TIP: recovering a broken hard disk partition table

happyoutkast · n00b Joined: 17 May 2005 Posts: 47

I'm sure anybody that's messed around with linux and changing partition tables has run into this problem: all of a sudden your partition table has become corrupted. I know this has happened to me more times than I care to count and really....it's something I feel like I'm getting more experience in than I would like. I didn't have this problem for quite some time so when hdparm managed to completely zero out the partition table of my /dev/hda hard drive, I about went into shock (especially since it's maybe a month until finals...).

So, I'm writing this to provide some tips and hints on how to:

1. pre-emptively back up your partition table in case it gets lost to make life easier

2. if you were an idiot, like me, and didn't back up your partition table, then how you can have the best chance of restoring it.

NOTE: this may be more difficult depending on the nature of your loss. For example, resizing partitions or formatting a partition and losing data will make life much more difficult. If you formatted, there's a good to excellent chance you are going to have to bid a fond farewell to your data.

First thing's first, if you find your partition table has been ruined, DON'T DO ANYTHING DRASTIC!!! Just because your partition table has been fscked up, doesn't mean your data and parition's boot sectors aren't there. All it means is that os's and low level utilities that read the hard drive partition table don't know where your partitions begin and end, so you can't mount, etc....In my case grub still worked fine and allowed me to boot into my second hard drive's gentoo install even though the partition that has grub.conf got lost. Even windows xp would try and boot for maybe 2 seconds before blue screening and rebooting.

So, now that I have a working partition table back, let's back it up in case this happens again. This can be done easily with the dd command. Make sure you replace /dev/hda with the actual info for your drive (/dev/sda or /dev/hdb, etc...).

# dd if=/dev/hda of=mbr bs=512 count=1

this will save your hard drive's master boot record including partition table information to a nice little file called mbr. Write this to floppy, burn it to cd/dvd, or just plain back it up somewhere save OTHER THAN the hard disk it's supposed to be a backup of. It would be rather pointless to store the mbr back up of a hard drive on that hard drive wouldn't it?

If you need to restore your mbr from that backup, simply cd to the directory where the mbr file is stored and execute the command below. For example, let's say you burned it to a CD-R disc:

# mount /dev/hdc /mnt/cdrom (replace the /dev/hdc with the actual locatation of your cd rom, and /mnt/cdrom with the mount point you wish to use)

# cd /mnt/cdrom

now, let's assume that the dd executable is in your PATH, it most likely will be. To restore your partition table without overwriting the mbr, execute the command below. I'm not certain but I think that by omitting the skip and seek options you can have it overwrite the mbr too. However that is most likely not necessary unless you really tore things up.

# dd if=mbr of=/dev/hda bs=1 count=64 skip=446 seek=446

Again replace /dev/hda with the actual device you're intending to restore and mbr with the name of the file. It really should stay mbr, I haven't tested it or tried it with a different file name, nor am I going to.

That's it really, if you had a backup and restored it using dd, you should be able to run:

# fdisk -l /dev/hda

and see all of your original partitions. In my case I did and they were all there. At this point you probably should reboot just to keep the kernel from having a fit, but it is possible to mount the partitions at this point unless there's some serious filesystem errors. Again, just to be safe, reboot your system and see if things work.

IF you didn't back up your partition table, then you'll have to recover it the gpart way. Keep in mind that it will scan the device for the boot sector of a partition. Your data may be easy or hard to recover, depending on how much you created/changed partitions and if you formatted to cause data loss. If you happen to be lucky like myself and only partitioned once when you bought the hard drive and ran it ever since, then it should be easy.

We will start this off by scanning the hard disc and seeing what gpart comes up with. Of course you will need gpart before you start, so if you haven't already, download it now:

# emerge gpart

WARNING: it is possible that the emerge will fail. I ran into this problem where the make failed without any real good reason why. The ebuild could be broken, or incompatible with gcc 3.4. I didn't concern myself with this and just downloaded the source from the gpart homepage and compiled and installed myself. That worked fine in my case. If someone wishes to investigate what's wrong with that ebuild then I'm sure we would all appreciate it

If the emerge fails, download source from http://www.stud.uni-hannover.de/user/76201/gpart/ and compile/install according to the install how to in that package.

Next, scan your drive for possible partitions. Again, depending on the nature of your problem, it may or may not "guess" the partition table correctly. In my case it did and I breathed a huge sigh of relief

By default, the makefile installs the executable to /usr/local/bin which isn't in the PATH for root (yes, you do need root access to do this part, as well as installing it).

