Accidentally converted basic disk to dynamic disk

[DistortedVision]

How many posts do I need to make so that I'm not subjected to moderator approval?

[fzabkar]

The simplest way to post the sector contents without requiring approval is to Copy Sectors to a file and then post a hex dump in text mode (using HxD).

[DistortedVision]

fzabkar thanks for your continued help.
I'm unsure what you're asking me to do in HxD. Is it right click Select All and copy?
I've sent you a PM with links to the screenshots.

[fzabkar]

Edit -> Select All (or Ctrl-A)
Edit -> Copy as -> Editor view

Then paste the contents of the clipboard into your next post (Ctrl-C). Use the "code" function in the toolbar above the reply box to format the input.

Here are your screenshots:
https://dl.dropboxusercontent.com/u/105 ... .26.29.png
https://dl.dropboxusercontent.com/u/105 ... .27.28.png

Edit: Your PM states that sector 2048 is blank, as well as sector 0. However, the backup NTFS boot sector appears intact. If this sector is valid, then we could use it to reconstruct the boot sector and partition table. My next step would be to examine the sectors immediately following 63 and 2048. Can you see any reference to NTLDR?

Last edited by fzabkar on March 19th, 2014, 14:34, edited 1 time in total.

[DistortedVision]

Sector 2048 is empty as well.

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000001B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000001C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000001D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

[DistortedVision]

Awaiting further instructions as I don't know what to do. Tried reading and researching but don't want to do anything and cause further damage.

[fzabkar]

At the moment we are merely examining the drive in readonly mode. If you have any reason to suspect that the drive has head/media problems, then I recommend that you clone it, sector by sector. Then work on the clone.

Otherwise, can you see any reference to "NTLDR" in sectors 64 or 2049, or are these sectors blank as well?

[DistortedVision]

Thanks. Both those sectors are empty too.

[fzabkar]

Select Tools -> Search for Special Sector -> MFT Record

[DistortedVision]

Okay - this looks its going to take an hour or two.

[fzabkar]

Can you find any reference to "$MFT" in either of the following sectors?

6293504
6291519

BTW, an MFT record search shouldn't take too long.

[DistortedVision]

The search is in progress. Will report back.

Really appreciate your help with this. I'm not sure how I can show my gratitude.

[fzabkar]

I'm just wondering whether your drive has been wiped. If you drag the vertical scrollbar from sector 0 to max LBA, do you see anything other than zeros?

Was the conversion from a basic partition to dynamic an instantaneous process, or did it take an hour or more?

If your drive is still scanning, then I suspect that you will find nothing.

[DistortedVision]

Still scanning - its at 25%. The drive hasn't been wiped as I can recovery files with R-Studio. Everything I've recovered is perfect. I'm not able to recover everything and its not ideal as there is no directory structure and all the files are renamed with generics.

The conversion to dynamic disk was instaneous.

Should I abort the scan or let it complete?

[fzabkar]

ISTM that there isn't any point scanning the drive. If the MFT were intact, you would have found it long ago. AFAICS, raw recovery is your only option now.

That said, it appears that your file system was already damaged prior to the conversion, unless I'm misunderstanding the process. I can recall at least two threads in other storage forums where the OPs recovered from such a conversion by editing the partition table, but your situation appears totally different. Perhaps those other people were using a different OS??? Sorry, I'm out of depth now.

[labtech]

Something is not added up with what happened with the drive.
Mft is gone, hence no file structure.

[DistortedVision]

I scanned the drive overnight to search for the MFT and it didn't find it. Is what I can recovery with R-Studio is the best option?

[labtech]

pretty much... though you never answered my question, it seems that GDB produced the same results. Data should be under Lost and Found.

[DistortedVision]

I can recover files with R-Studio I've not fully investigated it. All the filenames have been renamed so I need to continue with it. Not all the jpeg files were recovered. I was hoping to get the directory tree etc ie the partition as it was but this does not look feasible does it?

[DistortedVision]

I'm guessing that NTFS Search would not help me progress if I can't find the MFT sector manually? Sorry if this is a stupid question I have very limited knowledge of data recovery.