So, I'm writing this to provide some tips and hints on how to:
1. pre-emptively back up your partition table in case it gets lost to make life easier
2. if you were an idiot, like me, and didn't back up your partition table, then how you can have the best chance of restoring it.
NOTE: this may be more difficult depending on the nature of your loss. For example, resizing partitions or formatting a partition and losing data will make life much more difficult. If you formatted, there's a good to excellent chance you are going to have to bid a fond farewell to your data.
First thing's first, if you find your partition table has been ruined, DON'T DO ANYTHING DRASTIC!!! Just because your partition table has been fscked up, doesn't mean your data and parition's boot sectors aren't there. All it means is that os's and low level utilities that read the hard drive partition table don't know where your partitions begin and end, so you can't mount, etc....In my case grub still worked fine and allowed me to boot into my second hard drive's gentoo install even though the partition that has grub.conf got lost. Even windows xp would try and boot for maybe 2 seconds before blue screening and rebooting.
So, now that I have a working partition table back, let's back it up in case this happens again. This can be done easily with the dd command. Make sure you replace /dev/hda with the actual info for your drive (/dev/sda or /dev/hdb, etc...).
# dd if=/dev/hda of=mbr bs=512 count=1
this will save your hard drive's master boot record including partition table information to a nice little file called mbr. Write this to floppy, burn it to cd/dvd, or just plain back it up somewhere save OTHER THAN the hard disk it's supposed to be a backup of. It would be rather pointless to store the mbr back up of a hard drive on that hard drive wouldn't it?
If you need to restore your mbr from that backup, simply cd to the directory where the mbr file is stored and execute the command below. For example, let's say you burned it to a CD-R disc:
# mount /dev/hdc /mnt/cdrom (replace the /dev/hdc with the actual locatation of your cd rom, and /mnt/cdrom with the mount point you wish to use)
# cd /mnt/cdrom
now, let's assume that the dd executable is in your PATH, it most likely will be. To restore your partition table without overwriting the mbr, execute the command below. I'm not certain but I think that by omitting the skip and seek options you can have it overwrite the mbr too. However that is most likely not necessary unless you really tore things up.
# dd if=mbr of=/dev/hda bs=1 count=64 skip=446 seek=446
Again replace /dev/hda with the actual device you're intending to restore and mbr with the name of the file. It really should stay mbr, I haven't tested it or tried it with a different file name, nor am I going to.
That's it really, if you had a backup and restored it using dd, you should be able to run:
# fdisk -l /dev/hda
and see all of your original partitions. In my case I did and they were all there. At this point you probably should reboot just to keep the kernel from having a fit, but it is possible to mount the partitions at this point unless there's some serious filesystem errors. Again, just to be safe, reboot your system and see if things work.
IF you didn't back up your partition table, then you'll have to recover it the gpart way. Keep in mind that it will scan the device for the boot sector of a partition. Your data may be easy or hard to recover, depending on how much you created/changed partitions and if you formatted to cause data loss. If you happen to be lucky like myself and only partitioned once when you bought the hard drive and ran it ever since, then it should be easy.
We will start this off by scanning the hard disc and seeing what gpart comes up with. Of course you will need gpart before you start, so if you haven't already, download it now:
# emerge gpart
WARNING: it is possible that the emerge will fail. I ran into this problem where the make failed without any real good reason why. The ebuild could be broken, or incompatible with gcc 3.4. I didn't concern myself with this and just downloaded the source from the gpart homepage and compiled and installed myself. That worked fine in my case. If someone wishes to investigate what's wrong with that ebuild then I'm sure we would all appreciate it
If the emerge fails, download source from http://www.stud.uni-hannover.de/user/76201/gpart/ and compile/install according to the install how to in that package.
Next, scan your drive for possible partitions. Again, depending on the nature of your problem, it may or may not "guess" the partition table correctly. In my case it did and I breathed a huge sigh of relief
By default, the makefile installs the executable to /usr/local/bin which isn't in the PATH for root (yes, you do need root access to do this part, as well as installing it).
# ./gpart /dev/hda
Again, replace /dev/hda with your device you're trying to rescue
If the partition table that is guessed looks right, then you can have gpart write it to the partition table:
# ./gpart /dev/hda -W /dev/hda
MAKE SURE THAT THE GUESSED PARTITION TABLE IS CORRECT AND EDIT IT IF NECESSARY!!!!!!!!!! You have been warned...
So, if all went well then the partition table has been rescued and written to the hard disc. You can verify the entries by running fdisk:
# fdisk -l /dev/hda
Now you should be able to reboot and mount your file systems, unless there's errors on them. At very least it will allow you to use the various file system repair tools available with the OS that you're using.
I hope this helps you out, as it would've helped me 2 days ago when I orignally had a heart attack after discovering my partition table has been completely erased. Of course if anybody has anything to add to this, then please feel free to post it here and I will edit this as necessary.
-happyoutkast
--------------------------------
Athlon XP 2200+
Gentoo Linux 2.6.15-r1 using gentoo sources
