[SOLVED] Recovery Extended Logical partition from MBR to GPT conversion

kasak730 · 03-08-2019, 07:58 AM

I had tried to convert my HDD from MBR to GPT, and like an idiot converted every partition separately not
knowing I only had to convert the whole disk at once. I had seen a few tutorials where people were using
Parted to convert the MBR. Below is a printout of my partitions before the destruction:

Code:

fdisk -l /dev/sda

Model: ATA ST500LT012-9WS14 (scsi)
Disk /dev/sda: 976773168s
Sector size (logical/physical): 512B/4096B
Partition Table: msdos
Disk Flags:

Number  Start      End         Size        Type      File system  Flags
 2      2048s      39063551s   39061504s   primary   ext4         boot
 3      39067646s  650115071s  611047426s  extended
 5      39067648s  468023295s  428955648s  logical   ext4
Partition 3 does not start on physical sector boundary.

So to explain exactly what I did. I wanted to rid my system of the MBR 4 Primary partition limitation. Here
is a overview of each partiton was and usage: sda2 /, sda3 extended , & sda5 /home. Converting sda2 was
no problem. I ran into my issues when I got to sda3. I had tried converting (dev/sda3 204.6G extended) from
beginning to end (39067646s-650115071s) thinking this would include everything in the (dev/sda5 /home 86.8G logical)
partition. What I am left with is 2 partitions. Partition sda2 is fine with no issues, sda3 looks to have
absorbed sda5. I can no longer access these files from sda5. I know all my files are still there because I
used photorec to dump sda3 to an external sdd, then dd'd a complete copy of sda3 to another hdd. All the files
are still on the drive because when I used photorec for recovery, it dumped all files into whole bunch of directories
incrementally named "recup_dir...", but for the least they are there.

Somewhere in this process it seems as the partitions shifted a bit; Original sda2 / is now sda1 with everything
intact. Original partition sda3 is now sda2.

When running cfdisk on the sda2, I can see it shows as having a sub-partition of 86.8G which is exactly what my
original /home partition was. It lists it as "Free space" however which confuses me a bit.

Code:

cfdisk /dev/sda2
 Disk: /dev/sda2
                                        Size: 291.4 GiB, 312856282112 bytes, 611047426 sectors
                                                  Label: dos, identifier: 0x00000000

    Device              Boot                     Start               End           Sectors          Size        Id Type
>>  /dev/sda2p1                                      2         428955649         428955648        204.6G        83 Linux
    Free space                               428955650         611047425         182091776         86.8G

Also, taking a look with gdisk it shows as the MBR "protective", and GPT only "present". Not sure if this should like like this

Code:

gdisk /dev/sda
GPT fdisk (gdisk) version 1.0.3

Partition table scan:
  MBR: protective
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with protective MBR; using GPT.

All in all, what Id like to do ideally, would be to just recover my /home partition with the same folder names and file structure.
Once I have accomplished this I plan to format the whole drive and start fresh, it would be a huge loss to not be able to recover
all my files. Any and all help would be greatly appreciated.

Here is the exact commands I had used while converting:

Code:

#COMMANDS USED


parted /dev/sda
unit s


mktable gpt
        i #for ignore
          #yes to continue
        i #for ignore
    

Parted /dev/sda
unit s
mkpart    
    #partition name >blank
    #filesystem type >ext4
    #start >2048s
    #end >39063551s
    i #for ignore


mkpart "" home 39067646s 650115071s

set 1 legacy_boot on

partprobe

A before and after of partitions:

Code:

#Before conversion

fdisk -l /dev/sda

Model: ATA ST500LT012-9WS14 (scsi)
Disk /dev/sda: 976773168s
Sector size (logical/physical): 512B/4096B
Partition Table: msdos
Disk Flags:

Number  Start      End         Size        Type      File system  Flags
 2      2048s      39063551s   39061504s   primary   ext4         boot
 3      39067646s  650115071s  611047426s  extended
 5      39067648s  468023295s  428955648s  logical   ext4
Partition 3 does not start on physical sector boundary.



