I have a desktop running Windows XP with a 200 GB Hardisk. A logical drive (25 GB) was accidentally deleted from an extended partition. No partitions were created or deleted after the accident (in other words, there has been no modification to the hard disk's contents since the problem occurred). Is there any Linux utility\tool\software that I can use to either recover the partition or at least be able to extract the lost data on to another hard disk? I plan to use a LiveCD since, linux is so much more manageable than Win32.

thanks.


P.S. Using some demos, i did manage to find the sector number that the lost partition began. There were 8 partitions (hda1 hda2 hda3 hda4<hda5 hda6 hda7 hda8>) and I recovered only hda1-6 with cfdisk and testdisk. Hda7 is FAT32 and hda8 was NTFS 3.1 (Windows XP SP2).

Testdisk was going to be my suggestion. I'm surprised it missed some - did you use search in addition to analyse ??.

I'm also a bit confused. First you say you lost (just) one logical - in the postscript you imply you lost hda6, hda7 AND hda8.

Try gpart.

http://www.t2-project.org/packages/gpart.html

It is included with SystemRescueCD.

I suggest use PhotoRec from CGSecurity. It does not need a working partition table to start with. It starts at sector 1 and then stops at the end of the disk.

testdisk didn't seem to recognize the missing extended partition, hda4 (it encompasses the rest of the drive space besides hda1-3) that had logical drives hda5, hda6, hda7, and hda8. In fact, it only detected hda6 and hda8 as FAT 32, suggesting five primary partitions. I manually, with cfdisk, put back hda4 and simply guessed on the sizes and locations of had5 and hda6 to restore them (which proved the partition table of the HDD was only broken). I guessed and checked with a couple of demos. I believe hda7 and hda8 are damaged in such a way that the data is intact, but not so much the FS structures.

With a demo, i did manage to figure out the exact sector that hda8 begins (also know the approximate size of either 25GB). I wonder if there is such a utility for partitions that allow manipulation of the start and stop of partitions by sectors.

But, I'll try gpart.

P.S. Sorry for the confusion. I'm really after hda8, and hda5,hda6, and hda7 aren't too important. Originally, the partitions were like this at the accident:

hda1 hda2 hda3 hda4< --- hda6 --- --- >

the "---" signifies the gaps and missing partitions.

Usually when the partition table goes the file system loses its pointers and information, so file system utilities have to be run to fix the file structure. When this happens there is a possibility of losing data. I do not recommend using Testdisk while PhotoRec will get most of data back with out screwing around with the partition table and file system. PhotoRec does not use the partition table. It finds the header of the file formats that it knows and re-constructs the files. It may take a while to scan the disk, but it should work.

On the contrary, deleting a partition has no effect on the filesystem. Or data.
Partition table entries (all of them, on "classic" DOS layouts) are basically just extent start and end. Logicals (being a linked list) have the potential to damage data if they are inappropriately redefined.

testdisk and photorec come from the same people, and function similarly in that they go looking for "signatures" to determine what (and where) might be on the disk.
Both tremendous pieces of work.

I must say it appears we are not being given all of the story here by Exeis - things keep changing with each new post.

Duplicate post - deleted.

what syg00 said about logicals as a linked list seems interesting...

as a safety precaution (heeding syg00 warning about logical drives...), I'm using a demo to recover the data in the lost partition to another partition on another physical disk. Tedious, yes, but at least the demo *only* reads the drive to extract data from it, if that's how it works in general. I'm 'backing up the data' before doing any changes to the hard disk, in case I worsen the situation.

I'm still going to test out gpart on another machine to see if it'll work for my situation.

P.S. my knowledge on disk geometry and partitioning is limited, hence I apologize if things I've said aren't consistent. Plus, i guess there were some details of the problem that I thought might not be significant.

Normally, this accident wouldn't be a problem, had the partitions been deleted by cfdisk. Before the accident, I had added another logical drive (hda9)via cfdisk since there was about 87GB of free space in the extended partition(hda4). My mistake was that, under Windows XP, I used the built-in disk management utility of Windows to remove hda9 (since I noticed that hda9 didnt have enough capacity). This caused hda5, hda7, and hda8 to 'disappear'. Lesson learned: 1.) Backup before partitioning of any kind 2.) Use same utility to add or remove partitions.

It's one of the reasons I don't like using Windows... there is so much the OS does that the user can't monitor that can be monitored in linux. ("more power to the user" in linux!)

When you're dicking around with disks, "dd" the whole disk off to another. Screw around with the copy. That way you can always restart - or try something different.

I don't know what Windoze disk manager would have done in that situation; I never use it.