While re-partitioning a Server 2003 R2 domain controller, we accidentally deleted the partition that held the Active Directory database folder (D:\AD\Data). The D:\ was a partition on a disk shared with C:\.

We eliminated the D:\ drive not realizing that it housed the Active Directory data folder. We have no other domain controllers and no backups of this Active Directory data.

Is there any chance of restoring the AD?

  • 4
    Time to call a data recovery service and ship the disk.. – pauska Feb 24 '16 at 21:14
  • 8
    Or, it's 2003 and out of support. Build two new DCs and do it properly on a supported operating system. – Michael Hampton Feb 24 '16 at 21:17
  • 21
    Think of this as a blessing in disguise. You get to build a greenfield AD environment (because you have no other options), but you can build it right, this time. Oh, and you also have a good start on what not to do this time around (I count 3 biggies), so there's another silver lining. – HopelessN00b Feb 24 '16 at 21:20
  • 6
    Did you did a system-state backup ? just to be sure, as it can include the active directory even if you didnt know it was backuped. – yagmoth555 Feb 24 '16 at 21:33
  • 6
    Assuming that you just deleted the partition, you are not using any kind of volume manager and you did nothing with the space the partition was in after. It should just be as simple as readding its entry to the MBR/GPT and it would come back... – Vality Feb 25 '16 at 0:27

If you just deleted the partition and did not create a new partition, it is likely possible to recover.

First things first - pull the drive, put it in a Linux box and do a raw clone. The first rule of data recovery is that you do your work on a clone, not the original.

Now on the clone run a linux tool called testdisk. If the filesystem hasn't been obliterated this should re-create the partition table entry and allow it to be accessed again.

If you did create a new partition, or if testdisk can't find the filesystem then your chances of successful recovery are much lower. You might want to consider talking to data recovery specialists at this point.

  • 1
    Using a boot disk like Hiren's Boot CD will include all the tools needed to do every step you listed, including testdisk: hirensbootcd.org/download – SnakeDoc Feb 25 '16 at 18:52
  • I should point out, besides being the best answer for this question, it is possible in some cases where software can scan hard drive disks and recover those deleted files with time (can take a while to scan and recover). Besides searching for recovery software that can restore deleted files, there's no guarantee any of those will work (especially if they rely on the filesystem to be intact). The only way to guarantee you don't lose anything is to backup often and/or call a recovery specialist who specializes in hard drive repair & recovery (not forensics and recovery). – dakre18 Feb 25 '16 at 21:36
  • Even if you did create a new partition, testdisk will be able to determine how far the filesystem was stretching, effectively allowing to re-create the old partition. If the new partition was not just created but also formatted, chances are nowhere as good. – the-wabbit Feb 25 '16 at 21:40

No. You deleted data for which you have no backups. It is gone.

  • 2
    Unless he has a system state backup. But it doesn't seem likely... – Massimo Feb 24 '16 at 22:37
  • 1
    OP did say he had a C: drive backup; hopefully SysState was either selected by default or it got checked. – user339468 Feb 25 '16 at 0:18
  • 7
    Deleting a partition deletes no data. In fact, all the data are 100% recoverable, even if the other partitions are being used, because no partition will EVER write outside their allocated space... that's just utterly retarded if it happens. – Nelson Feb 25 '16 at 5:08
  • 4
    @Nelson This is technically accurate, but only relevant if the space wasn't reallocated. As there is generally no reason to delete a partition unless you are reallocating its space, odds are overwhelmingly high that this is what happened. Feel free to request clarification from the OP, or provide an answer of your own based on the possibility that the only action taken was deleting the partition, but this strikes me as a scenario so unlikely that I didn't feel it was worth considering. – HopelessN00b Feb 25 '16 at 10:30
  • 2
    This answer is derisive and factually incorrect, not "hard line". Yes the OP screwed up, but the only thing this answer is good for is your rep. – Lilienthal Feb 25 '16 at 20:46

Just to emphasize and clarify yagmoth's comment - Active Directory is not backed up by a file system backup - it is backed up by a System State Backup. If you have one, just look up the Active Directory Directory Restore Mode instructions and you may have a shot. You'll have to know the Directory Restore password.

You might have to manually recreate the D: Drive first, but if you do, that will interfere with efforts of a manual disk recovery service's efforts if you decided to pursue that option. Doing a sector-level raw cloning of the drive first would not be a bad idea.

  • 5
    +1 for clone. Go into full forensic procedures -- pull the drive and clone it and only try to rescue from the clone. Theoretically I believe you should be able to recreate the partition -- maybe under Linux -- and the underlying filesystem might still be in place. – rrauenza Feb 24 '16 at 22:21
  • 4
    @HopelessN00b: Then you have trust issues. Deleting a partition only changes a few bytes in the 512-byte MBR at the start of the disk, and in no way touches the actual data. Figuring out the correct values to restore the partition is not rocket science, and even if you somehow got them wrong, you wouldn't get magically slightly corrupted data, you'd get no data, as the filesystem wouldn't be found at all. All your "advice" on this question is downright harmful. – Aleksi Torhamo Feb 25 '16 at 9:34
  • 1
    @AleksiTorhamo No, what's downright harmful is basing the backbone of a corporate computer environment on recovered data, the integrity of which cannot be validated. That kind of reckless practice is exactly what got them into this precarious position in the first place, running a domain on a single domain controller, with no backups, on a platform that is end of life. That said, your comment should be an answer, so make it one, and the OP will be able clarify whose assumptions are correct, yours, or mine. – HopelessN00b Feb 25 '16 at 10:35
  • 1
    @HopelessN00b: Fair enough. I'm not a native speaker. :) (Not that I'm particularly good at communication even in my native language...) The analogy is a bit backwards though, since he talked about "BB pellets" and you assume "a .45". Given your last comment on your own answer, though, the assumption that you're making is quite a reasonable one. If your answer was prefixed with "Assuming that in addition to deleting the partition, you allocated a new partition and formatted it, ...", making the [reasonable, but dangerous if wrong] assumption explicit, I'd have had no qualms about it. – Aleksi Torhamo Feb 25 '16 at 12:21
  • 1
    @BlueCompute Actually, hashing out details and making clarifications is exactly what comments are intended for by SE overlords. – HopelessN00b Feb 25 '16 at 13:24

Depends what its worth to you, and factoring in timeliness. If you deleted the partition and nothing more, there are data recovery companies that will "undelete" files for you.

This is totally dependent on not writing any data to the disk blocks. So if you've created a partition or expanded the C drive, all recovery bets are off.

Note that continued use of the drive will decrease the probability of recovery, so if you want to do this, hard-power off now. Don't even do a safe shutdown.

But timeliness comes into it too - you're looking at days/weeks to do any sort of commercial recovery.

Otherwise its your perfect opportunity to build a new supported AD from scratch, and clear out all the old stale rubbish. Silver lining on a dark cloud.

  • 3
    It's dependent on more than just not overwriting the data. Data recovery is a tricky (and expensive and time consuming) business with no guarantees. – Todd Wilcox Feb 24 '16 at 22:34
  • 1
    @ToddWilcox absolutely agree with all your points. My intent was to show the user can make recovery even harder by faffing about instead of isolating the device. – Criggie Feb 25 '16 at 3:51
  • 2
    Just because you've created a new partition doesn't mean all recovery bets are off. Please do more research on the matter before making a vague statement like that. – Marc DiMillo Feb 25 '16 at 15:24
  • @MarcDiMillo As I said to Todd, "My intent was to show the user can make recovery even harder by faffing about instead of isolating the device." – Criggie Feb 25 '16 at 22:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.