#After conversion

fdisk -l /dev/sda

Disk /dev/sda: 465.8 GiB, 500107862016 bytes, 976773168 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: 4DC051BC-5700-489A-8E0B-919A562986E4

Device         Start       End   Sectors   Size Type
/dev/sda1       2048  39063551  39061504  18.6G EFI System
/dev/sda2   39067646 650115071 611047426 291.4G Linux filesystem

Brains · 03-08-2019, 02:57 PM

You can try testdisk, it is designed to recover lost partitions and rebuild the MBR. Rebuilding the MBR would be your only hope.
Best to make an image of the drive, make the image read/write and run testdisk on it first to see what it can do.
EDIT: Whatever the case, when it comes to recovering data, it is best to make an image of the drive, then make a copy of the image and try all kinds of things on it, if you feel you screwed it up, make another copy of the original image and keep playing. This way you don't screw up the drive and loose the data for good.

syg00 · 03-08-2019, 05:02 PM

Sounds like pretty good advice. Better would be to play with the backup you took before you started.
If it were me I'd have a go at losetup with an offset to get at the start of the (old) /home and simply try to mount that so it could be backed up properly.
Then let testdisk see what it can find.

Brains · 03-08-2019, 05:25 PM

Quote:

Originally Posted by syg00

If it were me I'd have a go at losetup with an offset to get at the start of the (old) /home and simply try to mount that so it could be backed up properly

Good one.
@ kasak730:
See if you can mount the old /home with command below:

Code:

mount -oloop,offset=20002635776 /dev/sda /mnt

If no error, navigate to /mnt directory to see if your home.

kasak730 · 03-16-2019, 08:48 PM

@Brains & @syg00

Sorry for the long response, my brother had passed and my priorities were sidetracked for a bit.

You fellas are my heros! Ran cmd provided by Brains, then cd'd into /mnt, and lo and behold /home intact. I will be backing this up to another disk then restarting correctly. Again, thanks a lot!

Although, I love to pick your brains to understand where you came up with "20002635776" for the offset number.... If you have time of course.

Code:

mount -oloop,offset=20002635776 /dev/sda /mnt

syg00 · 03-16-2019, 09:01 PM

Real life has a habit of intruding - hope you're handling the important things ok.

As for this issue, simple arithmetic - your "original" listing showed /dev/sda5 starting at sector 39067648; each sector (for these purposes) is 512 bytes.
The offset value is in bytes from the start of the device.

Glad you got it sorted.

Brains · 03-17-2019, 05:09 AM

Quote:

Originally Posted by kasak730

I will be backing this up to another disk then restarting correctly.

Well... sorry about the bad news.
If you have a UEFI system, then it might be best to repartition and get the EFI system partition to a normal size of 200-300MB.
But if you're not concerned about that, you can extract the old /home partition to an image file, then paste it into a new /dev/sda2 of same size. Then it's just a matter of editing /etc/fstab to include proper UUID, but it should work, extract the partition to an image with:

Code:

dd if=/dev/sda of=/dev/otherdrive/partition.img skip=39067648 count=428955648

Otherdrive is where you would send the partition image of course.
Then you would verify it's integrity by mounting it and checking the contents:

Code:

mount -o loop /dev/otherdrive/partition.img /mnt

If it mounts and everything is accessible, delete/recreate or shrink the new /dev/sda2 to 219626MB or 209451MiB, depending on which your partitioner defaults to (MB or MiB), the new partition can be a little larger to be safe and after reboot the file system can be expanded to fill the partition, then resized back down to where you want it.

Then paste the partition image into the new partition:

Code:

dd if=/dev/otherdrive/partition.img of=/dev/sda2 bs=64K

Now it's just a matter of booting it up and adjusting UUID in /etc/fstab, or do it from Live CD if it don't boot because it can't mount /home.
EDIT: Forgot to mention, you would have to change the ID of /dev/sda1, typically an EFI partition is hidden, it would need to be changed to 83 Linux, can be done with fdisk.

kasak730 · 03-18-2019, 08:00 AM

Having a bit of an issue backing up the home to an external drive. First I had made a mistake while typing the dd command where I forgot to add the "/" between dev and sdd2 and got the error message below. I had an NTFS filesystem on the 1st partition which I cant see on a Windows based computer. It was 5:20 AM. I stopped using that hdd at once and swapped for another one I had handy until I can resolve first issue, Ill leave this NTFS drive be for the moment.

