?
Solved

Missing Partition

Posted on 2012-09-06
25
Medium Priority
?
812 Views
Last Modified: 2013-11-22
We have a coworker that has his drive partitioned to a C and D drive. I believe a rootkit virus has deleted or removed the D partition. Is it possible to recover this? If so, can anyone recommend recovery steps and/or software that can assist in retrieving this? I'm using Kaspersky to remove the rootkit. Any help would be appreciated.
0
Comment
Question by:abeasst
  • 12
  • 7
  • 2
  • +3
25 Comments
 
LVL 32

Accepted Solution

by:
Scott C earned 1500 total points
ID: 38373093
Try booting with a Knoppix disk to see if the partition can be seen with that.

http://knoppix.net/get.php

If you can see the partition and data you can copy it off then rebuild the partition and copy the data back.
0
 

Author Comment

by:abeasst
ID: 38373104
Ok I will try that and post back when I've got a result.
0
 
LVL 24

Assisted Solution

by:Eirman
Eirman earned 500 total points
ID: 38373159
Testdisk is an excellent free utility, specifically designed to recover lost partitions ...
http://www.cgsecurity.org/wiki/TestDisk
0
Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

 

Author Comment

by:abeasst
ID: 38373193
Knopix is a little more complicated than I thought it would be. I'll try TestDisk while I wait for the torrent file to download.
0
 
LVL 24

Expert Comment

by:Eirman
ID: 38373203
In Testdisk, If the partition is found, you must choose W for write to restore the partition.
0
 
LVL 32

Expert Comment

by:Scott C
ID: 38373236
Hopefully you can restore the partition.  Keep the Knoppix disk in your toolbox it can come in handy for other issues.
0
 

Author Comment

by:abeasst
ID: 38373243
Here's where I am in TestDisk:

1 P Dell Utility 204800 (size in sectors)

Bad Sector count:

2 * HPFS - NTFS 20480000 [recovery]
3 P HPFS - NTFS 122880000
4 E Extended LBA 1106694144

INvalid FAT boot sector
5 L FAT16 /32M  1106692096
5 L FAT16 /32M  1106692096

*=Primary bootable
P = Primary
L=Logical
E=Extended
D=Deleted

Where do I go from here?
0
 

Author Comment

by:abeasst
ID: 38373285
I hit quick search and the following comes up:


Partition              Size in Sectors

*FAT16 >32M     204800 [DellUtility]
P HPFS - NTFS     20480000 [Recovery]
P HPFS - NTFS     122880000
L FAT16/32M      1106692096 (I'm pretty sure this is the partition that used to be present)
0
 

Author Comment

by:abeasst
ID: 38373443
I'm not really sure where to proceed from here. Any help would be greatly appreciated.
0
 
LVL 32

Expert Comment

by:Scott C
ID: 38373468
Sorry, I'm not familiar with that program so wouldn't know what to suggest next.  Perhaps Eirman will be able to help.

How's the Knoppix download coming?
0
 

Author Comment

by:abeasst
ID: 38373505
I've got the files downloaded. Do I just burn these to a disk and then try to boot to disc?
0
 
LVL 32

Expert Comment

by:Scott C
ID: 38373514
Yes.  After burning, boot from your optical drive.  You might be prompted for your language.  I am assuming [EN].  The GUI will then boot up and you should see all of your drives.

From there click on the "bad" drive and see if you can access the missing partition.

The one thing I had to get used to was that everything is a sinle-click.
0
 

Author Comment

by:abeasst
ID: 38373640
I have this loaded now (Knoppix) and I'm looking at the desktop. I clicked on the Knoppix folder icon and it brings up the equivalent to Windows Explorer. On the left I see the C partition (63 GB), my flash drive, and that's it. The drive capacity is 750 GB. I'm guessing the partition is toast if I don't see it in this window. What's next, if anything?
0
 
LVL 32

Assisted Solution

by:Scott C
Scott C earned 1500 total points
ID: 38373815
Unless that partition utility can find something, I'm afraid it is gone.
0
 

Author Comment

by:abeasst
ID: 38373844
Ok well thanks for your help. The other utility states "no file found, file system may be damaged." I don't know enough about the utility to go any further.
0
 
LVL 32

Assisted Solution

by:Scott C
Scott C earned 1500 total points
ID: 38373874
Yeah, unfortunately if it say that it looks like your partition is toast.  Be sure to keep that Knoppix disk handy.  It can be very useful.

For example if the boot files get hosed but the rest of the HD is fine you can get the data backed up.
0
 

Author Comment

by:abeasst
ID: 38373886
The computer boots into windows just fine. There is some residual windows damage from the virus (file allocations and registry issues). The D: drive is just gone. I've never seen a partition get removed by a virus before. This is a new one for me.
0
 
LVL 32

Expert Comment

by:Scott C
ID: 38373925
Oh, I know this computer boots into Windows fine.  I was saying keep the Knoppix disk handy in case you run into a situation where it won't.

I use it for laptops quite frequently.  That way I can backup the data files and not have to go through the trouble of removing the HD.
0
 

Author Comment

by:abeasst
ID: 38373933
Oh definitely. I'm sure having Knoppix will come in handy. Thanks for the tip.
0
 
LVL 1

Expert Comment

by:VRABHILASH
ID: 38373967
is this a virus problem or issue with hard disk.

if you are using window, try you device manger and try to access your diskmanager and look do you have a drive is there which is not acceptable. before going any adviace step go and explore the drive or open it with run or or shell and confirm that your date is there,
0
 
LVL 93

Expert Comment

by:nobus
ID: 38375148
try the partition recovery soft from easus (free) : http://www.easeus.com/partition-recovery/

***be sure to NOT install anything on the partition to recover !
0
 
LVL 47

Expert Comment

by:noxcho
ID: 38375432
Can you take screen shot of Windows Disk Management (right click on My Computer - Manage - Disk Management) and load it here?
0
 

Author Comment

by:abeasst
ID: 38376078
It doesn't show up in Disk management. That's the first place I looked. The only thing there is  unpartitioned space and the C drive.
0
 

Author Closing Comment

by:abeasst
ID: 38376115
The solutions provided by ScottCha (Knoppix) and Eirman (Testdisk) both came back with the same results. Testdisk is a little easier to use but both do the trick. Unfortunately, I think I'm just out of luck. We're sending the laptop to a recovery service to see if they have any better luck. If they can resolve it, I will update the question.
0
 
LVL 93

Expert Comment

by:nobus
ID: 38376511
bummer - you did not try the recovery i listed...
0

Featured Post

Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

By default the complete memory dump option is disabled in windows . If we want to enable the complete memory dump for a diagnostic purpose, we have a solution for it. here we are using the registry method to enable this.
Curious about the latest ransomware attack? Check out our timeline of events surrounding the spread of this new virus along with tips on how to mitigate the damage.
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum editing capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.
This Micro Tutorial will give you a basic overview of Windows Live Photo Gallery and show you various editing filters and touches to photos you can apply. This will be demonstrated using Windows Live Photo Gallery on Windows 7 operating system.
Suggested Courses

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question