f



Can This Hard Disk Be Saved? (formerly "Can't Find Partition Table On Boot")

This is a multi-part message in MIME format.

------=_NextPart_000_0024_01C51F18.F9C28C40
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

All:

I am attempting to repair a damaged partition table on a hard disk which =
was running Fedora Core 3.  I have been advised to try the gpart =
utitlity which I did on another machine using the full scan option.  The =
output log is included below.  I would like to know if this data is =
sufficient to make strides towards the recovery.  I believe the MBR data =
is in partition 1.  This seems to be the only partition that is captured =
in the gpart scan.  Perhaps if I use fdisk to reinstate partition 1, I =
can pull something useful out of that partition that will eventually =
help me get access to the entirety.  Your advice is sought on the =
subject. =20

Thanks,

John


<begin log data>
dev(/dev/hdc) mss(512) chs(58168/16/63) #s(58633344) size(28629mb)

* Warning: strange partition table magic 0x0410.

Primary partition(1)

type: 008(0x08)(AIX filesystem)

size: 24832mb #s(50855944) s(50855944-101711887)

chs: (3/0/8)-(3/0/8)d (50452/5/14)-(100904/10/26)r

hex: 08 00 08 03 08 00 08 03 08 00 08 03 08 00 08 03

Primary partition(2)

type: 008(0x08)(AIX filesystem)

size: 24832mb #s(50855944) s(50855944-101711887)

chs: (3/0/8)-(3/0/8)d (50452/5/14)-(100904/10/26)r

hex: 08 00 08 03 08 00 08 03 08 00 08 03 08 00 08 03

Primary partition(3)

type: 008(0x08)(AIX filesystem)

size: 33280mb #s(68158480) s(68157448-136315927)

chs: (3/0/8)-(3/0/8)d (67616/8/17)-(135234/0/56)r

hex: 08 00 08 03 08 00 08 03 08 00 10 04 10 04 10 04

Primary partition(4)

type: 014(0x0E)(Primary 'big' DOS (> 32MB, LBA))

size: 33280mb #s(68158736) s(84804624-152963359)

chs: (5/4/12)-(4/5/16)d (84131/9/10)-(151749/5/53)r

hex: 10 04 0C 05 0E 05 10 04 10 04 0E 05 10 05 10 04



Begin scan...

Possible partition(Linux swap), size(1019mb), offset(27603mb)

type: 130(0x82)(Linux swap or Solaris/x86)

size: 1019mb #s(2088448) s(56532735-58621182)

chs: (1023/15/63)-(1023/15/63)d (56084/1/1)-(58155/14/61)r

hex: 00 0F FF FF 82 0F FF FF FF 9E 5E 03 00 DE 1F 00



* Warning: short read near sector(58633155), 64512 bytes instead of =
66048. Skipping...

End scan.

Checking partitions...

Partition(Linux swap or Solaris/x86): primary=20

Ok.

Guessed primary partition table:

Primary partition(1)

type: 130(0x82)(Linux swap or Solaris/x86)

size: 1019mb #s(2088448) s(56532735-58621182)

chs: (1023/15/63)-(1023/15/63)d (56084/1/1)-(58155/14/61)r

hex: 00 0F FF FF 82 0F FF FF FF 9E 5E 03 00 DE 1F 00

Primary partition(2)

type: 000(0x00)(unused)

size: 0mb #s(0) s(0-0)

chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

hex: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Primary partition(3)

type: 000(0x00)(unused)

size: 0mb #s(0) s(0-0)

chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

hex: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Primary partition(4)

type: 000(0x00)(unused)

size: 0mb #s(0) s(0-0)

chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

hex: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

<end log data>



------=_NextPart_000_0024_01C51F18.F9C28C40
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2800.1479" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY>
<DIV><FONT face=3DArial size=3D2>All:</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>I am attempting to repair a damaged =
partition table=20
on a hard disk which was running Fedora Core 3.&nbsp; I have been =
advised to try=20
the gpart utitlity which I did on another machine using the full scan=20
option.&nbsp; The output log is included below.&nbsp; I would like to =
know if=20
this data is sufficient to make strides towards the recovery.&nbsp; I =
believe=20
the MBR data is in partition 1.&nbsp; This seems to be the only=20
partition&nbsp;that is captured in the gpart scan.&nbsp; Perhaps if I =
use fdisk=20
to reinstate partition 1, I can pull something useful out of that =
partition that=20
will eventually help me get access to the entirety.&nbsp; Your advice is =
sought=20
on the subject.&nbsp; </FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>Thanks,</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>John</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>&lt;begin log data&gt;</FONT></DIV>
<DIV><FONT face=3DArial size=3D2><FONT size=3D1>
<P><FONT size=3D2>dev(/dev/hdc) mss(512) chs(58168/16/63) #s(58633344)=20
size(28629mb)</FONT></P>
<P><FONT size=3D2>* Warning: strange partition table magic =
0x0410.</FONT></P>
<P><FONT size=3D2>Primary partition(1)</FONT></P>
<P><FONT size=3D2>type: 008(0x08)(AIX filesystem)</FONT></P>
<P><FONT size=3D2>size: 24832mb #s(50855944) =
s(50855944-101711887)</FONT></P>
<P><FONT size=3D2>chs: (3/0/8)-(3/0/8)d =
(50452/5/14)-(100904/10/26)r</FONT></P>
<P><FONT size=3D2>hex: 08 00 08 03 08 00 08 03 08 00 08 03 08 00 08 =
03</FONT></P>
<P><FONT size=3D2>Primary partition(2)</FONT></P>
<P><FONT size=3D2>type: 008(0x08)(AIX filesystem)</FONT></P>
<P><FONT size=3D2>size: 24832mb #s(50855944) =
s(50855944-101711887)</FONT></P>
<P><FONT size=3D2>chs: (3/0/8)-(3/0/8)d =
(50452/5/14)-(100904/10/26)r</FONT></P>
<P><FONT size=3D2>hex: 08 00 08 03 08 00 08 03 08 00 08 03 08 00 08 =
03</FONT></P>
<P><FONT size=3D2>Primary partition(3)</FONT></P>
<P><FONT size=3D2>type: 008(0x08)(AIX filesystem)</FONT></P>
<P><FONT size=3D2>size: 33280mb #s(68158480) =
s(68157448-136315927)</FONT></P>
<P><FONT size=3D2>chs: (3/0/8)-(3/0/8)d =
(67616/8/17)-(135234/0/56)r</FONT></P>
<P><FONT size=3D2>hex: 08 00 08 03 08 00 08 03 08 00 10 04 10 04 10 =
04</FONT></P>
<P><FONT size=3D2>Primary partition(4)</FONT></P>
<P><FONT size=3D2>type: 014(0x0E)(Primary 'big' DOS (&gt; 32MB, =
LBA))</FONT></P>
<P><FONT size=3D2>size: 33280mb #s(68158736) =
s(84804624-152963359)</FONT></P>
<P><FONT size=3D2>chs: (5/4/12)-(4/5/16)d =
(84131/9/10)-(151749/5/53)r</FONT></P>
<P><FONT size=3D2>hex: 10 04 0C 05 0E 05 10 04 10 04 0E 05 10 05 10 =
04</FONT></P>
<P><FONT size=3D2></FONT>&nbsp;</P>
<P><FONT size=3D2>Begin scan...</FONT></P>
<P><FONT size=3D2>Possible partition(Linux swap), size(1019mb),=20
offset(27603mb)</FONT></P>
<P><FONT size=3D2>type: 130(0x82)(Linux swap or Solaris/x86)</FONT></P>
<P><FONT size=3D2>size: 1019mb #s(2088448) =
s(56532735-58621182)</FONT></P>
<P><FONT size=3D2>chs: (1023/15/63)-(1023/15/63)d=20
(56084/1/1)-(58155/14/61)r</FONT></P>
<P><FONT size=3D2>hex: 00 0F FF FF 82 0F FF FF FF 9E 5E 03 00 DE 1F =
00</FONT></P>
<P><FONT size=3D2></FONT>&nbsp;</P>
<P><FONT size=3D2>* Warning: short read near sector(58633155), 64512 =
bytes instead=20
of 66048. Skipping...</FONT></P>
<P><FONT size=3D2>End scan.</FONT></P>
<P><FONT size=3D2>Checking partitions...</FONT></P>
<P><FONT size=3D2>Partition(Linux swap or Solaris/x86): primary =
</FONT></P>
<P><FONT size=3D2>Ok.</FONT></P>
<P><FONT size=3D2>Guessed primary partition table:</FONT></P>
<P><FONT size=3D2>Primary partition(1)</FONT></P>
<P><FONT size=3D2>type: 130(0x82)(Linux swap or Solaris/x86)</FONT></P>
<P><FONT size=3D2>size: 1019mb #s(2088448) =
s(56532735-58621182)</FONT></P>
<P><FONT size=3D2>chs: (1023/15/63)-(1023/15/63)d=20
(56084/1/1)-(58155/14/61)r</FONT></P>
<P><FONT size=3D2>hex: 00 0F FF FF 82 0F FF FF FF 9E 5E 03 00 DE 1F =
00</FONT></P>
<P><FONT size=3D2>Primary partition(2)</FONT></P>
<P><FONT size=3D2>type: 000(0x00)(unused)</FONT></P>
<P><FONT size=3D2>size: 0mb #s(0) s(0-0)</FONT></P>
<P><FONT size=3D2>chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r</FONT></P>
<P><FONT size=3D2>hex: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =
00</FONT></P>
<P><FONT size=3D2>Primary partition(3)</FONT></P>
<P><FONT size=3D2>type: 000(0x00)(unused)</FONT></P>
<P><FONT size=3D2>size: 0mb #s(0) s(0-0)</FONT></P>
<P><FONT size=3D2>chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r</FONT></P>
<P><FONT size=3D2>hex: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =
00</FONT></P>
<P><FONT size=3D2>Primary partition(4)</FONT></P>
<P><FONT size=3D2>type: 000(0x00)(unused)</FONT></P>
<P><FONT size=3D2>size: 0mb #s(0) s(0-0)</FONT></P>
<P><FONT size=3D2>chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r</FONT></P>
<P><FONT size=3D2>hex: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =
00</FONT></P>
<P><FONT size=3D2>&lt;end log data&gt;</FONT></P>
<P><FONT size=3D2></FONT>&nbsp;</P></FONT></FONT></DIV></BODY></HTML>

------=_NextPart_000_0024_01C51F18.F9C28C40--

0
mooseshoes (61)
3/2/2005 7:14:24 PM
comp.os.linux.misc 33599 articles. 1 followers. amosa69 (78) is leader. Post Follow

7 Replies
551 Views

Similar Articles

[PageSpeed] 48

John wrote:

> All:
> 
> I am attempting to repair a damaged partition table on a hard disk which
> was running Fedora Core 3. [...]

I will *consider* reading your newest post _after_ it is word wrapped by you
to 70 characters or less (per Usenet etiquette) - I hate MSOE.
-- 
oNb
Another happy Linux user - # 276084.
Reject religion ! Embrace Jesus Christ.
0
3/3/2005 2:29:20 AM
On Wed, 02 Mar 2005 19:14:24 +0000, John wrote:

> All:
> 
> I am attempting to repair a damaged partition table on a hard disk which was running Fedora Core 3.  I have been advised to try the gpart utitlity which I did on another machine using the full scan option.  The output log is included below.  I would like to know if this data is sufficient to make strides towards the recovery.  I believe the MBR data is in partition 1.  This seems to be the only partition that is captured in the gpart scan.  Perhaps if I use fdisk to reinstate partition 1, I can pull something useful out of that partition that will eventually help me get access to the entirety.  Your advice is sought on the subject.  
> 
> Thanks,
> 
> John
> 
> 
I am sorry that I don't have time to give you a detailed reply. I don't
have time. But I do want to say:

Yes. Most likely the disk can be repaired. If the only thing wrong with it
is a damaged partition table, then it should be pretty easy to do. The
only potentially tricky part is guessing what data should be in the
partition table. By examining whatever is left of the partition table, you
hopefully can get enough hints to reduce the dimensionality of the "guess
space."

I recommend you read up on the format of partition tables, get away from
canned utilities and examine the partition table with low level tools.

The partition table is a very small and simple structure. You can extract
the raw bytes using "dd" and write them to a file. Then examine them using
Emacs in hexl mode, or whatever other tool you want. You can keep the
original file and save your guesses for the repaired partition table to
new files. Then use "dd" to put partition tables back onto the drive. You
can always put the original one back if you want to give up and try
something else.

And, oh yes... You can severely trash your hard disk if you make any
mistakes. You should back the whole thing up, or at least the bad
partition, before you start messing with it. This can be accomplished with
"dd" also, regardless of how corrupt the data are.

-- 
Thomas D. Shepard
I am sorry, but you can't email me.
ImaSpammer@spam.sux is not a real email address. I figure if someone wants to
harvest an email address to use for sending spam, they may as well use this one.
0
ImaSpammer (44)
3/3/2005 6:32:37 AM
It doesn't look to me like the gpart data will be very useful.

