Cause of lost partition replaced by 2 Raw partitions

Question

I had a curious problem over the weekend... My 500gb WD hard drive all of a sudden could not be discovered by xp, then when I plugged in again via USB it was being discovered as 2 separate Raw partitions that were asking to be formatted. I have never modified partitions on this drive before. I was scratching my head for about this for 20mins or so when my second 1TB external hard drive did the exact same thing(with the same sized raw partitions as the 500gb).

I have since recovered the original partitions and data using Testdisk . I am more curious on the cause.... I suspect this could be a virus, however my machine hadn’t been online in a few days and AVG didn’t detect anything.

Has anyone seen this before?

Answer 1

Do a really deep virus scan.

In a normally running Windows machine the partition table will be written approximately never (ie about the time you format the drive or re-part it), and after that the partition entries won't be touched. They will be read frequently, but rarely written.

If you have something writing them, this is pretty nasty.

It could be bad mains power, though I have my doubts.

Generally look for the most obvious cause.

Answer 2

I saw this once or twice before when I lost power or tried to install linux on my USB thumbdrive. It's usually associated with windows not properly detecting the partitions, or a corrupt partition table, the latter of which can be caused by power failures, a failing harddrive, viruses, or probably several other actions. I can't recommend any off the top of my head, but you might want to find a program that will allow you to make a backup of your MBR and partition table, that way if this happens again you can simply restore those.