Sysadmin: Recovering deleted Windows partitions

I made a mistake the other day: I wanted to delete the partition on an external drive and in my haste ended up deleting the partition of a local hard drive instead…

The good thing is when you delete a partition using the Windows Disk Management console it doesn’t actually delete your files, only the partition header.

![Windows Disk Management Console][IMG1]

With NTFS files systems, there is a backup at the end of the partition. The problem is how do you recover it?

I first looked at the instructions from Microsoft knowledge base article [kb245725][1], downloaded the low-level sector editor `Dskprobe` but was getting no-where with it.

Searching google brings you to the usual list of recovery software that you can’t be sure will actually do the job until you fork $$ for them.
I’ve got nothing against paying for software but I’ve been bitten by false promises before.

My search ended up with [`TestDisk`][testdisk] an OpenSource utility to manipulate and recover partitions that works on almost all platforms.
The user interface is DOS only, so it’s not pretty, not point-and-click user friendly but it has a fair amount of options and after fiddling around with it for 10 minutes, I was able to simply recover the backup boot sector and tada! all my files were back!

![TestDisk in action][IMG2]

So, some recommendations when recovering lost partitions:

* Don’t panic! If you only deleted the partition (whichever type), chances are you’re likely to recover it or at least salvage the files.
* Obviously, be careful not to write anything over them, like recreating partitions and a file system.
* If you use a utility like `TestDisk`, don’t blindly follow the on-screen instructions. At first, it was telling me that I had 2 Linux partitions on the device (which used to be true) but it did not see the NTFS one. Then it thought I had a FAT partition only until I switched to the advanced options and inspected the boot partition.
Just know enough about file systems to know what you’re looking for.
* Low-level tools are not for everyone, so if you’re not comfortable using them, don’t tempt your luck and try a paid-for recovery tool with an easier interface.

If you use `TestDisk` and you manage to recover your files, don’t forget to [donate][3] to encourage Christophe GRENIER, the author.

### References

* [KB245725: How To Recover an Accidentally Deleted NTFS or FAT32 Dynamic Volume.][1]
* [TestDisk][testdisk] data recovery utility for Windows, Linux, OS/X, etc
* [PhotoRec Digital Picture and File Recovery][2] Open Source utility from the same author.

[1]:http://support.microsoft.com/kb/245725
[2]:http://www.cgsecurity.org/wiki/PhotoRec
[3]:http://www.cgsecurity.org/wiki/Donation
[testdisk]:http://www.cgsecurity.org/wiki/TestDisk
[IMG1]:/wp-content/uploads/2009/01/Recover1.png
[IMG2]:/wp-content/uploads/2009/01/Recover2.png