Uh-Oh... Manually Edit a Partition Table?
 

I have had the worst two days of my life today and yesterday.

I have a 120GB drive, of which 90~ GB is Fat32 and stores all of my really, really important data. Pictures of my kids, my entire music collection, all my business related stuff.

The rest is a copy of a /home from a distro of linux I ruined yesterday.

Well, today, I almost ruined the 90 gig partition. I was using parted to copy the aformentioned /home from an almost wrecked disk, and accidentally started to overwrite the FAT partition. NOw, this only happened for about 10 seconds, tops, before I had Cntrl+Alt+Deleted and killed the system. It wasn't my first choice, but Cntrl+C and X didn't do anything.

So I have a perfectly legitmate (incomplete) copy of my ext2 partition partially written over my FAT.

To my understanding, I have two things working in my favor here: For one, I am fairly sure that only about 10 GB of the partition was actually in use. I am hoping the really important stuff was in the middle or near the end. The second thing I have in my favor is that fdisk under linux recognized the partition as Fat32 Extended LBA. NOTHING else recognizes the drive as FAT, however. A concievable third thing that I have in my favor is that I have a decent partial backup, but lacking such notables as the irreplacable pictures of my daughter.

So here's what I've tried so far: I have tried using ptedit under DOS to set the filesystem type manually on the partition table. I have set is HEX 0B (Fat32X), HEX 0C (Fat32), and HEX (3hC) , which is a partition magic recovery marker. With the first two attempts, Partition magic sees only bare, unformatted disk space. With PQFlex (that's the third), I can see the size of the partition but still can't do much with it.

Now, due to the absolutely precious nature of this data, I am willing to take this drive to a professional to have it restored, but before I do that, I was hoping to get some input from the members of this forum, who are usually a wellspring of knowledge.

What if I use something like debugfs to dump the raw table to a disk someplace? I would have to do it in increments, because I don't have another disk this large. However, even doing this, how would I be able to actually recreate files?

What if I somehow adjust where the partition begins, and try to move past the area that was written? I am confident that only a small fraction of the drive was actually written before I killed the system.

Damn, sometimes life really throws these bad days at you. And all this on the heels of my decision to create a backup RAID....

first thing to do....make a backup of the entire disk.

since the very beginning of the partition is now a linux fs you will need to grab another hard drive with a fat partition and use the dd tool to make an exact copy of the other fat partition overwriting the linux/fat filesystem for about 5 seconds then kill it. the result should be a perfectly usable fat partition with minimal damage.

That's a terrific idea. Has anyone else ever tried this?

Specifically, I am worried that the first few megabytes of a FAT might contain information about how large the entire FAT is. In this case, I might be no better off with a FAT than an ext2.

However, if there is no indication of total size in the FAT's header, then I suppose it will work.

When I am all finished with the copying procedure, should I run a windows ScanDisk or Norton DD to fix the file table, or will that totally ruin the data?

i have done this technique 2 or 3 times...all of them weresuccessful. i believe it was ext3 or reiserfs though....shouldn't be a problem with fat, but i cant guarantee that as i've never tried it with fat. thats why the first step is critical :) if it does work, then once you have all of your data you need, i would format the partition and start fresh, after backing up what you recovered of course :)

So I guess I am not the only one that seems prone to hitting ENTER before really reading what they have just typed. I think it has something to do with being stressed out, working for 14 hours straight, etc. Sooner or later you are going to bang out a command a little too fast and sloppy and BAM!

actually, this might work better.

dd if=/dev/hdc1 of=/dev/hdb1 bs=1024

where hdc1 is the good fat partition and /dev/hdb1 is the bad fat partition. what this does is copies only the fat mbr making it fat without overwriting any data.

yep i hear ya...you're not alone...

but _we_ might be alone....i dont like reading when i'm stressed :)

Thanks a lot for that head's up. Seriously, if there is one big difference between windows and linux - it's the support you can get for free.

I'll let you know how that MBR update works out.

no problem...and yes, linux support beats any paid-for windows support :) ya plz let me know how it turned out. good luck

I think this would actually just read hdc into hdb1 1024 bytes at a time, wouldn't it?

nope, it reads up to 1024...actually, you want 512, sorry. the right way would be:

dd if=/dev/input of=/dev/output bs=512 count=1

/dev/input = good part
/dev/output = bad part

the count=1 is what you were thinking of i think.