20

While re-partitioning a Server 2003 R2 domain controller, we accidentally deleted the partition that held the Active Directory database folder (D:\AD\Data). The D:\ was a partition on a disk shared with C:\.

We eliminated the D:\ drive not realizing that it housed the Active Directory data folder. We have no other domain controllers and no backups of this Active Directory data.

Is there any chance of restoring the AD?

HopelessN00b
  • 54,273
matalaweb
  • 271

4 Answers4

49

If you just deleted the partition and did not create a new partition, it is likely possible to recover.

First things first - pull the drive, put it in a Linux box and do a raw clone. The first rule of data recovery is that you do your work on a clone, not the original.

Now on the clone run a linux tool called testdisk. If the filesystem hasn't been obliterated this should re-create the partition table entry and allow it to be accessed again.

If you did create a new partition, or if testdisk can't find the filesystem then your chances of successful recovery are much lower. You might want to consider talking to data recovery specialists at this point.

sleske
  • 10,234
Peter Green
  • 4,464
20

No. You deleted data for which you have no backups. It is gone.

HopelessN00b
  • 54,273
17

Just to emphasize and clarify yagmoth's comment - Active Directory is not backed up by a file system backup - it is backed up by a System State Backup. If you have one, just look up the Active Directory Directory Restore Mode instructions and you may have a shot. You'll have to know the Directory Restore password.

You might have to manually recreate the D: Drive first, but if you do, that will interfere with efforts of a manual disk recovery service's efforts if you decided to pursue that option. Doing a sector-level raw cloning of the drive first would not be a bad idea.

1

Depends what its worth to you, and factoring in timeliness. If you deleted the partition and nothing more, there are data recovery companies that will "undelete" files for you.

This is totally dependent on not writing any data to the disk blocks. So if you've created a partition or expanded the C drive, all recovery bets are off.

Note that continued use of the drive will decrease the probability of recovery, so if you want to do this, hard-power off now. Don't even do a safe shutdown.

But timeliness comes into it too - you're looking at days/weeks to do any sort of commercial recovery.

Otherwise its your perfect opportunity to build a new supported AD from scratch, and clear out all the old stale rubbish. Silver lining on a dark cloud.

Criggie
  • 2,328
  • 15
  • 27