LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 12-14-2010, 07:50 PM   #1
katto
Member
 
Registered: Nov 2010
Distribution: Kubuntu 10.4
Posts: 46

Rep: Reputation: 16
Looking for ways to manually rebuild a partition table


Hey guys. This is probably strange question, but I need to find a program or a way to edit the partition table and set the values and addresses for the partition boundaries manually. A while ago I had a very messy data loss that left me with a disk full of data but without a partition table (and without file indexes for some of the partitions on the disk). So, for recovery reasons I need to try lots of combinations of starting and ending addresses for each partition. Additionally it would be extra nice if I could do this with a live cd since I don't have the faulty drive attached to a working computer at the moment.

By the way although I always appreciate it when people try to help, suggestions about recovery programs for my data or alternative ways to avoid setting the partition boundaries manually are not going to be helpful at all. This really is the only way.
 
Old 12-14-2010, 08:08 PM   #2
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 681Reputation: 681Reputation: 681Reputation: 681Reputation: 681Reputation: 681
First, it would be a good idea to create an image of the disk and save it to an external drive. That way, you can work on the image instead of the original. If you make a mistake and destroy files, you can start over.

The first partition probably starts on block 63 or 2048. It depends on how recent the drive was partitioned.
You can use the losetup command to attach a loop device to any point on the disk (or disk image file).

Example:
Code:
> sudo /sbin/losetup -fs /dev/sda -o $((2048*512))
/dev/loop0
> sudo file -s /dev/loop0
/dev/loop0: x86 boot sector, code offset 0x52, OEM-ID "NTFS    ", sectors/cluster 8, reserved sectors 0, Media descriptor 0xf8, heads 255, hidden sectors 2048, dos < 4.0 BootSector (0x80)
While the -s option isn't listed in the man page, it seems to work for me. That option returns the loop device used. You might also want to use the -r option for "read only".

If the "file" command finds a filesystem, you can try to mount it. If it will mount, run "df --block-size=512". The results will include the size of the filesystem. The next partition may be above it.

Suppose there is a gap between the top of one partition and the next. You could search for it in a loop.

for example:
Code:
for ((offset=206840; offset<206860; offset++)); do
   losetup /dev/loop2 /dev/sda -o $(($offset*512))
   echo -n "$offset :";file -s /dev/loop2
   losetup -d /dev/loop2
done | grep -v -e data -e ASCII
Be sure to write down the beginning and length of each partition you find. The use the fdisk program to reconstruct your partition table. Read the manpage and select the option to use 512 byte blocks. Use 512 byte blocks on all commands, df, fdisk, etc. That will prevent rounding errors.

Good Luck!
 
Old 12-14-2010, 08:19 PM   #3
TobiSGD
Moderator
 
Registered: Dec 2009
Location: Germany
Distribution: Whatever fits the task best
Posts: 17,148
Blog Entries: 2

Rep: Reputation: 4885Reputation: 4885Reputation: 4885Reputation: 4885Reputation: 4885Reputation: 4885Reputation: 4885Reputation: 4885Reputation: 4885Reputation: 4885Reputation: 4885
At first, before doing anything, make an image of the drive, jschiwal already mentioned.

To restore partition tables you can try the tool testdisk.
 
Old 12-15-2010, 03:32 PM   #4
jefro
Moderator
 
Registered: Mar 2008
Posts: 21,641

Rep: Reputation: 3551Reputation: 3551Reputation: 3551Reputation: 3551Reputation: 3551Reputation: 3551Reputation: 3551Reputation: 3551Reputation: 3551Reputation: 3551Reputation: 3551
I have used ranish a long time ago. It may be helpful.
 
Old 12-16-2010, 04:40 PM   #5
katto
Member
 
Registered: Nov 2010
Distribution: Kubuntu 10.4
Posts: 46

Original Poster
Rep: Reputation: 16
Quote:
Originally Posted by jschiwal View Post
First, it would be a good idea to create an image of the disk and save it to an external drive. That way, you can work on the image instead of the original. If you make a mistake and destroy files, you can start over.

The first partition probably starts on block 63 or 2048. It depends on how recent the drive was partitioned.
You can use the losetup command to attach a loop device to any point on the disk (or disk image file).

Example:
Code:
> sudo /sbin/losetup -fs /dev/sda -o $((2048*512))
/dev/loop0
> sudo file -s /dev/loop0
/dev/loop0: x86 boot sector, code offset 0x52, OEM-ID "NTFS    ", sectors/cluster 8, reserved sectors 0, Media descriptor 0xf8, heads 255, hidden sectors 2048, dos < 4.0 BootSector (0x80)
While the -s option isn't listed in the man page, it seems to work for me. That option returns the loop device used. You might also want to use the -r option for "read only".