One way to approach this would be to make use of what you *do* know
about how the disk was partitioned. In other words, you don't know the
exact size of the partitions, but hopefully you know how many partitions
you had, what type they were (swap, ext2/3, reiserfs etc.). And you also
probably know which partition holds the data you're looking for.

For example, if you know that the first partition was a Linux native
partition (not the swap partition), you could start by using Linux fdisk
to create one big partition covering the entire disk. Obviously, that
would not be the correct size of the former first partition, but that
wouldn't matter for now. Then, **IF** the file system of the former
first partition is still intact, you could mount that partition and
access it. 

If that happens to be the partition where your data is, then you're
finished. If not, but you are able to access it (meaning the file system
is still intact), then the superblock of the first partition could be
looked at to determine the real size of the former first partition.
And that information could then be used to tell you (usually - unless
you had a gap between partition 1 and 2) where the 2nd partition
started...and so on.

This is all assuming that the only damage done was to the partition
table, which is a big assumption which could easily be wrong. But
there's no harm in trying it because Linux fdisk, unlike some other
partitioning programs, will never touch anything but the partition table
itself when creating or deleting partitions. In other words, just
creating and then later deleting partitions with it will not affect your
data - just the partition table contents.

Note: If you wanted to preserve what's left of your old partition table
before starting these tests, you could use the dd command to back up the
MBR sector first - with this command:

dd if=/dev/hdx of=mbr.hex bs=512 count=1

Later, you could restore that sector with:

dd if=mbr.hex of=/dev/hdx bs=512 count=1

Of course, replace /dev/hdx above with whatever the drive in question is
(/dev/hdc?)

Tom



> John wrote:
> 
> All:
> 
> I am attempting to repair a damaged partition table on a hard disk
> which was running Fedora Core 3.  I have been advised to try the gpart
> utitlity which I did on another machine using the full scan option.
> The output log is included below.  I would like to know if this data
> is sufficient to make strides towards the recovery.  I believe the MBR
> data is in partition 1.  This seems to be the only partition that is
> captured in the gpart scan.  Perhaps if I use fdisk to reinstate
> partition 1, I can pull something useful out of that partition that
> will eventually help me get access to the entirety.  Your advice is
> sought on the subject.
> 
> Thanks,
> 
> John
> 
> 
> <begin log data>
> 
> dev(/dev/hdc) mss(512) chs(58168/16/63) #s(58633344) size(28629mb)
> 
> * Warning: strange partition table magic 0x0410.
> 
> Primary partition(1)
> 
> type: 008(0x08)(AIX filesystem)
> 
> size: 24832mb #s(50855944) s(50855944-101711887)
> 
> chs: (3/0/8)-(3/0/8)d (50452/5/14)-(100904/10/26)r
> 
> hex: 08 00 08 03 08 00 08 03 08 00 08 03 08 00 08 03
> 
> Primary partition(2)
> 
> type: 008(0x08)(AIX filesystem)
> 
> size: 24832mb #s(50855944) s(50855944-101711887)
> 
> chs: (3/0/8)-(3/0/8)d (50452/5/14)-(100904/10/26)r
> 
> hex: 08 00 08 03 08 00 08 03 08 00 08 03 08 00 08 03
> 
> Primary partition(3)
> 
> type: 008(0x08)(AIX filesystem)
> 
> size: 33280mb #s(68158480) s(68157448-136315927)
> 
> chs: (3/0/8)-(3/0/8)d (67616/8/17)-(135234/0/56)r
> 
> hex: 08 00 08 03 08 00 08 03 08 00 10 04 10 04 10 04
> 
> Primary partition(4)
> 
> type: 014(0x0E)(Primary 'big' DOS (> 32MB, LBA))
> 
> size: 33280mb #s(68158736) s(84804624-152963359)
> 
> chs: (5/4/12)-(4/5/16)d (84131/9/10)-(151749/5/53)r
> 
> hex: 10 04 0C 05 0E 05 10 04 10 04 0E 05 10 05 10 04
> 
> 
> 
> Begin scan...
> 
> Possible partition(Linux swap), size(1019mb), offset(27603mb)
> 
> type: 130(0x82)(Linux swap or Solaris/x86)
> 
> size: 1019mb #s(2088448) s(56532735-58621182)
> 
> chs: (1023/15/63)-(1023/15/63)d (56084/1/1)-(58155/14/61)r
> 
> hex: 00 0F FF FF 82 0F FF FF FF 9E 5E 03 00 DE 1F 00
> 
> 
> 
> * Warning: short read near sector(58633155), 64512 bytes instead of
> 66048. Skipping...
> 
> End scan.
> 
> Checking partitions...
> 
> Partition(Linux swap or Solaris/x86): primary
> 
> Ok.
> 
> Guessed primary partition table:
> 
> Primary partition(1)
> 
> type: 130(0x82)(Linux swap or Solaris/x86)
> 
> size: 1019mb #s(2088448) s(56532735-58621182)
> 
> chs: (1023/15/63)-(1023/15/63)d (56084/1/1)-(58155/14/61)r
> 
> hex: 00 0F FF FF 82 0F FF FF FF 9E 5E 03 00 DE 1F 00
> 
> Primary partition(2)
> 
> type: 000(0x00)(unused)
> 
> size: 0mb #s(0) s(0-0)
> 
> chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r
> 
> hex: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 
> Primary partition(3)
> 
> type: 000(0x00)(unused)
> 
> size: 0mb #s(0) s(0-0)
> 
> chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r
> 
> hex: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 
> Primary partition(4)
> 
> type: 000(0x00)(unused)
> 
> size: 0mb #s(0) s(0-0)
> 
> chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r
> 
> hex: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 
> <end log data>
> 
>
0
tplists (3)
3/3/2005 12:09:54 PM
Thank you Thomas.  You have given me many ideas which I will try.

