LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
Search this Thread
Old 02-25-2004, 11:30 PM   #1
davidbalt
Member
 
Registered: Feb 2004
Distribution: Gentoo -- always from stage1
Posts: 85

Rep: Reputation: 15
Exclamation Uh-Oh... Manually Edit a Partition Table?


I have had the worst two days of my life today and yesterday.

I have a 120GB drive, of which 90~ GB is Fat32 and stores all of my really, really important data. Pictures of my kids, my entire music collection, all my business related stuff.

The rest is a copy of a /home from a distro of linux I ruined yesterday.

Well, today, I almost ruined the 90 gig partition. I was using parted to copy the aformentioned /home from an almost wrecked disk, and accidentally started to overwrite the FAT partition. NOw, this only happened for about 10 seconds, tops, before I had Cntrl+Alt+Deleted and killed the system. It wasn't my first choice, but Cntrl+C and X didn't do anything.

So I have a perfectly legitmate (incomplete) copy of my ext2 partition partially written over my FAT.

To my understanding, I have two things working in my favor here: For one, I am fairly sure that only about 10 GB of the partition was actually in use. I am hoping the really important stuff was in the middle or near the end. The second thing I have in my favor is that fdisk under linux recognized the partition as Fat32 Extended LBA. NOTHING else recognizes the drive as FAT, however. A concievable third thing that I have in my favor is that I have a decent partial backup, but lacking such notables as the irreplacable pictures of my daughter.

So here's what I've tried so far: I have tried using ptedit under DOS to set the filesystem type manually on the partition table. I have set is HEX 0B (Fat32X), HEX 0C (Fat32), and HEX (3hC) , which is a partition magic recovery marker. With the first two attempts, Partition magic sees only bare, unformatted disk space. With PQFlex (that's the third), I can see the size of the partition but still can't do much with it.

Now, due to the absolutely precious nature of this data, I am willing to take this drive to a professional to have it restored, but before I do that, I was hoping to get some input from the members of this forum, who are usually a wellspring of knowledge.

What if I use something like debugfs to dump the raw table to a disk someplace? I would have to do it in increments, because I don't have another disk this large. However, even doing this, how would I be able to actually recreate files?

What if I somehow adjust where the partition begins, and try to move past the area that was written? I am confident that only a small fraction of the drive was actually written before I killed the system.

Damn, sometimes life really throws these bad days at you. And all this on the heels of my decision to create a backup RAID....
 
Old 02-26-2004, 02:21 AM   #2
Axion
Member
 
Registered: Jan 2003
Location: Albany, NY
Distribution: Slackware 9.1, Gentoo 2004.1
Posts: 153

Rep: Reputation: 30
first thing to do....make a backup of the entire disk.

since the very beginning of the partition is now a linux fs you will need to grab another hard drive with a fat partition and use the dd tool to make an exact copy of the other fat partition overwriting the linux/fat filesystem for about 5 seconds then kill it. the result should be a perfectly usable fat partition with minimal damage.
 
Old 02-26-2004, 08:50 AM   #3
davidbalt
Member
 
Registered: Feb 2004
Distribution: Gentoo -- always from stage1
Posts: 85

Original Poster
Rep: Reputation: 15
That's a terrific idea. Has anyone else ever tried this?
 
Old 02-26-2004, 09:08 AM   #4
davidbalt
Member
 
Registered: Feb 2004
Distribution: Gentoo -- always from stage1
Posts: 85

Original Poster
Rep: Reputation: 15
Specifically, I am worried that the first few megabytes of a FAT might contain information about how large the entire FAT is. In this case, I might be no better off with a FAT than an ext2.

However, if there is no indication of total size in the FAT's header, then I suppose it will work.

When I am all finished with the copying procedure, should I run a windows ScanDisk or Norton DD to fix the file table, or will that totally ruin the data?
 
Old 02-26-2004, 09:15 AM   #5
Axion
Member
 
Registered: Jan 2003
Location: Albany, NY
Distribution: Slackware 9.1, Gentoo 2004.1
Posts: 153

Rep: Reputation: 30
i have done this technique 2 or 3 times...all of them weresuccessful. i believe it was ext3 or reiserfs though....shouldn't be a problem with fat, but i cant guarantee that as i've never tried it with fat. thats why the first step is critical if it does work, then once you have all of your data you need, i would format the partition and start fresh, after backing up what you recovered of course
 
Old 02-26-2004, 09:17 AM   #6
davidbalt
Member
 
Registered: Feb 2004
Distribution: Gentoo -- always from stage1
Posts: 85

Original Poster
Rep: Reputation: 15
So I guess I am not the only one that seems prone to hitting ENTER before really reading what they have just typed. I think it has something to do with being stressed out, working for 14 hours straight, etc. Sooner or later you are going to bang out a command a little too fast and sloppy and BAM!
 
Old 02-26-2004, 09:22 AM   #7
Axion
Member
 
Registered: Jan 2003
Location: Albany, NY
Distribution: Slackware 9.1, Gentoo 2004.1
Posts: 153

Rep: Reputation: 30
actually, this might work better.

dd if=/dev/hdc1 of=/dev/hdb1 bs=1024

where hdc1 is the good fat partition and /dev/hdb1 is the bad fat partition. what this does is copies only the fat mbr making it fat without overwriting any data.
 
Old 02-26-2004, 09:25 AM   #8
Axion
Member
 
Registered: Jan 2003
Location: Albany, NY
Distribution: Slackware 9.1, Gentoo 2004.1
Posts: 153

Rep: Reputation: 30
yep i hear ya...you're not alone...

but _we_ might be alone....i dont like reading when i'm stressed
 
Old 02-26-2004, 09:28 AM   #9
davidbalt
Member
 
Registered: Feb 2004
Distribution: Gentoo -- always from stage1
Posts: 85

Original Poster
Rep: Reputation: 15
Thanks a lot for that head's up. Seriously, if there is one big difference between windows and linux - it's the support you can get for free.

I'll let you know how that MBR update works out.
 
Old 02-26-2004, 09:30 AM   #10
Axion
Member
 
Registered: Jan 2003
Location: Albany, NY
Distribution: Slackware 9.1, Gentoo 2004.1
Posts: 153

Rep: Reputation: 30
no problem...and yes, linux support beats any paid-for windows support ya plz let me know how it turned out. good luck
 
Old 02-26-2004, 02:01 PM   #11
davidbalt
Member
 
Registered: Feb 2004
Distribution: Gentoo -- always from stage1
Posts: 85

Original Poster
Rep: Reputation: 15
Quote:
Originally posted by Axion
actually, this might work better.

dd if=/dev/hdc1 of=/dev/hdb1 bs=1024

where hdc1 is the good fat partition and /dev/hdb1 is the bad fat partition. what this does is copies only the fat mbr making it fat without overwriting any data.
I think this would actually just read hdc into hdb1 1024 bytes at a time, wouldn't it?
 
Old 03-02-2004, 01:16 AM   #12
Axion
Member
 
Registered: Jan 2003
Location: Albany, NY
Distribution: Slackware 9.1, Gentoo 2004.1
Posts: 153

Rep: Reputation: 30
nope, it reads up to 1024...actually, you want 512, sorry. the right way would be:

dd if=/dev/input of=/dev/output bs=512 count=1

/dev/input = good part
/dev/output = bad part

the count=1 is what you were thinking of i think.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
"No partition table or unknown signature on partition table" 10.1 install madcow007 Slackware 4 02-09-2009 11:04 AM
Edit table in myphpadmin jbg_sm Programming 1 04-11-2005 12:42 PM
Slack 10: S-ATA = "No partition table or unknown signature on partition table"? dissolved soul Slackware - Installation 11 08-05-2004 02:12 PM
How do i manually edit xf86config file in Debian Delarama Linux - Newbie 9 06-28-2004 02:29 AM
How do I manually edit the K-Menu? Quattro Linux - Software 3 03-30-2004 01:46 AM


All times are GMT -5. The time now is 10:46 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration