1

Nowhere can I seem to be able to find how to resolve this situation in-place.

What happened:

Before,

C: ~= 90GB, freshly installed Win 8.1 Enterprise, 64bit

D: ~= 880GB, also ntfs. Mainly for data files. Still contained folders from nonworking Win8.0, from when this was formerly the C: drive.

Manual chkdsk for C and D went fine in the Advanced Tools, Command Prompt bootup option. No errors.

Next, used Minitool Partition Magic to merge the adjacent D: into C:, as the subdir C:\D

Made sure order was correct, i.e. the C:\Windows is the same before and after, and other files originally directly under C:\ are still there, NOT under C:\D now.

After:

Win8.1 loads, but most icons from installed programs (to C:) are blank.
"C:\Program Files" and "C:\Program Files (x86)" and maybe other folders are totally missing from explorer.exe's view AND cmd.exe run as Administrator. However, the free vs. used disk space add up to about what should be from the C: and D: before the merge.

This leads me to believe the allocated files & folders ARE still written on the disk.

My hypothesis is that somehow, the ntfs permissions/ownerships/ACLs got screwed, possibly imposing onto those disappeared folders mappings from the old D: MFT that no longer exists.

Maybe the current SYSTEM/Administrator/TrustedInstaller/User/...? accounts suddenly can't see whatever ID somehow got linked to the missing folders? If so, how to restore? How to get a root-like view of the C: drive with no regard for ownerships or ACLs?

All research seems to point to using tools to undeleting files or scraping unallocated space; nothing seems to come close to fixing the messed up security-descriptors scenario.

Manually running chkdsk /f c: after the fact ended with no errors detected. Also did sfc /scannow

NOTES

  • the old C: partition was right after the EFI partition, earlier in the disk than the old D.
  • Had recovery/forensic tools installed like R-Studio, which are all inaccessible now, as they were under the old "C:\Program Files" or "C:\Program Files (x86)"
  • a User-level program like WinDirStat run against the C: in the post-merge Windows 8.1 doesn't reveal enough space taken by files to be consistent with the "free space" listed by running dir from a command shell. All the more compelling reason for my suspicions that from an ntfs point of view, the fs structure is fine and the folders are not really gone. Except even the "SYSTEM" account in Windows 8.1 can't see them. However, I could be wrong. Any other ideas?

1 Answer 1

1

For others hitting these possibly rare circumstances:

I was right in my suspicion that the missing folders were still on disk, albeit invisibly.

"Program Files\", "Program Files (x86)\", and "ProgramData\" were found entirely intact in the hidden c:\found.000
(I suspect that resulted from an automatic chkdsk preceding a boot back into Windows, after the partitioning software's batch job had run.)

I should have known to check...wish I had known before I let Windows self-heal imperfectly with sfc, which created barebones copies of all three above, and left me with a lot of careful file merging and manual link resolution later.

Many other files (from the older D: partition, now merged into C:) listed owners similar to

Account Unknown(S-1-5-21-580982140-4090956935-1935414389-1001)

which was no surprise.

Commands like

icacls * /grant:r everyone:f /t

and

takeown /F .

helped re-gaining access to those.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .