[wellylug] Fsck'd Partitions... help?

[David Antliff]

On Fri, 21 Apr 2006, Cliff Pratt wrote:
> Quite possibly. I did pose it as a question! It seems a bit risky not to keep 
> a copy somewhere else on disk though. There must be good reasons why it is 
> not done. The whole of the first sector is not normally part of the 
> filesystem, or it could form part of the partition header. Or am I missing 
> something?

There is no backup of the partition table. Yes, it's risky and so a backup 
isn't a bad thing to do. You don't really need to backup the actual data 
directly off the disk - just print out the output of sfdisk or save it 
somewhere:

# sfdisk /dev/hda -uS -d

You can simply redirect that back into sfdisk at a later date to restore 
everything.

Incidentally, the heirarchy goes something like this:

In the beginning, there is a block device. This is accessed by sectors. 
Sector 0 is called the MBR (master boot record) and contains the main 
partition table at offset 0x1b0. The partition table contains four rows 
that point to the start sector of up to four 'primary' partitions.

You can access this block device directly via, for example, /dev/hda

The four primary partitions are numbered 1-4 and may be accessed via, for 
example: /dev/hda1, hda2, hda3, hda4. These partitions begin precisely at 
the sector indicated. If they contain a filesystem, then this begins at 
the first byte of the first sector of the partition.

Typically, no more than one of these 'primary' partitions is actually 
tagged as an 'extended' partition. This means that the first sector of 
this partition actually contains another partition table with 1 or 2 
entries (same format as the main PT). The first entry will indicate 
precisely the first sector of the 'logical' partition (where any 
filesystem immediately begins) and the second entry will indicate the 
sector that contains the next extended partition table. These are linked 
in a chain (linked list). It's important to realise that the second entry 
does NOT indicate where the next logical partition begins - you have to 
first find the sector it references, read the partition table from there, 
check the first row, and THAT tells you where the logical partition 
begins.

There are no backups of any of these partition tables. If you lose one of 
the extended partition tables in the 'chain' you will have to 'manually' 
search for the start of the logical partition and the next partition 
table, or use previous knowledge to simply write it back.

If you tell fdisk to write back a "partition table" that contains logical 
partitions and you get it wrong, you will overwrite sectors that weren't 
previously used for this purpose. Bad. If you get it right, you will 
simply refresh/repair what was there previously. Writing a partition table 
does not destroy the data in partitions if nothing has changed. Even 
changing the primary partition start-sectors in the main partition table 
doesn't destroy data. You can use this to crudely obscure data if you're 
into that (e.g. make the disk look empty, or contain other stuff).

-- 
David.