Hi ,
I managed to overwrite the first 512 bytes of my
/dev/sda ( an ide hard disk connected to my laptop
via a usb adapter having only linux partitions )

I think gpart can't do much for logical partitions
SO I used testdisk which works well except I can't
mount my most important 50 G filesystem anymore.
The partition table shows a bit of an overlap
of the 11th and 12th partition ( I may be wrong )
But here is the output:
analyse disk gave me this output

Linux 0 1 1 20317 15 62 20480480 [/opt]
Linux 20318 0 1 30476 15 63 10240272 [/u01]
Linux 30477 0 1 40635 15 63 10240272 [/usr]
Linux 40636 1 1 44699 15 62 4096448 [/var]
Linux 44700 1 1 54387 15 62 9765440
Linux 54388 1 1 56325 15 62 1953440
Linux 56326 1 1 57294 15 62 976688
Linux Swap 57295 1 1 61169 15 46 3905920
Linux 61170 1 1 80545 15 62 19530944
Linux 80546 1 1 99921 15 62 19530944 (Note this ends at 99921)
Linux 99921 15 63 196802 15 54 97656040 (Note this starts at 99921)
Linux 196803 1 1 238215 15 62 41744240 (These 3 lines are the
Linux 196812 1 1 238224 15 62 41744240 same partition really)
Linux 196877 1 1 238289 15 62 41744240

Now, Why does partition 12 start at the SAME place
where partition 11 ends. How do I fix that?
Is that the reason why the filesystem on 12
is "corrupt?" - I get a bad magic number in
superblock when I try to mount it.

Thanks!

Testdisk makes "best guess" - can't always be right. Have you been to the site - there are some excellent articles there to explain how to use it.

Your partitions 11 and 12 don't overlap. Same cylinder, different sectors - not expected, but not illegal. Allocation these days typically starts at the cylinder boundary, but watch what M$oft do on Vista.
Your parition 12 apparently doesn't align to the right spot - hence the filesystem errors. Can be rechecked with testdisk - or by hand if need be, but that's a serious PITA.

Restore from a recent backup is of course the easy option.

The output you posted would be more readable if you put it in a code block.
Could you post the output of "sudo /sbin/fdisk -l" so we can see what actually is in the partition table rather than what the analysis found. You might want to print out both as a kind of backup. The solution may be to use fdisk tweaking the values until all partitions are mountable, and then running "fsck" on the partition to fix the end values in the filesystems themselves.
Also, including the block size of your output would help. ( This may have been printed in the header info that you didn't post. )
One tool you could try is to copy a partial image to a file (using dd) and then using "file" to analyse the result. For example, if your list used a block size of 512:
If there was a filesystem that started on one of these, one of the "file" replies should tell you.

For these two:
I think you first want to see if the partition starting on 99921 mounts ok. If it does, try to mount the partition starting on 80546. If it does: backup the contents; change the end to 99920; run "fsck" on this partition.

Good Luck!

Note, that I didn't know if your listing shows blocks, or sectors. If they are sectors then you can embed the calculations in the dd command. Like "skip=$((99921*16063))" if there are 16063 blocks per sector. I had better luck using "fdisk -lu /dev/sda" when testing this on my laptop. If your tool can output block offsets instead of sector offsets, use that instead.
I also guessed how many blocks are needed for file to analyze an image sample.

----

PS. If you get it all fixed. Make a backup of your MBR and the output of "sudo /sbin/fdisk -l" && "sudo /sbin/fdisk -lu". Beside saving the text of the last two as a file, print them out as well. Then in the future, you could use dd to restore the MBR or you could use fdisk to restore the partition table based on the printout.

I like sfdisk - produces a txt file you can feed straight back in and let it do the work. And yes, it potentially suffers from going out of date, but I am in the habit of producing it every time I create a new partition (or resize).

Hi ,
I tried to delete all the partitions and build them again.
The results of that + other information I have posted below.

Once again, the partition that couldn't be recovered by testdisk
was the 50G one.

testdisk initial result:
(Sorry I don't know how to include it in a code block)
Sun Nov 25 22:35:26 2007
Command line: TestDisk /log /debug /dev/uba

TestDisk 6.8, Data Recovery Utility, August 2007
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Linux version (ext2fs lib: 1.39, ntfs lib: 9:0:0, reiserfs lib: 0.3.1-rc8, ewf l
ib: none)
Failed to set locale, using default 'C'.
Geometry from i386 MBR: head=255 sector=63
Hard disk list
Disk /dev/uba - 122 GB / 114 GiB - CHS 14947 255 63, sector size=512

...then I changed the number of heads to 16...
and got the New geometry of
Disk /dev/uba - 122 GB / 114 GiB - CHS 238216 16 63 sector_size=512

then analyse disk started:-
Analyse Disk /dev/uba - 122 GB / 114 GiB - CHS 238216 16 63
Current partition structure:
No partition is bootable
Ask the user for vista mode
Allow partial last cylinder : No
search_vista_part: 0

search_part()
Disk /dev/uba - 122 GB / 114 GiB - CHS 238216 16 63

recover_EXT2: s_block_group_nr=0/78, s_mnt_count=40/4294967295, s_blocks_per_group=32768
recover_EXT2: boot_sector=0, s_blocksize=4096
recover_EXT2: s_blocks_count 2560060
recover_EXT2: part_size 20480480
D Linux 0 1 1 20317 15 62 20480480 [/opt]
EXT3 Large file Sparse superblock, 10486 MB / 10000 MiB

recover_EXT2: s_block_group_nr=0/39, s_mnt_count=35/4294967295, s_blocks_per_group=32768
recover_EXT2: boot_sector=0, s_blocksize=4096
recover_EXT2: s_blocks_count 1280034
recover_EXT2: part_size 10240272
D Linux 20318 0 1 30476 15 63 10240272 [/u01]
EXT3 Sparse superblock, 5243 MB / 5000 MiB

recover_EXT2: s_block_group_nr=0/39, s_mnt_count=27/5, s_blocks_per_group=32768
recover_EXT2: boot_sector=0, s_blocksize=4096
recover_EXT2: s_blocks_count 1280034
recover_EXT2: part_size 10240272
D Linux 30477 0 1 40635 15 63 10240272 [/usr]
EXT3 Sparse superblock, 5243 MB / 5000 MiB

recover_EXT2: s_block_group_nr=0/15, s_mnt_count=26/5, s_blocks_per_group=32768
recover_EXT2: boot_sector=0, s_blocksize=4096
recover_EXT2: s_blocks_count 512056
recover_EXT2: part_size 4096448
D Linux 40636 1 1 44699 15 62 4096448 [/var]
EXT3 Sparse superblock, 2097 MB / 2000 MiB

recover_EXT2: s_block_group_nr=0/149, s_mnt_count=14/25, s_blocks_per_group=8184
recover_EXT2: boot_sector=0, s_blocksize=4096
recover_EXT2: s_blocks_count 1220680
recover_EXT2: part_size 9765440
D Linux 44700 1 1 54387 15 62 9765440
EXT3 Sparse superblock, 4999 MB / 4768 MiB

recover_EXT2: s_block_group_nr=0/7, s_mnt_count=13/27, s_blocks_per_group=32768
recover_EXT2: boot_sector=0, s_blocksize=4096
recover_EXT2: s_blocks_count 244180
recover_EXT2: part_size 1953440
D Linux 54388 1 1 56325 15 62 1953440
EXT3 Sparse superblock, 1000 MB / 953 MiB

recover_EXT2: s_block_group_nr=0/59, s_mnt_count=11/30, s_blocks_per_group=8192
recover_EXT2: boot_sector=0, s_blocksize=1024
recover_EXT2: s_blocks_count 488344
recover_EXT2: part_size 976688
D Linux 56326 1 1 57294 15 62 976688
EXT3 Sparse superblock, 500 MB / 476 MiB
D Linux Swap 57295 1 1 61169 15 46 3905920
SWAP2 version 1, 1999 MB / 1907 MiB

recover_EXT2: s_block_group_nr=0/74, s_mnt_count=34/24, s_blocks_per_group=32768
recover_EXT2: boot_sector=0, s_blocksize=4096
recover_EXT2: s_blocks_count 2441368
recover_EXT2: part_size 19530944
D Linux 61170 1 1 80545 15 62 19530944
EXT3 Large file Sparse superblock, 9999 MB / 9536 MiB

recover_EXT2: s_block_group_nr=0/74, s_mnt_count=21/28, s_blocks_per_group=32768
recover_EXT2: boot_sector=0, s_blocksize=4096
recover_EXT2: s_blocks_count 2441368
recover_EXT2: part_size 19530944
D Linux 80546 1 1 99921 15 62 19530944
EXT3 Sparse superblock, 9999 MB / 9536 MiB

block_group_nr 1

recover_EXT2: "e2fsck -b 32768 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=1/372, s_mnt_count=12/25, s_blocks_per_group=32768
recover_EXT2: boot_sector=32768, s_blocksize=4096
recover_EXT2: s_blocks_count 12207005
recover_EXT2: part_size 97656040
D Linux 99921 15 63 196802 15 54 97656040
EXT3 Large file Sparse superblock Backup superblock, 49 GB / 46 GiB

recover_EXT2: s_block_group_nr=0/159, s_mnt_count=18/33, s_blocks_per_group=32768
recover_EXT2: boot_sector=0, s_blocksize=4096
recover_EXT2: s_blocks_count 5218030
recover_EXT2: part_size 41744240
D Linux 196803 1 1 238215 15 62 41744240
EXT3 Sparse superblock, 21 GB / 19 GiB
get_geometry_from_list_part_aux head=16 nbr=22
get_geometry_from_list_part_aux head=8 nbr=22
get_geometry_from_list_part_aux head=16 nbr=22
get_geometry_from_list_part_aux head=32 nbr=14
get_geometry_from_list_part_aux head=64 nbr=6
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=3
get_geometry_from_list_part_aux head=255 nbr=1

Results
* Linux 0 1 1 20317 15 63 20480481 [/opt]
EXT3 Large file Sparse superblock, 10486 MB / 10000 MiB
P Linux 20318 0 1 30476 15 63 10240272 [/u01]
EXT3 Sparse superblock, 5243 MB / 5000 MiB
P Linux 30477 0 1 40635 15 63 10240272 [/usr]
EXT3 Sparse superblock, 5243 MB / 5000 MiB
L Linux 40636 1 1 44699 15 63 4096449 [/var]
EXT3 Sparse superblock, 2097 MB / 2000 MiB
L Linux 44700 1 1 54387 15 63 9765441
EXT3 Sparse superblock, 4999 MB / 4768 MiB
L Linux 54388 1 1 56325 15 63 1953441
EXT3 Sparse superblock, 1000 MB / 953 MiB
L Linux 56326 1 1 57294 15 63 976689
EXT3 Sparse superblock, 500 MB / 476 MiB
L Linux Swap 57295 1 1 61169 15 63 3905937
SWAP2 version 1, 1999 MB / 1907 MiB
L Linux 61170 1 1 80545 15 63 19530945
EXT3 Large file Sparse superblock, 9999 MB / 9536 MiB
D Linux 80546 1 1 99921 15 63 19530945
EXT3 Sparse superblock, 9999 MB / 9536 MiB
D Linux 99921 15 63 196802 15 63 97656049
EXT3 Large file Sparse superblock Backup superblock, 49 GB / 46 GiB
L Linux 196803 1 1 238215 15 63 41744241
EXT3 Sparse superblock, 21 GB / 19 GiB

Then I try to read the partition just above the 50G one
which is: D Linux 80546 1 1 99921 15 63 19530945
and I can read the files:
(Note I can also read the partition just after the 50G one)
So,
dir_partition inode=2
D Linux 80546 1 1 99921 15 63 19530945
EXT3 Sparse superblock, 9999 MB / 9536 MiB
Directory /
2 drwxrwxrwx 0 0 4096 5-Sep-2007 21:41 .
2 drwxrwxrwx 0 0 4096 5-Sep-2007 21:41 ..
11 drwx------ 0 0 16384 13-Mar-2005 16:13 lost+found
32577 drwxr-xr-x 0 0 4096 15-Mar-2005 23:16 yum
179169 drwxr-xr-x 504 506 8192 18-Mar-2005 13:11 UNREAD-UNBURNED-STUFF
......etc etc
Then I tried to read the 50G partition which is:
D Linux 99921 15 63 196802 15 63 97656049
and I get:
Couldn't open reiser filesystem (I dont remember making this a reiserfs)

D Linux 99921 15 63 196802 15 63 97656049
EXT3 Large file Sparse superblock Backup superblock, 49 GB / 46 GiB
Can't open filesystem. Filesystem seems damaged.

and besides it says EXT3 thereafter, But as you can see the File System
seems damaged...

Then I un 'D' the previous partition, so my listing reads
interface_write()
1 * Linux 0 1 1 20317 15 63 20480481 [/opt]
2 P Linux 20318 0 1 30476 15 63 10240272 [/u01]
3 P Linux 30477 0 1 40635 15 63 10240272 [/usr]
4 E extended LBA 40636 0 1 238215 15 63 199160640
5 L Linux 40636 1 1 44699 15 63 4096449 [/var]
6 L Linux 44700 1 1 54387 15 63 9765441
7 L Linux 54388 1 1 56325 15 63 1953441
8 L Linux 56326 1 1 57294 15 63 976689
9 L Linux Swap 57295 1 1 61169 15 63 3905937
10 L Linux 61170 1 1 80545 15 63 19530945
11 L Linux 80546 1 1 99921 15 63 19530945
12 L Linux 196803 1 1 238215 15 63 41744241
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 40636/0/1,lba=40961088
write_all_log_i386: CHS: 44700/0/1,lba=45057600
write_all_log_i386: CHS: 54388/0/1,lba=54823104
write_all_log_i386: CHS: 56326/0/1,lba=56776608
write_all_log_i386: CHS: 57295/0/1,lba=57753360
write_all_log_i386: CHS: 61170/0/1,lba=61659360
write_all_log_i386: CHS: 80546/0/1,lba=81190368
write_all_log_i386: CHS: 196803/0/1,lba=198377424
You will have to reboot for the change to take effect.
As you can see, the 50 G one is not included in the Write.

Now,
I reboot and then using cfdisk I create it so that it fits
between 11 and 12, Therefore I now have 13 partitions..
But the numbers are off by 1 and also cfdisk says the newly created 50G parition is not Linux Ext3 but just Linux.

bash-3.00# fdisk -ls /dev/sda

Disk /dev/sda: 122.9 GB, 122942324736 bytes
16 heads, 63 sectors/track, 238216 cylinders
Units = cylinders of 1008 * 512 = 516096 bytes

Device Boot Start End Blocks Id System
/dev/sda1 * 1 20318 10240240+ 83 Linux
/dev/sda2 20319 30477 5120136 83 Linux
/dev/sda3 30478 40636 5120136 83 Linux
/dev/sda4 40637 238216 99580320 f W95 Ext'd (LBA)
/dev/sda5 40637 44700 2048224+ 83 Linux
/dev/sda6 44701 54388 4882720+ 83 Linux
/dev/sda7 54389 56326 976720+ 83 Linux
/dev/sda8 56327 57295 488344+ 83 Linux
/dev/sda9 57296 61170 1952968+ 82 Linux swap
/dev/sda10 61171 80546 9765472+ 83 Linux
/dev/sda11 80547 99922 9765472+ 83 Linux
/dev/sda12 99923 196803 48827992+ 83 Linux
/dev/sda13 196804 238216 20872120+ 83 Linux
bash-3.00#
bash-3.00# fdisk -lu /dev/sda

Disk /dev/sda: 122.9 GB, 122942324736 bytes
16 heads, 63 sectors/track, 238216 cylinders, total 240121728 sectors
Units = sectors of 1 * 512 = 512 bytes

Device Boot Start End Blocks Id System
/dev/sda1 * 63 20480543 10240240+ 83 Linux
/dev/sda2 20480544 30720815 5120136 83 Linux
/dev/sda3 30720816 40961087 5120136 83 Linux
/dev/sda4 40961088 240121727 99580320 f W95 Ext'd (LBA)
/dev/sda5 40961151 45057599 2048224+ 83 Linux
/dev/sda6 45057663 54823103 4882720+ 83 Linux
/dev/sda7 54823167 56776607 976720+ 83 Linux
/dev/sda8 56776671 57753359 488344+ 83 Linux
/dev/sda9 57753423 61659359 1952968+ 82 Linux swap
/dev/sda10 61659423 81190367 9765472+ 83 Linux
/dev/sda11 81190431 100721375 9765472+ 83 Linux
/dev/sda12 100721439 198377423 48827992+ 83 Linux
/dev/sda13 198377487 240121727 20872120+ 83 Linux

bash-3.00# e2fsck /dev/sda12
e2fsck 1.38 (30-Jun-2005)
Couldn't find ext2 superblock, trying backup blocks...
e2fsck: Bad magic number in super-block while trying to open /dev/sda12

The superblock could not be read or does not describe a correct ext2
filesystem. If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193 <device> ( But this gives the same result)

Then if you see the test disk log above, it says to try:
e2fsck -b 32768 -B 4096 /dev/sda12
But I get the same result.

also:

dd if=/dev/sda count=20 skip=99922 bs=512 of=test
Gives bash-3.00# file test
test: ASCII English text ( this is true because the text is present )

Then on trying the previous partition
bash-3.00# dd if=/dev/sda of=sda6.image count=20 bs=512 skip=80546
20+0 records in
20+0 records out
bash-3.00# file sda6.image
sda6.image: data
bash-3.00# dd if=/dev/sda of=sda6.image count=20 bs=512 skip=80547
20+0 records in
20+0 records out
bash-3.00# file sda6.image
sda6.image: data
bash-3.00#
I don't get Ext2 filesystem as expected. But I can mount this partition,
Its the 12 one /dev/sda12 that is the problem.
bash-3.00# mount /dev/sda12 sda12
mount: you must specify the filesystem type


bash-3.00# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/hda5 449634 303304 120628 72% /
/dev/hda6 4482124 2607912 1617980 62% /usr
/dev/hda7 4475348 3158168 1061348 75% /opt
/dev/hda8 6716344 4379844 1952552 70% /data
/dev/hda10 9614116 7825532 1300212 86% /vmware
(Problem hard disk below..)
/dev/sda11 9612100 5803960 3319868 64% /mnt/sda/sda11
/dev/sda1 10079324 8422460 1144852 89% /mnt/sda/sda1
/dev/sda10 9612100 8667072 456756 95% /mnt/sda/sda10
/dev/sda13 20544308 997100 18503604 6% /mnt/sda/sda13
/dev/sda2 5039592 3849780 933808 81% /mnt/sda/sda2
/dev/sda3 5039592 3707592 1075996 78% /mnt/sda/sda3
/dev/sda5 2015984 1267368 646208 67% /mnt/sda/sda5
/dev/sda6 4270588 2946012 1080440 74% /mnt/sda/sda6
/dev/sda7 946088 21436 875816 3% /mnt/sda/sda7
/dev/sda8 472896 8240 440239 2% /mnt/sda/sda8
bash-3.00#

What can I now do to say /dev/sda12 ???
Many Thanks!
-d

Well I've managed to borrow an extra disk but I'll need to give it back soon , Maybe I can dump some date onto it and do more painstaking analysis ?

Another point to note - none of the other partitions are important to me, so I could do without any of them.
The most important one is the /dev/sda12
All the paritions are mounting ok, so what if I delete
all from sda9 ( The swap one ) onwards and then make 1 partition from there to the end of the disk? Then I can
mount the filesystems 1 by 1. My question would then be
how do I know how big the file system is so that I can cut the partition boundary off at the end and make another partition ?
I know that:
sda10 = 10G
sda11 = 10G
sda12 = 50G
sda13 = 20G

Hi,
I have tried the following steps to no avail...

dd if=/dev/zero of=testfile bs=512 count=10000
mke2fs testfile
dd if=/dev/sda12 of=testfile bs=512 count=10000
mkdir loopdir
mount testfile loopdir -o loop
...Then I get a loop device busy error and the same dreaded please specify the type of the filesystem message!

The same thing works fine for other partitions, though...

/dev/sda11 mounts fine
/dev/sda12 does not mount
/dev/sda13 mounts fine.

But the files I need are on sda12

My question is How do I find out where /dev/sda12 starts??? so that I can read from there!?
I feel like I'm poking it somewhere in the middle though I don't know why/how? The only change
I made to the disk ever since is to the first 512 bytes...
Any suggestions?
Thanks!
- D