Boot drive overlain on data drive


  1. Posts : 39
    win 10 Pro 64b 21H2
       #1

    Boot drive overlain on data drive


    Just wanted to ask if anyone had seen anything like this. I have a whitebox HTPC that I built about 6 years ago. Aside from Win and other software updates, this hasn't changed over that time and has been operating just fine. Macrium Reflect is used to image (full & incrementals) the system drive every night to a NAS.
    The system drive is a 128GB SSD (C:) and it has a 2TB data drive (D:) for misc. junk.
    Today I went into the data drive to clean out some stuff and found that the drive structure had been changed. It appears that the D: drive has been overlaid with a copy of the C: drive and the system reserved space with these being labeled as F: and D: respectively. All other space was converted to unallocated. Prior to this the D: drive was just a large block of storage partition. I've included a disk management capture.
    I will be reformatting this to a single open partition, but did want to ask if anyone has ever seen anything like this? I'm sort of at a loss and as far as I can recall it wasn't something that I did, but who knows. I don't look at this drive very often, so can't pin down when this might have happened.
    Any other advice would also be appreciated. Thanks

    <br><img src="https://www.tenforums.com/attachments/general-support/201623-boot-drive-overlain-data-drive-capture.png" attachmentid="201623" alt="" id="vbattach_201623" class="previewthumb">
    Attached Thumbnails Attached Thumbnails Boot drive overlain on data drive-capture.png  
      My Computers


  2. Posts : 3,271
    Win10
       #2

    Can you check what files/folders are showing on Drive F: ? It looks as if the System Reserved and HTPCBoot drives have been cloned/copied over onto Disk 1 at some point, if so the most recent dates of files and folders on Drive F: may give you an idea about when it happened. This is just one possibility.
      My Computers


  3. Posts : 39
    win 10 Pro 64b 21H2
    Thread Starter
       #3

    Yeah, good suggestion. It looks as if this happened on 8/20. Still no idea of what might have caused it. My backup logs are all normal back through that date. No clue. I'll probably just go ahead and reformat and relabel the drive.
      My Computers


  4. Posts : 3,271
    Win10
       #4

    Did you check the "Macrium Refect" Log tab for "Image Restore" or "Clone" Entries ? Normally, the entries would be logged unless an image restore or clone was carried out/attempted offline through a bootable USB or DVD.
      My Computers


  5. Posts : 39
    win 10 Pro 64b 21H2
    Thread Starter
       #5

    Good thought, thanks. But no, there were no odd entries in the logs for a couple of days before to about 4 days after. Just the normal incrementals. These routines have been running pretty flawlessly for the past 5 years so not a big surprise I guess. I'm sort of out of ideas. Thanks for the suggestions, if you have any others pass them on.
      My Computers


  6. Posts : 19,516
    W11+W11 Developer Insider + Linux
       #6

    dlross said:
    Just wanted to ask if anyone had seen anything like this. I have a whitebox HTPC that I built about 6 years ago. Aside from Win and other software updates, this hasn't changed over that time and has been operating just fine. Macrium Reflect is used to image (full & incrementals) the system drive every night to a NAS.
    The system drive is a 128GB SSD (C:) and it has a 2TB data drive (D:) for misc. junk.
    Today I went into the data drive to clean out some stuff and found that the drive structure had been changed. It appears that the D: drive has been overlaid with a copy of the C: drive and the system reserved space with these being labeled as F: and D: respectively. All other space was converted to unallocated. Prior to this the D: drive was just a large block of storage partition. I've included a disk management capture.
    I will be reformatting this to a single open partition, but did want to ask if anyone has ever seen anything like this? I'm sort of at a loss and as far as I can recall it wasn't something that I did, but who knows. I don't look at this drive very often, so can't pin down when this might have happened.
    Any other advice would also be appreciated. Thanks

    <br><img src="https://www.tenforums.com/attachments/general-support/201623-boot-drive-overlain-data-drive-capture.png" attachmentid="201623" alt="" id="vbattach_201623" class="previewthumb">
    That looks like Disk one was restored or cloned to Disk1.
      My Computers


  7. Posts : 3,271
    Win10
       #7

    If you haven't yet formatted the disk 1, try to search the whole of F: drive with something like the "Everything" search tool ( free from: voidtools ). Then, sort by date, to give you a more precise idea of the time that the copy/clone happened, then search your Windows Event Viewer for what happened at that time.
      My Computers


  8. Posts : 39
    win 10 Pro 64b 21H2
    Thread Starter
       #8

    Thanks again. As yet I haven't reformatted the drive.

    I agree that it looks as if drive 0 was cloned to drive 1, but the question is how. The obvious culprit might be Reflect, but there is no indication in the MR logs that anything other than the normal daily incremental backups ran for a number of days around this time.

    Using the date/time stamp on the pagefile.sys on the F: drive as a reasonable indicator of when the clone happened, I've scanned the system event logs around that time (about 11:40 AM on 8/20), the last entry before this time was at 11:29 AM and the next entry after this time was at about 2:13 PM. I've scanned around these times in the event log and while I'm no wizard at reading the logs, I can find nothing that looks like it could have done this.

    This machine is not highly active as it's used as an HTPC running JR Media Center as the main app. There are a few other apps I run on it like MakeMKV and other than checking those occasionally for updates, the system pretty much runs itself. It does a reboot every morning about 3 AM and runs the backup around 4 AM. It's been running like this pretty much for over 5 years with nothing other than system and app updates.

    Still wondering, any further thoughts welcome.
      My Computers


  9. Posts : 3,271
    Win10
       #9

    Really seems like a mystery doesn't it, but please post back if you do solve it. A lot of members here use Macrium. Also, unless you are using the free version of Macrium, you could post a query on the Macrium forums.
      My Computers


  10. Posts : 39
    win 10 Pro 64b 21H2
    Thread Starter
       #10

    Thanks, appreciate your help. I do own the MR license, so I'll probably ask the guys there what they think although I kind of hate to bother them about something that doesn't necessarily look like MR did it. If I find out anything I'll post back.
      My Computers


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 10:28.
Find Us




Windows 10 Forums