So, after I swapped the hdd I had tried formatting the first partition on this hdd before dd'ing. I allocated 500 GB to the first partition, and on the rest of the disk is a 2nd partition with some backups. I am still unable to dd with the same error.

Code:

[root@ArcoLinux liveuser]# dd if=/dev/sda of=/devsdd2/partition.img skip=39067648 count=428955648 status=progress
dd: failed to open '/devsdd2/partition.img': No such file or directory

[root@ArcoLinux liveuser]# dd if=/dev/sda of=/dev/sdd1/partition.img skip=39067648 count=428955648

dd: failed to open '/dev/sdd1/partition.img': Not a directory

Then, I had tried mounting /dev/sdd1 to /mnt then dd'ing, but it and I got 22 GB written. This I believe was the size of my / partition. My original /home was 86-97 GB. I have tried to mount for confirmation to no avail. I have tried looking into other post about the "dd: failed to open '/dev/sdd1/partition.img': Not a directory" issue, but I havent found a solution as of yet. Any Ideas?

Code:


[root@ArcoLinux mnt]# mkdir yup

[root@ArcoLinux mnt]# mount /dev/sdd1 yup

[root@ArcoLinux]# dd if=/dev/sda of=/mnt/yup/partition.img skip=39067648 count=42895548
42895548+0 records in
42895548+0 records out
21962520576 bytes (22 GB, 20 GiB) copied, 591.925 s, 37.1 MB/s

Also, I forgot to mention; I had also tried writing the .img to the disk without any partition "of=/dev/sdd/part.img" resulting in the same outcome.

Brains · 03-18-2019, 03:54 PM

Code:

Model: ATA ST500LT012-9WS14 (scsi)
Disk /dev/sda: 976773168s
Sector size (logical/physical): 512B/4096B
Partition Table: msdos
Disk Flags:

Number  Start      End         Size        Type      File system  Flags
 2      2048s      39063551s   39061504s   primary   ext4         boot
 3      39067646s  650115071s  611047426s  extended
 5      39067648s  468023295s  428955648s  logical   ext4
Partition 3 does not start on physical sector boundary.

Well, all calculators I've tried come up with 204.542GB for 428955648 sectors at 512B each. Since you were able to mount /home with my calculations of (39067648 x 512 = 20002635776) means the calculations are good. The reported size of the partition is 428955648, it's possible the partition was actually 204.5GB but the file system was only 86-97GB. This can happen when the partition is expanded, but the file system within was not expanded.

But for imaging sake, it's best to work with the reported numbers for now, after re-writing the partition image, you could run command: resize2fs /dev/sda2 even if mounted which would automatically fill the container (partition) then you'll know the size of the partition, then you can use Gparted to shrink it if desired when it's not mounted.

Your last attempt was close:

Code:

[root@ArcoLinux]# dd if=/dev/sda of=/mnt/yup/partition.img skip=39067648 count=42895548
42895548+0 records in
42895548+0 records out
21962520576 bytes (22 GB, 20 GiB) copied, 591.925 s, 37.1 MB/s

You didn't set the count value properly:

Code:

dd if=/dev/sda of=/mnt/yup/partition.img skip=39067648 count=428955648

kasak730 · 03-18-2019, 05:36 PM

I cant believe I missed that ¨6¨, I have a feeling this is what my issue was. Either way, I have dd running now and I will post as to the outcome.

Update:
Looks to have only written 33GB now.