If the "file" command finds a filesystem, you can try to mount it. If it will mount, run "df --block-size=512". The results will include the size of the filesystem. The next partition may be above it.

Suppose there is a gap between the top of one partition and the next. You could search for it in a loop.

for example:
Code:
for ((offset=206840; offset<206860; offset++)); do
   losetup /dev/loop2 /dev/sda -o $(($offset*512))
   echo -n "$offset :";file -s /dev/loop2
   losetup -d /dev/loop2
done | grep -v -e data -e ASCII
Be sure to write down the beginning and length of each partition you find. The use the fdisk program to reconstruct your partition table. Read the manpage and select the option to use 512 byte blocks. Use 512 byte blocks on all commands, df, fdisk, etc. That will prevent rounding errors.

Good Luck!
Thanks for the replies everyone. Is there a way to multiquote on this forum?

I have another disk I use for the recovery, after I cloned the old one over it using dd (best program for cloning in the world). I have a list of potential partition boundaries found with TestDisk in CHS format. How do I convert that to blocks?

The problem is that so far I don't have any working filesystems on the partitions. The one I'm most concerned about was a NTFS Vista partition that had gigs of data I want to salvage. The mft for that volume is missing so it is unmountable as an NTFS partition. Using hex editors directly on the partition I can see my old data but obviously they are jumbled around due to fragmentation and currently unsalvageable. Is there a way to mount it regardless of whether there is a working filesystem?

I did use testdisk initially and its a great program but I need to tweak some things more than that program will allow. Eventually I plan to put dd through awk to look for fragments of the mft and undelete it by hand.
 
Old 12-17-2010, 12:04 AM   #6
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 681Reputation: 681Reputation: 681Reputation: 681Reputation: 681Reputation: 681
You could try looking at it by running "sudo /sbin/fdisk </dev/sd?>" where ? is the drive letter.
The header info before the table may provide you with information about how many bytes per cylinder are used for that drive.
Code:
example:
Disk /dev/sdb: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000ebdcb

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1               2          26      200812+  83  Linux
/dev/sdb2              27         678     5237190   82  Linux swap / Solaris
/dev/sdb3             679       21826   169871310   83  Linux
/dev/sdb4           21827       38913   137251327+  83  Linux
Also try "sudo file -s <device>"

The CHS listing may not be useful for large drives. At least the value printed on the drive for the capacity.

This guide may help:
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

For multiquoting, you could manually enter the quote tags and cut and paste the quoted info between the tags. I added spaces to prevent it from being taken literally here:
[ quote=<username> ]<cut and paste>[ /quote ]

eg:
Quote:
Originally Posted by katto
Is there a way to multiquote on this forum?
 
Old 12-17-2010, 10:31 AM   #7
katto
Member
 
Registered: Nov 2010
Distribution: Kubuntu 10.4
Posts: 46

Original Poster
Rep: Reputation: 16
Quote:
Originally Posted by jschiwal View Post
You could try looking at it by running "sudo /sbin/fdisk </dev/sd?>" where ? is the drive letter.
The header info before the table may provide you with information about how many bytes per cylinder are used for that drive.
Code:
example:
Disk /dev/sdb: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000ebdcb

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1               2          26      200812+  83  Linux
/dev/sdb2              27         678     5237190   82  Linux swap / Solaris
/dev/sdb3             679       21826   169871310   83  Linux
/dev/sdb4           21827       38913   137251327+  83  Linux
Also try "sudo file -s <device>"

The CHS listing may not be useful for large drives. At least the value printed on the drive for the capacity.

This guide may help:
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

For multiquoting, you could manually enter the quote tags and cut and paste the quoted info between the tags. I added spaces to prevent it from being taken literally here:
[ quote=<username> ]<cut and paste>[ /quote ]

eg:
Thanks jschiwal. This helped alot. I made some different partition tables for testing but none worked. I will now have to look for NTFS metadata files by hand if I'm going to fix this.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
manually write partition table for deleted partition tihcra Linux - Software 1 07-30-2009 12:26 PM
how to rebuild the partition table tijo.thomas Linux - General 14 02-21-2006 11:51 AM
Manually create partition table? FogSwimmer Linux - Software 7 12-29-2005 06:28 PM
Overwrote partition table. System still running. :) Ways to restore? sleeper.service Linux - Hardware 9 12-19-2004 01:06 PM
Uh-Oh... Manually Edit a Partition Table? davidbalt Linux - Software 11 03-02-2004 01:16 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 06:05 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration