[wellylug] Fsck'd Partitions... help?

[David Antliff]

On Thu, 20 Apr 2006, Jo Booth wrote:
> Not too sure what's lost... i just can't find two of my partitions that used 
> to be there.

Do you recall what you did to 'lose' them? Was it software or did you 
suffer some sort of hardware failure? As I explain below, if the partition 
table chain is broken, it's easy to fix.

BTW, You can't even start looking at fixing the filesystems until you have 
recovered the partition table, or at least worked out where they are on 
the disk.

> hdb1 is a small "boot" partition of 518 mb
> hdb2 is an extended partition with (28,106 Mb)
>  	hdb5 (the old linux partition) unknown type (9,193 MB)
> 	hdb6 is an 86 Mb swap partition
> Then we have 18,826 mb of "unallocated space"  where I used to have two 
> drives, both with "important" stuff on them

Ok, it looks like the extended partition table chain has probably been 
broken, either in partition 6's extended PT (such that it points to a 
wrong 'next table') or the next table is in fact wrong itself. Read on...

> I haven't "formatted" any of the partitions, and I don't think i've resized 
> anything (windows diskpart doesn't do much)

Ok, don't run anything on the disk that might change data yet...

> I'd be keen on fixing it - even if I have to scroll through MBs of data to 
> find the ends of the disks ;)  I know all three partitions are about 10 gig 
> anyways.
> So -- how does one rewrite partition tables by hand using an Ubunutu 5.1 live 
> cd.. :)

I would definitely recommend 'mirroring' the entire disk onto another disk 
drive. If the data really is valuable, you should do this first BEFORE you 
try anything else. That way, you can always start again if you screw it 
up.

The base (I'll call it 'main') partition table is quite straightforward, 
it's a table of four 16-byte 'row' entries followed by a 2-byte closing 
signature (0x55AA I think, might be the reverse). The fields in each 'row' 
are documented fairly well. The second entry will have a 'type' that 
indicates it's an extended partition. This points to a sector that 
contains another partition table with only two rows in the same format as 
the base PT. The first row will indicate the start sector of the 
actual logical partition and the second row is the sector where the 
NEXT extended PT can be found. There's a chance this chain has been broken 
and you'd only need to repair it to get your data back. Maybe...


mainPT
  |_hdb1
  |_hdb2
    |_extPT
       |_hdb5
       |_extPT
          |_hdb6
          |_extPT   * could be broken after here somewhere
            |_hdb7
            |_extPT
               |_hdb8
               |_STOP

But first, make a complete copy of that disk using 'dd':

dd if=/dev/hdb of=/dev/hdd bs=512 conv=noerror,sync


You could try 'gpart' but make a copy of the disk first, just in case.


-- 
David.