Disk recovery?

I had 30 GB of empty space on my 200 GB hard drive, so I decided to check Gentoo 2006.0 out (I hadn't used Gentoo since 2005.0). I used the fancy new graphical installer to add two new partitions to the 30 GB of unpartitioned space at the front of the hard drive. I went through the rest of it, and when the installer began to work, it threw some error during partitioning/formatting, about 30 seconds into the install. Something about "the end can't come before the beginning" (no kidding, thats what the error said). I figured I'd reboot and try again later -- and now, none of my old OS' will boot. I boot a LiveCD, take a look at fdisk, and here's what it gives:

Command (m for help): p

Disk /dev/hda: 203.9 GB, 203928109056 bytes
255 heads, 63 sectors/track, 24792 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/hda1               1        3851    30933126   83  Linux
/dev/hda2            3852        3916      522112+  82  Linux swap / Solaris

It deleted all my old partitions and replaced it with just the two Gentoo partitions, even though I am POSITIVE(!!!) that I only gave the installer permission to use the 30 GB at the front, not the whole drive. Apparently, the old partitions are all gone now; all thanks to that damn bug in the installer.

I had a lot of important things on the hard drive; I wasn't expecting an installer to somehow fsck up an entire hard drive. What are my chances of recuparting stuff? Anyone have any ideas? I figure I have a really good chance of getting most of my stuff back since the whole formatting stage of the installation before it crashed only lasted about 20 seconds; I'm pretty sure its not possibly for any program to fully write over 200 GB of data in that amount of time. So hopefully there's a solution here...

thanks in advance...

I had a lot of important things on the hard drive;

Can't have been too important if you couldn't be bothered backing it up.

Looks like those two partitions are only using the space you specified - the old part entries are gone, but should be recoverable.
Try testdisk - it's on Knoppix, which is probably amongst the safest ways to do recovery.

Open a bug on gentoo if you think it's broke - I haven't tried the GUI installer. Not likely to - goes against the grain.

Originally Posted by syg00 Can't have been too important if you couldn't be bothered backing it up.

It was pretty important; I just didn't anticipate that a simple installer could mess up an entire hard drive. Also, it's difficult to back up a hard drive when its total size is greater than the sum of all your other hard drives.

Originally Posted by syg00 Looks like those two partitions are only using the space you specified - the old part entries are gone, but should be recoverable. Try testdisk - it's on Knoppix, which is probably amongst the safest ways to do recovery.

I'm doing that I'm on Knoppix-STD as I type this. However, I'm finding 'testdisk' to be rather cryptic; I'm going to keep trying it, however, since it seems to be my best chance so far.

Thanks

First, let's not argue about the merits of backup.....

I would say the data is definitely recoverable---don't do ANYTHING that would write to the disk. If possible, you might want to buy or borrow another drive and clone the disk before doing anything else.

There are lots of utilities out there for data recovery, but there is a learning curve--you might want to simply take the disk to a service that specializes.

Curious to know how the installer might have done this. Presumably the old partitions were numbered starting at 1---thus they would have to be renumbered.

If you want to spend the time, look for partition tables as follows:
dd if=/dev/hda bs=512 count=20 | hexdump -C > filename
This writes the first 20 sectors of hda to "filename" Reading this file, every sector which contains a partition table will have the signature 55aa (hex) at the end. The 64bytes immediately preceding is the partition table. For the format, go here: http://www.ata-atapi.com/hiwtab.htm The first 64-byte table will hold four partition descriptors. If there are to be more than four partitions, one of these must be an extended partition. If you find the 55aa signature more than once, you know there are extended/logical partitions.

It is quite possible that you can recover by simply editing partition tables so they are in a legal format. (Use dd to do this)

WARNING: Proceed at your own risk!! dd is very effective at doing just about anything to a hard disk, including wiping it out.

Originally Posted by pixellany Curious to know how the installer might have done this. Presumably the old partitions were numbered starting at 1---thus they would have to be renumbered.

Thank you for your willingness to help, pixellany
Actually, the old partitions were at the end of the hard drive. The first 30 GB was unallocated space. Now that I look at the fdisk data more carefully, it turns out that, although the installer erased the old partitions, the new partitions only occupy the first 30 GB, implying that the old partitions are still there, data-wise, and were not formatted after all. I know I can just re-edit the partition table, but the problem is I don't remember exactly which blocks the old partitions occupied. Is there a way to find this out?

Originally Posted by pixellany If you want to spend the time, look for partition tables as follows: dd if=/dev/hda bs=512 count=20 | hexdump -C > filename This writes the first 20 sectors of hda to "filename" Reading this file, every sector which contains a partition table will have the signature 55aa (hex) at the end. The 64bytes immediately preceding is the partition table. For the format, go here: http://www.ata-atapi.com/hiwtab.htm The first 64-byte table will hold four partition descriptors. If there are to be more than four partitions, one of these must be an extended partition. If you find the 55aa signature more than once, you know there are extended/logical partitions. It is quite possible that you can recover by simply editing partition tables so they are in a legal format. (Use dd to do this) WARNING: Proceed at your own risk!! dd is very effective at doing just about anything to a hard disk, including wiping it out.

Okay, I wrote the first twenty sectors to a file, and I'm browsing it with vim. I cannot seem to find the pattern you described; I definitely did not have an extended/logical partition, just two primary partitions (before the installer, that is). BEFORE the format, my hard drive looked like this:
30 GB unallocated space
50 GB NTFS Partition
110 GB FAT32 Partition
If it is any help, here is the contents of that hexdump: http://thegoban.com/dumpfile.txt
I was encouraged when I realized that the old partitions were not actually formatted over, just removed from the partition table.

I tried simply creating a new, 50 GB partition right at the end of the new Linux one with fdisk, but this did not help with anything. I still cannot mount /dev/hda3 (bad fs type).

Any more ideas?

Originally Posted by Hikaru79 Any more ideas?

You could try "gpart" (short for "guess partitions"). I think it comes on Knoppix, but I'm not sure. Here's it's webpage:
http://www.stud.uni-hannover.de/user/76201/gpart/

Before touching your current partition table, BACK IT UP! It's only a few bytes. Boot a LiveCD and then:

# dd if=/dev/hda of=/tmp/MBR.bin bs=512 count=1

Make sure you get your if= and of= correct. Do NOT reverse them!
Then copy this 512 byte file somewhere safe. Save to a flashdrive. Copy to a floppy. Email it to yourself. Copy across the LAN to another computer if you have one. That way at least you can go back to where you are now should you mess it up further by accident.

Originally Posted by pixellany This writes the first 20 sectors of hda to "filename" Reading this file, every sector which contains a partition table will have the signature 55aa (hex) at the end.

You will only find one partition table in track zero (these first 20 sectors are part of track zero). Extented partition tables are found much further along in the disk.

Originally Posted by Hikaru79 [snip] I tried simply creating a new, 50 GB partition right at the end of the new Linux one with fdisk, but this did not help with anything. I still cannot mount /dev/hda3 (bad fs type). [/snip]

Did you just say you wrote to you HD's partition table before you had it backed-up?

caution, this is quite likely to be considered a very ugly hack. its quick and dirty, but it has saved my ass before today. those with weak stomachs should look away now.

what is it you want to save? im assuming you dont want to recover the whole 200gb? if its something small-ish (and preferably text based), there is a method that, whilst not 'the correct way', may help.

cat /dev/hda | grep -A XX -B YY matchtext

XX = the number of lines appearing before matchtext to print.

YY = the number of lines appearing after matchtext to print

matchtext == the text pattern to search for.

as i said, its very ugly, and will probably take some time to spool through 200gb, but if all you need to save is your resume, then 'cat /dev/hda | grep -A 200 -B 200 yourname' should at least show you the data as it is on disk, after which, a quick copy/paste into your favourite editor and all is well(ish). if you have more than a few essentials to recover, or need to recover binary data, then this is really not a great deal of use.

(for the ones that doubt if this will work (many do when i tell them about it), it does. as does 'cat /dev/hdX > file.iso' for making a quick iso of something. oh, and 'cat /dev/hdX > /dev/hdY' is suprisingly good at cloning drives (i had 20 drives to clone, it saved a lot of time))

of course, the best way to rescue data is to just copy it off your backups..... but im not going to go there

Originally Posted by haertig You will only find one partition table in track zero (these first 20 sectors are part of track zero). Extented partition tables are found much further along in the disk.

Thanks for catching that--I had misinterpreted some tests I did a while back.
So, the more general--and more correct--answer is to search the HD for the "55aa" signature.

Thanks for the testisk referral.

I 2nd gpart.

I also suggest using sfdisk -d:
(From the sfdisk man page)

-d Dump the partitions of a device in a format useful as input to sfdisk. For example, % sfdisk -d /dev/hda > hda.out % sfdisk /dev/hda < hda.out will correct the bad last extended partition that the OS/2 fdisk creates.

Hi

Your actual partition table is this bit of info here.

000001b0 00 00 00 00 00 2c 44 63 98 d5 08 00 00 00 00 01 |.....,Dc........|
000001c0 01 00 83 fe ff ff 3f 00 00 00 0c 01 b0 03 00 fe |......?.........|
000001d0 ff ff 82 fe ff ff 4b 01 b0 03 01 ef 0f 00 00 fe |......K.........|
000001e0 ff ff 07 fe ff ff 4c f0 bf 03 c0 67 d2 05 00 00 |......L....g....|
000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.|


As for http://mirror.href.com/thestarman/asm/mbr/GRUB.htm

it appears that it has been pooled bytes to the left. As this is how I think it should be read:
00 01 01 00 83 fe ff ff 3f 00 00 00 0c 01 b0 03
00 fe ff ff 82 fe ff ff 4b 01 b0 03 01 ef 0f 00
00 fe ff ff 07 fe ff ff 4c f0 bf 03 c0 67 d2 05

so according to http://www.ata-atapi.com/hiwtab.htm#T2:
the first part start at CHS 0H,1H,1H and is type 83 'Linux'
the second part uses a hack mentioned in the same site that some newer os do use and is type 83 'Swap'
the third partition is type 07 'NTFS' partition which starts on LBA 03bff04cH and has 05d267c0H sectors which approx. 50Gb.


As for the site http://mirror.href.com/thestarman/asm/mbr/GRUB.htm the "stage2" of grub should be at sector 07bbfc74H as you can see here
00000040 f0 ac 3c 00 "74 fc bb 07"

so try do a "dd if=/dev/hda of=something bs=512 skip=129760372 count=1" to find out if there is anything that resembles to this- Loading stage2.

some more take a look here http://mirror.href.com/thestarman/as...PartTables.htm it explains some more partition table things

The problem you still have left is to find your extend partition first sector if you had one to extract the rest of your partitions, my guess is that it should be at sector 62910540 (03bff04cH) or at sector 160585741 (03bff04cH+05d267c0H+1H) (LBA 1 address+part size+1)

so if you do "dd if=/dev/hda of=something bs=512 skip=62910540 count=1" or "dd if=/dev/hda of=something bs=512 skip=160585741 count=1" with some luck you can see the rest of partition table.

Really hope this can help I have also had some problems were I had to recover my disks.

JdogPC