Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

External Drive Repartitioned? - What happened and why?


  • Please log in to reply
11 replies to this topic

#1 britechguy

britechguy

    Been there, done that, got the T-shirt


  • Moderator
  • 6,787 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Staunton, VA
  • Local time:06:24 AM

Posted 26 September 2016 - 09:53 AM

Hello All,

 

          I have no idea of precisely what forum is best to ask this question on since any one of a number of factors could be involved.  I'm working with a client running Windows 10 on a Lenovo ThinkPad.  It's got AVG antivirus on it and I've determined that's causing problems with access to specific legitimate websites.  We were also being blocked from applying the Windows 10 Anniversary Update, and he had already tried prior to my attempt.  When we temporarily disabled AVG we could access all the websites that had been blocked (like Outlook.com, for instance) and when I had him disable it overnight [using the "until restart" option] and schedule a restart to try to apply the AU again it worked. I add the AVG details only on the off chance they might be somehow related to what follows.

 

          He also has a 500GB Seagate Slim external drive he's been using for some time to back up user data.   Several weeks ago something happened where the drive got renamed (which is what he noticed) and, somehow, repartitioned.  Based upon his description this does not seem to be the result of operator error (he doesn't even know how to partition a drive) and based on a Malwarebytes scan I'm doubting that it's the result of malware, either.  He had some malware identified, but what was identified did not ring any of my bells for doing this sort of thing.   The drive now shows a single partition of just a bit over 30 GB and had its volume name set to "Recovery."  Of course, the rest of the drive space still exists, but is not currently accessible.

 

          I don't know precisely what might have happened, so am soliciting theories just because I'm curious.   I also don't know whether this could be the result of some bizarre form of drive failure, but it seems far to "organized" a result for that to be the case.

 

          Finally, are there any tools that folks would recommend for trying to examine the now invisible space on the drive to see if we can get it back and recover whatever data may remain on it?   I want to take every precaution I can to avoid possibly losing data that may be recoverable.  I have already recommended that he replace this drive, and promptly, since I just don't trust it anymore.

 

          Thanks for any advice you all have to offer.  If this query belongs in another forum please feel free to move it.  There's just too much territory for it to fit conveniently anywhere.


Brian  AKA  Bri the Tech Guy (my website address is in my profile) Windows 10 Home, 64-bit, Version 1709, Build 16299

       

    Here is a test to find out whether your mission in life is complete.  If you’re alive, it isn’t.
             ~ Lauren Bacall
              

 


BC AdBot (Login to Remove)

 


#2 JohnC_21

JohnC_21

  • Members
  • 22,581 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:24 AM

Posted 26 September 2016 - 10:13 AM

See post #12 in this thread. If the drive was attached during the update there was a good chance Windows 10 decided to partition the disk. The update borked a lot of dual boot partitions. I would not write anything to the drive as this will make data recovery harder.

 

For recovering the data see if you can recover the partition table by using the partition recovery wizard of Partition Wizard. Do a Quick Scan first. For any partition it finds double click it and see if your files are listed. Highlight the partition with the files and click Finish. After clicking Finish click Apply. If not partition is found do a Full Search which will take a long time. If Partition wizard finds the partitions but does not list any files after double clicking the found partition do not click finish and close out Partition Wizard.

 

If Partition Wizard cannot find your partition then post back and I will give instructions on using Testdisk unless you are familiar with it already.

 

Edit: Also see this post on the same thread.


Edited by JohnC_21, 26 September 2016 - 10:19 AM.


#3 britechguy

britechguy

    Been there, done that, got the T-shirt

  • Topic Starter

  • Moderator
  • 6,787 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Staunton, VA
  • Local time:06:24 AM

Posted 26 September 2016 - 11:12 AM

John,

 

          Thanks much.   I've used Partition Wizard in the past, but it's been a while since the last go-round.

 

          One quick follow-up question:  I presume I can "grab and go" with this drive and do the examination using Partition Wizard and my own PC.  Is this correct?


Brian  AKA  Bri the Tech Guy (my website address is in my profile) Windows 10 Home, 64-bit, Version 1709, Build 16299

       

    Here is a test to find out whether your mission in life is complete.  If you’re alive, it isn’t.
             ~ Lauren Bacall
              

 


#4 JohnC_21

JohnC_21

  • Members
  • 22,581 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:24 AM

Posted 26 September 2016 - 11:16 AM

Correct, you scan the external on any computer that has Partition Wizard.



#5 britechguy

britechguy

    Been there, done that, got the T-shirt

  • Topic Starter

  • Moderator
  • 6,787 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Staunton, VA
  • Local time:06:24 AM

Posted 26 September 2016 - 05:14 PM

John,

 

         Thanks.  I had no luck with Partition Wizard.  It is not finding anything it can restore.  I'm thinking about using their data restoration tool next.