# ./gpart /dev/hda

Again, replace /dev/hda with your device you're trying to rescue

If the partition table that is guessed looks right, then you can have gpart write it to the partition table:

# ./gpart /dev/hda -W /dev/hda

MAKE SURE THAT THE GUESSED PARTITION TABLE IS CORRECT AND EDIT IT IF NECESSARY!!!!!!!!!! You have been warned...

So, if all went well then the partition table has been rescued and written to the hard disc. You can verify the entries by running fdisk:

# fdisk -l /dev/hda

Now you should be able to reboot and mount your file systems, unless there's errors on them. At very least it will allow you to use the various file system repair tools available with the OS that you're using.

I hope this helps you out, as it would've helped me 2 days ago when I orignally had a heart attack after discovering my partition table has been completely erased. Of course if anybody has anything to add to this, then please feel free to post it here and I will edit this as necessary.

-happyoutkast

--------------------------------
Athlon XP 2200+
Gentoo Linux 2.6.15-r1 using gentoo sources

marciorps · n00b Joined: 25 Aug 2005 Posts: 22

Losing the partition table is indeed a nasty experience, but anyhow we all come to it someday.

I just wanted to say that altough your described procedure seems to be the most standard, there are other paths and tools available.

Last time I lost my partition table, I tried both the parted rescue command and the gpart from System Rescue CD, but neither was able to find my lost reiserfs partition. When I was almost acepting the burden of re-installing gentoo from scratch, I came across a comment in gpart's own site about 2 other tools that try the same thing. One of them was my saviour, testdisk.

happyoutkast · n00b Joined: 17 May 2005 Posts: 47

yes, that is a very good post and I'm happy to have it added to this thread. My method is just one of many possible ones out there, and the one that worked for me so I can say for certain it worked. My goal was to even start a thread like this so that those with similar problems have a place to go to learn a few things to try. I know I searched around for quite sometime before I came across something that was really so simple yet TOO hard to find. IMHO this really should be stickied so that others can reference and add to this information easily!

It is worth mentioning that I have read something interesting which I would like confirmation on...

From what I heard, if you delete your partition table, and then set up, fdisk new partitions EXACTLY where the old ones were then everything should be restored... assuming you didn't make other partitions and format them, etc...

is this true? If so than I can add a few more things to this thread...

Andersson · Posted: Wed Apr 26, 2006 7:45 pm Post subject:

happyoutkast · n00b Joined: 17 May 2005 Posts: 47

well....that's good to know! thanks!

kartebi · n00b Joined: 09 Apr 2004 Posts: 22

testdisk just saved my day :lol:

Didn't find the uber-experimental-not-as-good-as-3.6 reiser4 , but who gives a shit since it found the 90GB /home extended partition which was 97% full.
Hope my hair start growing again :lol:

_________________
Happy Gentoo Linux User

arigh · Posted: Sat May 20, 2006 12:28 pm Post subject:

Recently I lost my partition table. I've already started a thread on it here

Now, what I'd like to know is, since I know how big my partitions were and everything, can I just use the gentoo minimal-install cd, run fdisk and create the partitions as they were?

Further details:

Please read my post at https://forums.gentoo.org/viewtopic-p-3328775.html
When I started out, I had a blank HD, I installed Windows XP on a partition that was 25000 Mb and left the rest unallocated
Then (when I had tweaked my windows), when I installed my Gentoo, I created three partitions (sda2: +32M boot, sda3: +512M swap and sda4: +25000Mb root)
Since I had an 80 Gb disk, I had unpartitioned space, which I intended to take care of later.
[Later:] Insert Windows XP installation disk, enter problem.

So just to sum this post up:
Can I rely on fdisk from scratch or do I have to insert the Windows XP disk, create one partition of 25000 Mb, then insert gentoo disk, run fdisk and creating the next partitions exactly as before?

Andersson · Posted: Sat May 20, 2006 12:57 pm Post subject:

arigh · Posted: Sat May 20, 2006 2:33 pm Post subject:

Well, actually the XP partition isn't working, that's what's wierd about this.

I think it maybe has something to do with that no-more-than-four partition rule.

Before I tried to create a new partition (FAT32) with the windows xp disk, I had 4 partitions, but after I had tried to create a new partition, I didn't have 5 but I had 2 partitions.
The partition that I just created appeared as big as it was supposed to (the rest of the disk) but the other partitions had magically changed into "Unpartitioned space" !

arigh · Posted: Sat May 20, 2006 5:09 pm Post subject:

Hmm. Now I've been trying to fix this darn thing for a little while, I'll tell you guys (in short) what I've been trying.

First I fired up fdisk and tried building the partitions (both Windows and Linux) manually. Here's the partition table:

/dev/sda1 ntfs(hex=86) +25000M
/dev/sda2 linux (boot, with the flag) +32M
/dev/sda3 swap (hex=82) +512M
/dev/sda4 linux +25000M

after doing this I could mount the Windows partition without any trouble, but not the linux! So I tried changing the boot flag to the Windows partition
No boot! It showed the fancy Windows XP flag twirling in the wind, and it seemed to be going ok, but then there came the bluescreen with accompanying restart.

Then I tried to use the Windows XP installation disk (the very same as caused me all this trouble in the first place) to delete the current partitions, and make one that was 25000M but not installing windows there (because initially I did use that partitioning utility to partition my disk for the Windows XP partition)

After doing this, I fired up the Gentoo Minimal installation disk's fdisk to create the three linux partitions (see table above)

When that was done, I could mount the linux partitions but not the Windows XP partition!

So I tried booting, but no luck. "Error loading operating system".

That's pretty much where I stand now!

I think maybe I'll just cut my losses and copy my stuff from the partitions and set the whole thing up again!

What do you think!?? (I haven't tried any of those utilities yet, don't quite seem to fit my problem, or do they?)

Andersson · Posted: Sun May 21, 2006 2:04 am Post subject:

Perhaps you need to reinstall grub or lilo to the master boot record?
Or was it XP that didn't boot properly?
_________________
Must...resist...posting....
One...step...closer...to...getting...stupid...l33t...ranking...

marciorps · n00b Joined: 25 Aug 2005 Posts: 22

Another advice: do not try to save what is not valuable. If for example, you had a /var partition filled with such things as logs, portage working directories, easyly re-downloadable source tarballs and the like, dump said partition and try to save /home with your PhD thesis! What you really NEED to recover?

About redoing the partitions from fdisk, it is exactly what happens with the sfdisk --dump method, except you record the exact values as to not need to remember and re-type them, two procedures highly prone to error.

About testdisk, well, I am VERY pleased with it, but I found out that after running it parted complained about not being able to align partitions properly and Partition Magic wouldn't even start. I believe it does some tweak that works, but anyway I still wanted to be able to access my disk with other tools, and after sometime I found out that dumpig the partition table with sfdik, zeroing it out with plain fdisk and recreating it with sfdisk duped data worked perfectly. Surely it was frightening to do so, but worked...

linuxbum · Posted: Thu Jul 06, 2006 2:56 am Post subject:

Man did not list LVM in the testdisk FS type supportted
Just FYI

Bryan :roll:

psycepa · Veteran Joined: 27 Dec 2004 Posts: 1637 Location: Poland

I just wanted to say that it should be some reward for helping people in IT given for Christopher Grenier (testdisk author). Testdisk saved my live. Again.
I had trial version of w2k3r2 on my dev/hda1 partition, but the trial period was approaching the end so i have decided to reinstall it. Unfortunately, it is not able to boot and install, so I had to use another windows installation so I could upgrade to w2k3r2. And that was where the horror begun. :wink:

The F**** win98 (unfortunately i was able to borrow from my friend only this version of Win) installer screwed up my partition table, and strarted to format all 120 GB disk as it was just one FAT partition.
Luckily I reset computer while formatting and booted up gentoo. Then tried testdisk.
It didn't find any partitions. So I followed this thread and tried gparted. It found 3 partitions but I wasn't really sure if it is really correct (gparted has a quite 'hard' output).

And then I recalled from my previous MBR problems that it could help if I change header size in testdisk from 16 to 255. That did it!

testdisk found all my partitions as well as broken one that previously was c:
now I still have all my data (I cared about photos and university stuff since mp3 and other could be downloaded again)
and all this thanks to testdisk

wish you luck in your partitions problems, but for 90% of them testdisk is the answer

greetz
_________________
RLUNo. 376073
bo czytac, to trzeba ze zrozumieniem (c) by psycepa
"nigdy nie kloc sie z glupcem, najpierw sprowadzi cie do swojego poziomu a potem pokona doswiadczeniem"
"Life is complex. It has its real and imaginary part."

OddFox · Posted: Fri Oct 13, 2006 1:21 am Post subject:

Thank God for this thread, it should be made stickied or referred to in a FAQ somewhere because the Gentoo Installer almost wiped my entire disk, but gpart was able to recover it successfully. Last time I ever try to use it since it did the same thing to me last time.
_________________
Now the rainy season reminds me of Maria
The way she danced, the color of her hair
Now I'm locked inside a stall at the cantina
Eating the bananas and the cocaine off the mirror
Looking for a ticket to take me away from here