Recovering files from simple dynamic volume

[RoadToNever]

Hi everybody!

I'm looking for recomendations for programs that are good for recovering files from deleted dynamic(simple) partitions. So far I've tried Testdisk, Partition find & Mount, R-Studio and ZAR. The fist two didn't locate any files while the second two did but not as many files as I had hoped for.

[dmarques]

Hi,

Before selecting any application, you should think what file system is involved, because depending on the FS, then you can choose an app.
What file system do you need to recover partitions?

[RoadToNever]

The FS is NTFS.

[dmarques]

For apps r-studio or gdb are just fine for that FS, but if they are not able, you need a manual analysis, and for that you can use winhex.

[RoadToNever]

Tried Get Data Back, it seems to find all the contents on the disk but the the file and folder names have become mixed up Anything else I could try beside manual hacking?

[Vulcan]

What happened exactly after the original partitions were deleted?

Were partitions recreated in the same space, after the original partitions were deleted? If so, were filesystems created in those partitions (i.e. was "format" or the GUI equivalent used)?

What exactly do you mean by the file & folder names being "mixed up"? Do you mean that all the file and folder names are correct, but that the file contents for file1 are from file2? Or do you mean the characters in file & folder names are jumbled e.g. instead of Downloads you see loDoadswn or similar? Or something else?

[RoadToNever]

Hang on, I'm giving GDBs excessive search a try.

To answer your question the original partition deletion was a random event. The disk is without physical damage such as bad sectors. AFAICT no data has been written after the event.

Do you mean that all the file and folder names are correct, but that the file contents for file1 are from file2? Or do you mean the characters in file & folder names are jumbled e.g. instead of Downloads you see loDoadswn or similar?

I'm seeing both conditions.

[Vulcan]

To answer your question the original partition deletion was a random event.

Thanks for the reply, but that comment is ambiguous - I could guess several possible meanings. Can you be a bit clearer please? Are you saying that the "partition deletion" happened without someone deliberately doing it? Or are you saying that someone did deliberately delete the partition (how exactly?), but it was accidental? Or something else?

AFAICT no data has been written after the event.

Why are you saying "AFAICT" - don't you know for sure? IMHO more details are needed from you about the exact circumstances of the original event - this will help others to understand the situation you are seeing.

Do you mean that all the file and folder names are correct, but that the file contents for file1 are from file2? Or do you mean the characters in file & folder names are jumbled e.g. instead of Downloads you see loDoadswn or similar?

I'm seeing both conditions.

Wow. This is very strange. If all I did was to delete a partition, and nothing else, I would not expect to see the behaviour which you are describing, since just deleting the partition does not affect the filesystem which was contained within that partition. However the behaviour you are describing suggests the filesystem has either been corrupted, or is unable to be correctly recognised by multiple recovery packages. I have a suspicion about what might be happening here, but I can't be sure from the info provided so far.

For this reason, answers to the questions above are important IMHO.

Of course if GDB is successful for you, then great!

[RoadToNever]

After playing around with the settings of GDB I have been able to get a seemingly successful recovery of my files with intact names, folder structure and content and overall size.

Why are you saying "AFAICT" - don't you know for sure? IMHO more details are needed from you about the exact circumstances of the original event - this will help others to understand the situation you are seeing.

What happend after the original partition disappeared was that I decided to run OSFClone to back up the current state of my problem disk onto a fresh disk. Something went wrong and the problem disk ended up with a dynamic partition that extended onto the fresh disk. Not expected of course, the fresh disk was a GPT disk and OSFClone wasnt prepared for that perhaps, who knows. Sorry I didnt mention this earlier I just couldnt quite recall the details in my last post. It's been a while since the problem apperad and I've only been able to try and solve it on and off during the last months.

Anyway problem finally solved!

[Vulcan]

After playing around with the settings of GDB I have been able to get a seemingly successful recovery of my files with intact names, folder structure and content and overall size.

I'm glad that seems to have been successful. Your other comments did help with some of my questions, but now we don't have to troubleshoot further.