Best,

John


0
mooseshoes (61)
3/3/2005 4:00:44 PM
Thank you Tom.

One thing I'd like to do immediately is back up the data I have on the disk.

Based on what I've read, it appears the way to do this is to make one large
partition and mount the disk accordingly.  I don't know of how to read data
from
the disk otherwise.  The worst case then, would be to start from scratch in
the
event the disk can't be recovered.

Does that make sense?

Best,

John


0
mooseshoes (61)
3/3/2005 4:04:49 PM
John wrote:
> 
> Thank you Tom.
> 
> One thing I'd like to do immediately is back up the data I have on the disk.
> 
> Based on what I've read, it appears the way to do this is to make one large
> partition and mount the disk accordingly.  I don't know of how to read data
> from
> the disk otherwise.  The worst case then, would be to start from scratch in
> the
> event the disk can't be recovered.
> 
> Does that make sense?
> 
> Best,
> 
> John

Without mounting anything, you could copy the entire drive to another
drive of equal or greater size by using the dd command like this:

dd  if=/dev/hdc  of=/dev/hdd    (where /dev/hdd is the new drive)

With a 30 GB drive, that will take a while because it will copy every
byte from the old drive.

Getting back to the problem drive...if you were to create a partition
covering the entire drive and were able to mount it, that means that the
file system for the former first partition is still at least somewhat
intact. But, at best, that will only give you access to the files that
were on the first partition. But if that's all you need, then you're
fine. If not, you'd have to go further.

Actually, if you go on the huge assumption that only the partition table
has been damaged, there are 2 programs that come to mind that could
possibly resurrect your partition table.

The first is testdisk (
http://www.cgsecurity.org/index.html?testdisk.html ), which is available
for both Linux and DOS. I'm just slightly familiar with it, and have
never tried it for partition table recovery. But it has a good
reputation.

Another is BootItNG ( http://www.bootitng.com ). When you download it,
you need to make either a bootable floppy disk or CD - your choice. When
you boot from it, it will want to install itself to the hard drive, but
if you just take the option to Cancel out of that, it will take you to
its maintenance mode where you can choose the Partition Work screen. 

>From there, identify and choose the correct drive (on the left), which
should appear as all free space. Then, highlight that free space and
choose the Undelete button. It normally will be able to rebuild the
partition table that way, again assuming the file systems are all still
intact. 

BUT, also read the Help section on working with partitions, because the
program may find older partitions that still have remnants (like boot
sectors) on the disk. The help will tell you what to do if it finds
those instead of the partitions you're looking for.

Tom
0
tplists (3)
3/4/2005 12:06:35 PM
I suggest you use partition table doctor.It provides very useful
functions: Backup partition table, Restore partition table, Rebuild
partition table, undelete partition,Fixboot.
see more:http://www.ptdd.com

0
wemaole (1)
3/15/2005 5:45:17 AM
Reply: