. Right now, I don't even dare move the mouse on that computer because I don't know how that might affect anything and destroy my chances of recovery. Should I just leave it on? Should I shut down "cleanly"? Should I just pull the power? Something else?

Short(-ish) version

Migrated 700GB D: partition from 1TB MBR drive to 2.3 D: partition on 3TB UEFI drive.

Dual boot Ubuntu 14.04 (upgraded from 13.10) and Windows 7, both 64 bit.

Was backing up laptop hard drive to said desktop partition, partition ostensibly ran out of space. Both Ubuntu and Windows reported 1.3TB/2.3TB utilization. Ubuntu explicitly errored not enough space left, Windows errored hard drive is too fragmented.

Analyzed drive fragmentation in Windows, it was kind of high (20-something percent). Started de-fragmentation, but cancelled it because it didn't really make sense.

Checked partition for errors using GUI; it hung at the end. Closed disk checker. I think fix errors was checked.

Ran dskchk /F /V /X D:. It apparently dismounted the partition (/X flag), and finished cleanly. Shut down computer.

Tried to boot into Ubuntu. Ubuntu for some unknown reason hung while booting.

Booted into Windows. Windows continued the check on disk partition on D:. It didn't take long (compared to the first run), and I didn't catch exactly what it said, but it reported removing a lot of "indexes". I'm not sure if those were just search indexes, or something different.

Opened D: partition to check if everything was OK. ALL MY FILES AND FOLDERS WERE MISSING.

Pulled power as per @David Schwartz's recommendation.

More questions

  1. Did I screw myself by trying to defragment the partition?
  2. Can I figure out exactly what chkdsk ended up doing to my partition? Will that help?
  3. How do I mount the partition without changing a single bit on the partition?
  4. What tools can help me recover the data? Do I need a new drive to assist with this?
  5. Any thoughts on getting professional data recovery help? If so, any recommendations for good firms?

Some background

Ironically, I was backing up my laptop hard drive to my desktop partition in question when I apparently ran out of room on the partition in question (D: in Windows, sda4 in Ubuntu). This was very surprising because I had a lot of free space left: both the df utility in Ubuntu and various tools in Windows 7 reported about 1 TB free (2.3TB partition on 3TB drive).

I believe the problem likely (but not certainly) has to do with when I migrated from a 1TB drive to a 3TB drive a few months ago. The migration was a pain since the old drive was MBR and the new drive had to be UEFI to support drive size greater than 2TB. I don't remember the exact details of the migration, but I essentially ended up installing Windows 7 from scratch onto a brand new C: partition (on the new drive), making a couple of extra, small-ish partitions for Ubuntu, then using the remaining 2.3TB for my D: partition. Then I installed Ubuntu 13.10 and copied my old ~700GB D: partition from my old 1TB drive to my new 2.3TB D: partition on my new drive. I don't remember exactly how I did the copy because I tried a lot of tools (both Windows and Linux), and I don't remember which one finally (seemed to have) worked.

Everything worked fine for months.

So fast forward back to now. rsync hung while backing up my laptop hard drive to the sda4/D: partition. Puzzled, I tried to touch a new (empty) file where the partition was mounted in Linux, and it complained that there was not enough space left on the device. df showed 1.3TB/2.3TB utilization.

I rebooted into Windows, and again tried to create an empty file. Windows complained that the drive was "too fragmented" even though it also reported 1.3TB/2.3TB utilization.

3
  • 2
    As @DavidSchwartz sugested, a 'LiveCD'/thumb drive will be benificial in that your HD won't be writing OS data. Also, take a look at TestDisk (cgsecurity.org/wiki/TestDisk), I've used it numerous times to save partitions I accidentally deleted or had some other issue come to. It's not a full data recovery tool, but a great partition recovery tool (and can handle multiple file systems for your dual boot needs).
    – txtechhelp
    Apr 25, 2014 at 5:06
  • 2
    NOTE: SE might not be the best place for the nandling of an emergency situation in an emergency time frame.
    – mdpc
    Apr 25, 2014 at 6:26
  • 1
    @mdpc Point taken, but I said "desperate" not "urgent" help needed. I still have my laptop and my work computer(s), so I can do without my desktop for a while. Apr 26, 2014 at 19:55

2 Answers 2

4

Pull the power immediately. You don't want the state of the drive to change at all. It won't get any better.

Boot from a CD, possibly a Linux live CD. Take a snapshot of the hard drive, possibly to an external drive. That way, no matter what happens you can get back to where you are now. That will allow you to try different recovery techniques.

3
  • 1
    Done. That was my first instinct too, but I wanted a sanity check. When I boot from eg, Ubuntu Live disk (or some other), do you know how I can force it to mount the partition read-only? (ie, not wait till after boot to mount -o remount,ro /dev/sd??.) Apr 25, 2014 at 4:30
  • 1
    @SchighSchagh I wouldn't mount the partition at all until after you back it up. (You don't want to back up the files, you want to back up the partition.) Apr 25, 2014 at 4:40
  • 1
    Any thoughts on backing it up without mounting it? dd off a live Linux disk seems like an obvious choice, but what live disk will boot up an OS without automatically mounting any partition it can find? Apr 26, 2014 at 19:57
1

I'd strongly suggest that you use your carefully maintained backups and restore your system from that. What I have found over my many years in dealing with such problem cases, that a LOT of effort needs to be done, usually with very little (if any) data recovery or reward.

You realize that you could be dealing with a disk or controller hardware failure. Such damage again has a low probability of information recovery.

If the information is that critical, and you do not have a backup, you might consider a professional recovery disk recovery service.

BTW, I disk image my systems to an attached drive using one of the many generally excellent products out there. In the event of disk failure or wipeout, I just completely restore the disk image.

2
  • 1
    Unfortunately, my backups aren't as carefully maintained as they should be. The vast majority of it is probably duplicated somewhere, be it one of my other, semi-retired drives or somewhere in the cloud. But the more recent data is not really duplicated. Do you know of any good professional disk recovery services? Also, can you recommend any particular disk imaging/backup solutions for the future? Apr 25, 2014 at 19:40
  • 2
    You realize that you could be dealing with a disk or controller hardware failure. Any thoughts on how to check for that? Apr 26, 2014 at 20:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .