restore partition table from the cache?
 

Doh! All of the sudden, I couldn't access any of my data on my NFS mount. When I went to go check it out, my partition no longer exists (cfdisk shows no partitions). This is the most important hard drive in my house since it is the storage drive for the network.

I've been working on a remote partitioning utility and while I don't know exactly how it happened, I'm pretty sure this is what caused it (which is weird since it doesn't actually partition yet, just creates a partition table ready to be written to the disk).

OK, now for my question.

Back when I was doing my initial testing, I was using sfdisk to dump the partition table to a file, modify and write it back to the disk. I was able to do this while still working in Linux, (as long as I restored the original output before I rebooted). I belive this was because partition table was cached.

Can I somehow grab this "cached" partition table and write it back to my disk and *hopefully* save my 250Gb of data? (included some development work for my project)

I haven't modified the disk, or rebooted, so theoretically, I should just be able to restore the partition table and be good to go ...right?

Here's hoping,
...drkstr

**edit**
FYI, I do know the start/end sectors (we'll I can calculate them that is, luckly it's only 1 partition). I could just overwrite the partition table manually, but I wanted to check first before I ruin my chances for good.

I don't think there's any cache for the partition table itself, at least not at the OS level, since usually direct disk access is used to read and write to it... Maybe you can recreate it manually using the /dev/hd?? devices, if they aren't gone (i.e., you can tell that if you have a /dev/hda1 and /dev/hda5 that you have primary (1), extended (not shown) and logical (5) partitions and you might be able to query the kernel about the partition (device) size...), I'm just guessing.

If I understood your post correctly, then sfdisk is dumping the same partition table, even after it has been modified (which doesn't make any sense to me, tho').

If that's the case, can't you just use it to dump again the same partition table?

Anyway, why were you modifying the partition table of a machine with important work and data on it and (presumably) no backups?

Sorry, I didn't explain it very well. I would dump the partition table to a back up file. Then dump it again to another file, modify, rewrite, then restore from the unmodified backup when I was done testing.

I don't have a backup onfortunatly. The testing I was referring to was done on my laptop with no important data whatsoever. To be honest, I have no idea why my partition got deleted on my development server. I can only assume that I did something stupid by accident without even realizing it. At no point did I intentionally try and modify the partition table on my server.

I guess I will just calculate the start/end sector and try my luck and restoring it manually.

Ironically, this was the whole purpose of the testing I did 3-4 weeks ago on my laptop. I wanted to see if I could restore the partition table manually after making modifications to it. I guess I'm not 100% confident in my calculations though.

Thanks for the help! I'll let you know how it turns out.
...drkstr

F'ing SWEET! It totally worked! Linux kicks so much arse.

I dumped the partition table to my first disk in a file to get a template, then 0'd everything out:
Then I did 'sfdisk -l /dev/hdb' to get my Cyllinders, Heads, and Sectors per track.Since there was only 1 partition, start sector is 63 (for thr MBR), and size is (Cylinders*Heads*sect_per_track) - 63
Then in my file containing the partition table (ptable.dump)
Then all I had to do was Mounted the partition, and there were my files. Didn't even have to reboot!

I'm going to create a partition table dump for each hard drive I have and save them to a floppy disk.

<whew> I'm quite relived.

Thanks for the moral support. I just needed a nudge to suck it up and just try it.

...drkstr

WOW! Well done! I must say that I'm impressed.

Now there's an (and the only I know) argument to keep just one partition: It's easier to write the partition table manually that way :)

hehe, yeah I lucked out. I would have been boned if it was my system drive which has 8 partitions (including extended of course). This is why I'm going to back up my partition tables for the other disks, just in case.

I'm glad to know my partition utility will work as expected. ...well, assuming it doesn't delete random partitions when I'm not looking ;)

take care,
...drkstr

There's a nice utility to save your partitions in those situations: http://www.cgsecurity.org/wiki/TestDisk
It has been very usefull to me sometimes ;)

Testdisk is excellent - and the site has some handy doco for recovery.
Also, next time have a look at /proc/partitions.

Partition table backups (use sfdisk) are a bit debateable. You have to remember to do it each time you fiddle with partitions.
In my case this is all the bloody time. For a while I thought of doing it in rc.local, but it was too much of a pain finding a floppy every boot.
I just rely on testdisk now.

Thanks for the tip, I'll check it out, it looks pretty advanced. Maybe I will get some ideas for my own utility.

regards,
...drkstr

I always email myself before and after printouts of the partition table in cyls AND sectors (fdisk -l and fdisk -lu). I do the sector thing because *BSD thinks in sectors and if you have one of those and try to rebuild the partition table in cyls/megs/whatever you're gonna be toast.

Twice I've rebuilt the partition table by hand. Talk about sweating boo-lats :p And it works.

There's a simple program called gpart which may be useful to you. You might have a look at fixdisktable also.