Code:

[root@ArcoLinux liveuser]# cd /mnt
[root@ArcoLinux mnt]#
[root@ArcoLinux mnt]# mkdir yup
[root@ArcoLinux mnt]# mount /dev/sdd1 yup
[root@ArcoLinux mnt]#
[root@ArcoLinux mnt]#
[root@ArcoLinux mnt]# dd if=/dev/sda of=/mnt/yup/partition.img skip=39067648 count=426488955 status=progress
33022923264 bytes (33 GB, 31 GiB) copied, 825 s, 40.0 MB/s
dd: writing to '/mnt/yup/partition.img': Read-only file system
64497930+0 records in
64497929+0 records out
33022939648 bytes (33 GB, 31 GiB) copied, 826.238 s, 40.0 MB/s
[root@ArcoLinux mnt]#

Im wondering if I should try mounting /home with the offset to /mnt/home then dding to the /mnt/yup/partition.img... Not sure if this will play out as I want...

Before I do anything more, I just ran the command to mount sda with the same off set and I am getting errors:

Code:

[root@ArcoLinux liveuser]# mkdir /mnt/home
[root@ArcoLinux liveuser]# mount -oloop,offset=20002635776 /dev/sda /mnt/home
NTFS signature is missing.
Failed to mount '/dev/loop1': Invalid argument
The device '/dev/loop1' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

Brains · 03-18-2019, 07:47 PM

Hopefully you did the backup the first time you mounted it before playing with this?

Code:

[root@ArcoLinux mnt]# dd if=/dev/sda of=/mnt/yup/partition.img skip=39067648 count=426488955 status=progress
33022923264 bytes (33 GB, 31 GiB) copied, 825 s, 40.0 MB/s
dd: writing to '/mnt/yup/partition.img': Read-only file system

Your count value is wrong again, maybe just copy/paste the command from the bottom of my last post, as long as the external drive is just mounted to /mnt/yup. There's no need to mount /dev/sda.

Also, dd reported that the external drive's file system is read-only, so it can't write to it. Typically dd needs to be run as root or sudo, and if the external drive's file system is ext4, it's possible only root can write to it. Before running the dd command, try writing to it as root or sudo by simply creating an empty file with command: touch /mnt/yup/test.txt. This should produce a test.txt file which you should be able to see get created if you have a file browser open in that directory or with command: ls /mnt/yup

Quote:

[root@ArcoLinux liveuser]# mount -oloop,offset=20002635776 /dev/sda /mnt/home
NTFS signature is missing.

Are you sure you tried mounting the right drive, run command: fdisk -l first to see which drive is which.
You shouldn't have issues writing to an NTFS drive as long as ntfs-3g is installed, no permission issues unless it's a OS partition which most distros won't allow a user to write to that type of partition.

kasak730 · 03-19-2019, 06:57 AM

Yes, I had made 2 backups originally before I started playing with anything. Ill just do what you say and copy/paste it over. Typing on one computer from the screen of another with dyslexia doesnt help much lol. I did see that with dd stating the file system is read-only, but to my surprise it had written a 33GB .img to the drive. Im running dd now without the read-only warning. Ill post back as to the outcome. Thanks again for your help.

Code:

[root@ArcoLinux yup]# dd if=/dev/sda of=/mnt/yup/partition.img skip=39067648 count=428955648 status=progress
219617572352 bytes (220 GB, 205 GiB) copied, 7628 s, 28.8 MB/s
428955648+0 records in
428955648+0 records out
219625291776 bytes (220 GB, 205 GiB) copied, 7628.63 s, 28.8 MB/s
[root@ArcoLinux yup]# 
[root@ArcoLinux yup]# ls -la
total 215322237
drwxr-xr-x 2 root root         4096 Mar 19 07:40 .
drwxr-xr-x 1 root root           60 Mar 19 07:27 ..
-rw-r--r-- 1 root root            0 Mar 19 07:37 .nilfs
-rw-r--r-- 1 root root 219625291776 Mar 19 09:49 partition.img
[root@ArcoLinux yup]#
[root@ArcoLinux yup]# cd ..
[root@ArcoLinux mnt]# mkdir nop
[root@ArcoLinux mnt]# mount -o loop /mnt/yup/partition.img /mnt/nop/

dd'd out 220GB. Mounted it and everything looks good. Now I have the confirmed image Ill wipe my sda and start fresh then Ill dd the home image back as suggested to a new partition and update the fstab file.

Hope this is all for now. Thank a lot for the support.