 

         Since the drive is now set up as a FAT file system of only 36 GB in size I have to believe it was repartitioned that way at the outset.  Given that the rest of the drive has been unallocated space since then there cannot have been any read-write action there since.  The data has to be there even if what Partition Wizard needs to reconstruct a full partition is not.  The drive did not fail.

 

          It's also interesting to see that his actual hard drive is broken into a C: and D: drive, which I'm doubting was the original case.  The D: drive had not been being used for File History or the like but there's an odd collection of data on it.

 

          It is disconcerting that any failure mode for the Anniversary Update wrought havoc like this did.  This goes well beyond "buggy."  I hope whatever it was that allowed this to occur has been fixed by now.


Brian  AKA  Bri the Tech Guy (my website address is in my profile) Windows 10 Home, 64-bit, Version 1709, Build 16299

       

    Here is a test to find out whether your mission in life is complete.  If you’re alive, it isn’t.
             ~ Lauren Bacall
              

 


#6 JohnC_21

JohnC_21

  • Members
  • 22,581 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:24 AM

Posted 26 September 2016 - 05:21 PM

I don't know if it's related to Windows 10 but a poster had the same problem where the drive changed to FAT16. He did not have much luck recovering anything including scanning the drive with recovery software. In TestDisk we tried to set the type to NTFS and do another scan and that did not work. When the drive is connected does it show as RAW in Disk Management?

 

http://www.bleepingcomputer.com/forums/t/626785/recovering-files-from-my-external-harddrive/?hl=%2Bfat#entry4084393



#7 britechguy

britechguy

    Been there, done that, got the T-shirt

  • Topic Starter

  • Moderator
  • 6,787 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Staunton, VA
  • Local time:06:24 AM

Posted 26 September 2016 - 05:30 PM

John,

 

          I'll have to check this tomorrow.  I think the drive was FAT32, if I'm not mistaken, but I'm sure it is formatted as FAT on the partition that is still accessible.  If I can't end up recovering anything I'll just reformat the whole drive as NTFS and write the data off as a loss.   It's just really sad that I have to even be considering this eventuality.


Brian  AKA  Bri the Tech Guy (my website address is in my profile) Windows 10 Home, 64-bit, Version 1709, Build 16299

       

    Here is a test to find out whether your mission in life is complete.  If you’re alive, it isn’t.
             ~ Lauren Bacall
              

 


#8 JohnC_21

JohnC_21

  • Members
  • 22,581 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:24 AM

Posted 26 September 2016 - 05:34 PM

Yeah, never want to lose data. Good Luck.



#9 britechguy

britechguy

    Been there, done that, got the T-shirt

  • Topic Starter

  • Moderator
  • 6,787 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Staunton, VA
  • Local time:06:24 AM

Posted 26 September 2016 - 05:47 PM

Well, what's even worse is that this particular user has been doing everything right.  He's kept an external backup drive, regularly backed up his data, etc.  About the only mistake he made was keeping some of that data strictly on the single backup drive and removing it from the machine itself.

 

That his came about during the attempt to apply the Anniversary Update is, to put it mildly, an outrage.  There are times when my blood could boil, and this is one of them.  I am a strong supporter of always applying any updates to any operating system that its maker recommends.  But when things like this happen, though they are rare, it shakes one's resolve about doing what is, in the vast majority of cases, the best thing to do.


Brian  AKA  Bri the Tech Guy (my website address is in my profile) Windows 10 Home, 64-bit, Version 1709, Build 16299

       

    Here is a test to find out whether your mission in life is complete.  If you’re alive, it isn’t.
             ~ Lauren Bacall
              

 


#10 JohnC_21

JohnC_21

  • Members
  • 22,581 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:24 AM

Posted 26 September 2016 - 06:14 PM

I would only do the following if all other attempts at data recovery fail. Use Partition Wizard to delete any existing partitions on the external drive then do a full scan with the Partition Recovery Wizard. Deleting all partitions may make it easier to find something.



#11 RolandJS

RolandJS

  • Members
  • 4,477 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:05:24 AM

Posted 26 September 2016 - 06:40 PM

britechguy, I'm wondering if that external HD just happened to be attached when the Windows 10 Annv update was applied.  If you said so earlier, sorry, I missed it.


"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)

"I heard Spock finally got colander!"  "I believe the word is Kolinahr."  "Oh."


#12 JohnC_21

JohnC_21

  • Members
  • 22,581 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:06:24 AM

Posted 09 October 2016 - 07:25 AM

Hello Brian,

Not exactly your issue but see the BC article on the Windows Insider Preview. Other people on BC have posted the RAW issue though. This should have been the first on the list and in big bold letters.

 

  • We fixed an issue resulting in a small set of users seeing the NTFS partition of their external hard drive incorrectly showing up as RAW format.

     

     






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users