External HDD suddenly wiped by XP! [Restoring partition tables]

This is a problem I had at work just now with one of my 300GB external drives. Since it appears to be rather unknown, I thought I’d post my findings here. It took me one and a half day to find out what had gone wrong, but I was able to restore everything back to its former glory thanks to OpenSource/GNU licensed software and some helpful tips from users at the TrueCrypt support forums. The Swedish users at this thread weren’t that lucky, and ended up formatting and losing their data.
Since I had just made a new TrueCrypt volume file at 150GB I thought that the reason for XP being unable to discover the drive was this new NTFS formatted file. This is what happened to the Swedes too. I was asked to "initialize" the disk, which I did, and suddenly the only thing on the drive was unallocated space.

I was using two laptops with XP Pro Service Pack 2 when the problem arose.
The 300GB external USB2 drive had 1 big partition (NTFS).

Symptomps:
After inserting an external harddisk drive into another machine/laptop using XP Pro, the drive is not recognized and not given a drive letter. Windows XP may ask you to initialize it. Going into Disk Management reveals that the entire space of the disk is unallocated. The disk appeared to be wiped, but in fact it is only the partition table that is. Unless you use the disk now, or format it, you should still be able to restore everything back to its normal state. But the more complex your partition scheme is, the harder it will be.

Solution:
Whatever you do, do not use the disk (e.g. use, format, defrag). The data itself is there. In this case, I powered off the disk immediately so that it would be no activity on it while I searched for a solution.
If you have the storage capacity make an image of the disk.
Download TestDisk from CGSecurity, and remember that the Win version is for WinXP/2000/2003 and the DOS version for previous Windows versions. TestDisk is a GNU/linux product, so it will work under maost operation systems, and it is also free of use. On the other hand, CGSecurity can not be held liable for any misuse or erraneous result of your using it. Again; if you have the capacity to make a backup image of the disk, then go ahead and do that first.

My process was a bit tiresome as I had to re-size the partitions of a stationary machine (using qtparted in Knoppix 5.01) so that I could make a ghost image of the disk first, using Norton Ghost 7.5.

Running TestDisk was extremely easy though. With the HDD turned on and plugged in, I ran the exe file and TestDisk showed me all the physical disks. I selected the right one and chose to Analyze it. After a couple of seconds it had found the one NTFS partition that had been on the disk. I was asked whether I wanted to apply/write this change to the disk.
Having nothing to lose, I went for it, rebooted the computer and voilá!

2 thoughts on “External HDD suddenly wiped by XP! [Restoring partition tables]”

  1. Btw, you don’t need an expensive solution to make a disk. If you use *nix operating system just use dd (but BE CAREFUL) and set OF to *.img.
    This can then be mounted as a loop device to do the partition search/file carving/forensics on without touching the physical disk.

    If you’re not into GNU/Linux let me suggest Clonezilla. It’s a LiveCD which allows you to do the same reasonably easy.

Leave a Reply

Your email address will not be published. Required fields are marked *


This site uses Akismet to reduce spam. Learn how your comment data is processed.