LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Laptop and Netbook
User Name
Password
Linux - Laptop and Netbook Having a problem installing or configuring Linux on your laptop? Need help running Linux on your netbook? This forum is for you. This forum is for any topics relating to Linux and either traditional laptops or netbooks (such as the Asus EEE PC, Everex CloudBook or MSI Wind).

Notices

Reply
 
LinkBack Search this Thread
Old 03-19-2013, 12:08 AM   #1
irish_confetti
LQ Newbie
 
Registered: Jun 2009
Posts: 15

Rep: Reputation: 0
Corrupt Partition / MBR Virus / Windows deleted Linux partition?


I recently ran into something I have never seen before on a friend's machine for whom I am doing a favor. Years ago I installed Ubuntu to dual boot alongside the pre-existing Windows 7 install. The disk looked something like this beforehand (I copied the data into a small spreadsheet) (sector size = 512 bytes):
Code:
Device		Boot	start		end		sectors		id	tpye		
/dev/sda1		63		29366819	29366757	27	unknown	
/dev/sda2	*	29366820	29575664	208845		7	HPFS/NTFS
/dev/sda3		29575665	488395119	458819455	7	HPFS/NTFS
/dev/sda4		0		0		0			empty
and after I got through with it:
Code:
Device		Boot	start		end		sectors		id	tpye
/dev/sda1		63		29366819	29366757	27	unknown
/dev/sda2	*	29366820	29575664	208845		7	HPFS/NTFS
/dev/sda3		29575665	252814904	223239240	7	HPFS/NTFS
/dev/sda4		252814966	488392064	235577099	5	Extended
/dev/sda5		252814968	485243324	232428357	83	Linux
/dev/sda6		485243388	488392064	3148677		82	Linux / swap
I basically wanted a swap partition, and with only one parition available to me I created 2 logical partitions to accomplish this, thus sda5 and sda6. I'm not certian that was wise in retrospect, but it was years ago, Ubuntu booted and worked fine ever since. I don't recall exactly how I had set up grub. I think I had added a menu item to the Windows boot loader to chain-load grub, and grub in turn loaded Ubuntu, and I had grub in a small .img file in the windows partition root directory sitting alongside the file describing the added menu option to load ubuntu...but my memory is fuzzy right now at 1am if that sounds crazy. I do not recall why Windows claimed sda1, 2, and 3 but I do recall all were in use and I could do nothing about it. One of them was a recovery partition, one perhaps had some utilities, and the largest, sda3 had the installation.

A few days ago I'm told that Windows was showing signs of degredation in performance, and suddenly, Ubuntu could not boot. When I try to boot Ubuntu, grub complains: "no such partition" and drops me into the grub shell. I'm almost 100% confident no updated were applied by Ubuntu recently; whatever happened, happened while using Windows, was caused by a Windows update, or some malware in Windows. But which? But I digress...

The partitions table now looks very odd:
Code:
Disk /dev/sda: 30401 cylinders, 255 heads, 63 sectors/track
Units = sectors of 512 bytes, counting from 0
Device		Boot	start		end		sectors		id	tpye			Label
/dev/sda1	*	51		50		0		0	empty	
/dev/sda2		63		29366819	29366757	27	Hidden NTFS WinRE	PQSERVICE
/dev/sda3	*	29366820	29575664	208845		7	HPFS/NTFS/exFA		SYSTEM.RESERVED
/dev/sda4		29575665	252814904	223239240	7	HPFS/NTFS/exFAT		Acer
The logical partitions are gone and all the partitions seem to have been shifted in so far as labels are concerned. I have an old copy of the first 63 sectors that I copied with dd for safekeeping (both before and after I mucked with it years ago). GParted shows the same; but also highlighted for me that while it does not even list sda1, sda2, 3 & 4 occupy about 14Gib, 101.98Mib, and 112.33Gib respectively, leaving 112.33Gib unallocated at the end of the disk. I suspect the Ubuntu and swap partition and all files are still there for salvage if I play my cards right.

Anyone ever seen this? Any suggestions for a course of action before I potentially wreck this partition table? What might cause logical partitions to vanish and the other partitions to shif?

I'm tempted to just overwrite with my backup of the MBR and first 63 sectors. Although I just read up a little on extended partitions and I didn't know they're stored in the first sector before the partition they describe, so I don't have a backup copy of the 2 logical partitions, but presumably they still exist and if they don't am I hosed?

Thank you all in advance.
 
Old 03-19-2013, 07:25 PM   #2
kbp
Senior Member
 
Registered: Aug 2009
Posts: 3,716

Rep: Reputation: 635Reputation: 635Reputation: 635Reputation: 635Reputation: 635Reputation: 635
You should probably take a new copy of the boot sector as backup .. then maybe you could try testdisk and see if it can repair the partition table.
 
Old 03-20-2013, 11:51 PM   #3
EDDY1
Senior Member
 
Registered: Mar 2010
Location: Oakland,Ca
Distribution: DebianSqueeze, winsxp, wins7, Debian wheezy, LFS 7.2
Posts: 4,658

Rep: Reputation: 408Reputation: 408Reputation: 408Reputation: 408Reputation: 408
First of all was wins 7 the original Os or was it an upgrade from winsxp/vista to wins7?
Was this a Wubi install?
I myself would assume that it was originally winsxp, because of the PQ Service partition.
The PQ Service partition & System Reserved partitions are common on Acer Machines. What I find odd about your system is that the MBR is listed as it's own partition. Not only that but starting at 51 & ending at 50.
It seems to me someone started a factory restore.
I say this because Ive done a factory restore on the Acer which is in my signature & I'm presently responding to this post on.
Anyway as long as the that I was restoring to had data on it, it wouldn't complete the transaction.
I would say that you need to fix wins MBR.
 
  


Reply

Tags
corrupt, logical, mbr, partition, windows7


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Accidently deleted the linux partition(root partition) how to recover it? sanues Linux - Newbie 7 11-30-2009 01:55 PM
Deleted Linux Partition in Windows.....(read on please) bigdaddyev General 4 03-09-2008 04:11 PM
Deleted linux partition, how to boot Windows partition? mysak Linux - General 3 12-14-2005 04:22 PM
Deleted ntfs partition - added linux partition in its place - corrupt! eklhad Linux From Scratch 2 06-28-2005 01:31 AM
After reformatting Windows partition, Linux is corrupt and won't boot. JakeMH Linux - Software 3 05-31-2005 05:35 PM


All times are GMT -5. The time now is 12:57 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration