Linux - DesktopThis forum is for the discussion of all Linux Software used in a desktop context.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
Hi: I lost a logical partition with valuable data. There are however other logical partitions which I can access, so the extended partition has not entirely been damaged. Lilo each time it writes a boot sector saves a copy of the previous one in /boot. Somewhere on the disk is a boot.NNNN where NNNN is some hex value, the boot sector saved by lilo. Looking for it should be easy, as the physical sector size is 512 on this disk every boot sector begins with 0xfaeb and ends with 0x55aa. Besides the are a lots of byte strings, besides these, which are the same in every msdos boot sector. I could write a C program to do the job if I knew how to read disk sectors independently of the file structure. I think there is one system call to do this.
If I am lucky and find it, then I could recuperate the data. Unless there is some program to do just that, looking for boot sectors in a disk out there. So in fact the question would be what the system call is and what it's parameters.
Distribution: Debian /Jessie/Stretch/Sid, Linux Mint DE
Posts: 5,195
Rep:
You say you lost a logical partition inside an extended partition. Then comes a whole story about LILO and boot sectors. Are you sure LILO writes the boot sector PLUS partition table?
If you are looking for boot.NNNN why do you need forensic type tools? This assumes LILO has written the boot.NNNN on the damaged logical partition. Otherwise you simply can look for the file boot.NNNN.
A logical partition is not so difficult to restore. If it was the first, it starts at the sector of the extended partition + offset. I think the offset is 2048 but I am not sure. You can check that on an arbitrary partitioned disk. Use parted and look at the start of the extended and the first logical partition.
If the logical partition was between 2 other partition, the same goes. The logical partition starts at the end of the previous logical partition. Again, check if there is any offset on a known good disk.
Remember that for reading, only the start of the partition is relevant. If you get the end wrong it creates chaos while formatting. But for reading anything goes.
I have, somewhere on disk, some boot.NNNN files from the time the partitions were OK. The present boot.NNNN corresponds to the bootsec with the problematic partition table. When I run parted -l parted says "Error: can't have a partition outside the disk" and he exits with message "Partition table unknown". However, fdisk won't object:
Code:
root@darkstar:/home/bill/HARD/MBR# fdisk -l
Disk /dev/sda: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders, total 625142448 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x6715d19b
Device Boot Start End Blocks Id System
/dev/sda1 * 2048 1953791 975872 c W95 FAT32 (LBA)
/dev/sda2 1953792 41015295 19530752 c W95 FAT32 (LBA)
/dev/sda3 41015296 82958335 20971520 83 Linux
/dev/sda4 87873536 625142447 268634456 f W95 Ext'd (LBA)
/dev/sda5 ? 3431934351 879347767 871190356+ 25 Unknown
/dev/sda6 * 536900346 625142447 44121051 7 HPFS/NTFS/exFAT
Partition table entries are not in disk order
Anyway. the entry for the extended partition has to be OK, since I can mount /dev/sda6. So the problem is only within the extended partition?
You can see the entry marked ? is realy outside the disk, but as there's no problem with the partition table, I do not see why parted has to complain.
I ran gparted and the same as parted. It says Partitions overlapping and then shows an empty partition table. There is the option Attemp to Rescue, which tries to find file systems on the disk and takes a long time. I'll run it tonight and see what happens.
Might be worth it to dd the drive off before you mess it up?
At one time Ranish used to be able to fix partitions pretty well but if this data is valuable then dd it off first. Then diag the copy by some or many means.
Distribution: Debian /Jessie/Stretch/Sid, Linux Mint DE
Posts: 5,195
Rep:
It is obvious that the start for sda5 is wrong. As you can see in sda4, the extended partition runs from 87873536 to 625142447. It is impossible for sda5 to start beyond the end of sda4.
sda6 ends at the same block as sda4 and that is fine. Since you can access it, it likely starts at the correct block as well.
So change the start of sda5. Let it start at 87873536 + 2048. If that doesn't work, try 87873536 + 1 or 87873536.
Set the end at 536900346-1 (the start of sda6) or 536900346 - 2048 (to be sure not to damage sda6)
I can't tell you with certainty where sda5 should start withing the extended partition. I read this from the partition table of my main machine. That is the only one with an extended partition which I want to enter with fdisk. But this is a repaired partition table.
Remember, you can write to the partition table and nothing changes in your file system. If it doesn't work you can edit and write again. But don't you write anything to the partitions or file system itself!
After you tried to change the settings for sda5 you can try and mount this partition. If it doesn't work, try the next option I described.
jlinkels
Edit: changing sda5 you most likely do by deleting sda5 and then recreate it. You can delete, recreate and list before you actually write to disk.
Remember, you can write to the partition table and nothing changes in your file system. If it doesn't work you can edit and write again. But don't you write anything to the partitions or file system itself!
That is only true for the entries in the (primary) partition table itself. Entries for logical partitions are a linked list within the extended partition.
Distribution: Debian /Jessie/Stretch/Sid, Linux Mint DE
Posts: 5,195
Rep:
Quote:
Originally Posted by syg00
That is only true for the entries in the (primary) partition table itself. Entries for logical partitions are a linked list within the extended partition.
The extended partition information must be somewhere so that makes sense. Is that information perhaps written in the block between the start of the extended partition and the first partition inside this extended partition?
In this case of the OP it should not make any difference as he should write only values in the linked list. He does not change the position of the extended partition, nor the number of extended partitions.
Might be worth it to dd the drive off before you mess it up?
At one time Ranish used to be able to fix partitions pretty well but if this data is valuable then dd it off first. Then diag the copy by some or many means.
Unfortunately I don't have a backup medium to dd the drive to it. I'll have to risk directly writing to it. I ran testdisk_static from cgsecurity dot org and it's a wonder how it restored all lost partitions. Now as a final step I'll have to tell it to write to disk, but the root partition is naturally mounted. Suppose the program know what it does.
It is obvious that the start for sda5 is wrong. As you can see in sda4, the extended partition runs from 87873536 to 625142447. It is impossible for sda5 to start beyond the end of sda4.
Thanks. I wrote a program to find all sectors containing boot sectors and it found eight of them. I was examining them when it hit me I couldn't repair the partition by playing with the partition table as the damage was in the extended partition itself. So I took courage and ran tesdisk_static, a command line program. It immediately found all lost partitions.
As a dividend, every time I ran cfisk in the past cfisk complained and did not let me see the partition table, it immediately exit. I always could, however use all partition and even parted did not find any problem. Now I can also run cfdisk!
I sang victory too early. One of the logical partitions is gone for good. But it was the one with the OS and it did not contained important data. I can see free space that exactly matches in size the size of the lost partition (20GB). I used parted, the text mode version, its rescue command, giving it the limits of the free space, but it didn't do anything. Bad luck.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
