wiped first sector of extd partition
Is it possible to recover data and/or restore partition structure of the underlying logical partitions of an extended partition? I unintentionally wiped the first boot sector of /dev/sdb1 instead of the entire disk. I was under the impression I'd wiped the MBR so I eventually overwrote it as well. Fortunately, I'd copied the partition structure from testdisk prior to this, so I still have the partition table information. However, when I try to mount any of the partitions, mount fails to recognize that the filesystem is ext3.
Thanks |
I am not sure on this, but you MAY be able to do an fsck on the filesystem by telling fsck.ext3 to look for different superblocks to recover from.
|
Unfortunately, I've already tried this and none of the blocks were links to valid superblocks.
|
I think that before you make any alterations you should preserve what's there and make a 'dd' copy. Then check out http://www.cgsecurity.org/wiki/Category:Data_Recovery -> http://www.cgsecurity.org/wiki/Advan...kup_SuperBlock . If you run any other tools, what does Gpart say?
|
I mirrored the drive, but only after I wiped the MBR. However, as I've said, I copied the partition structure into a forum post and recreated it. gpart AND testdisk (testdisk was even able to view all files) worked before I wiped the MBR. But I find it incomprehensible why both of these tools fail to work anymore after the partition structure was recreated.
Edit: Advanced>Superblock doesn't find any backup ext2.ext3 backup superblocks. I've tried it many times before on both drives. |
This is definitely possible to recover...
An extended partition entry sets the total size of all the underlying logicals, and points to the FIRST logical partition. In the boot sector of that partition, there are 2 entries: 1 for the logical, and another extended which points to the next logical. All you have to know is where that first logical is. For the structure of a partition table, go here: http://www.ata-atapi.com/hiwtab.htm Meanwhile, I'm going to try and generate an example for you.... |
That's very encouraging news. I have been attempting to recover for just over seven days now. I've put untold hours into recovering my data, so I'd rather not take the drive in for professional data recovery.
I'd think it would be a simple matter of recreating the partition table, but obviously this is not the case. Thanks for everyones' help so far. Edit: Example 3 on the page you referred me to is exactly what I'm looking for. Quote:
|
Here is something interesting...
Apparently, the BIOS is having trouble assigning the correct names to the three hard drives connected right now. I tried to boot Ubuntu, which is installed on a 250GB hdd, but when I booted using the original 80GB hdd, it booted into Ubuntu. There is no way I installed Ubuntu onto THIS drive since I checked fdisk output beforehand and I determined it was the correct drive with the least number of partitions (Ubuntu) and 250GB in size. 'fdisk -l' still shows the original partition table on the 80GB and 250GB mirrored drives, so something is bungled up in the BIOS, it seems. Also, when I tried to boot the other two drives, I received 'GRUB error 17' (unable to mount partition), which makes sense. One of the GRUB menus only allowed me to boot kernel 2.6.20-15, which is the kernel Ubuntu uses and the other one didn't even display GRUB. I'm not sure why I'm getting GRUB errors since I wiped the MBR. Maybe it didn't affect the bootloader... edit: I'm starting to worry that I may have accidentally installed Ubuntu on both the backup and original drive since the GRUB menu is the same as Ubuntu's. However, this wouldn't have been possible unless 'fdisk -l' was displaying incorrect information and the partition table is exactly the same as it ever was on the two salvage drives... completely different from Ubuntu's default partition table. Also, Ubuntu should boot without error if the installation did in fact repartition the drive. |
Here is an example from one of my systems:
Code:
Device Boot Start End Blocks Id System Code:
root@mherring-xp:/home/mherring# dd if=/dev/hda bs=512 count=1|hexdump -C Code:
root@mherring-xp:/home/mherring# dd if=/dev/hda bs=512 skip=41624415 count=1|hexdump -C So....All you have to do is determine where your second logical partition is, and then recreate the correct entry for the first logical. I'll save further details until you either catch up or tell me that you have already gotten ahead of me..... |
It will probably take me some time to figure all of this out and I'll probably need a more experienced individual's help.
Right now, however, I'm a bit concerned about the situation I've laid out in post #8. I'm confused why the Ubuntu GRUB bootloader has taken the place of my formerly non-existent(?) bootloader on my other two hard drives. As I've said, the partition table via 'fdisk -l' still looks exactly the same, so it's not as if the Ubuntu install has overwritten the partition table with a new one. edit: Alright, I'm getting there... somewhat slowly. dd if=/dev/sda bs=512 count=1|hexdump -C Code:
000001c0 01 00 83 fe ff ff 3f 00 00 00 4c 97 c0 1c 00 fe |......?...L.....| dd if=/dev/sda bs=512 skip=482383755 count=1|hexdump -C Code:
000001c0 ff ff 82 fe ff ff 3f 00 00 00 b7 ad 5b 00 00 00 |......?.....[...| Gparted has the same first sector for the extd partition. :) :( edit: How do I know that this is the correct partition table since my bootloader now seems to be the Ubuntu one. Isn't the bootloader stored in the MBR? |
I am now confused....
In your first post, you said that you thought you wiped the MBR, but it was really a boot sector. Later, you make references to "wiping the MBR". Can you boot into anything? If not, can you boot up with a live CD? If you can boot with any Linux, we can see what is going on..... First, do fdisk -l and post the results |
Your confusion is completely understandable. It's a very confusing state of affairs and it's getting awfully difficult to describe the flow of events.
Quote:
fdisk -l: Disk /dev/sda: 250.0 GB, 250059350016 bytes 255 heads, 63 sectors/track, 30401 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Device Boot Start End Blocks Id System /dev/sda1 1 8843 71031366 f W95 Ext'd (LBA) /dev/sda2 * 8844 9726 7092697+ 83 Linux /dev/sda5 1 3039 24410704+ 83 Linux /dev/sda6 3040 6686 29294496 83 Linux /dev/sda7 6687 8510 14651248+ 83 Linux /dev/sda8 8511 8692 1461883+ 83 Linux /dev/sda9 8693 8753 489951 83 Linux /dev/sda10 8754 8765 96358+ 83 Linux /dev/sda11 8766 8843 626503+ 82 Linux swap / Solaris Disk /dev/sdb: 250.0 GB, 250059350016 bytes 255 heads, 63 sectors/track, 30401 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Device Boot Start End Blocks Id System /dev/sdb1 * 1 30027 241191846 83 Linux /dev/sdb2 30028 30401 3004155 5 Extended /dev/sdb5 30028 30401 3004123+ 82 Linux swap / Solaris Disk /dev/sdc: 80.0 GB, 80000000000 bytes 255 heads, 63 sectors/track, 9726 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Device Boot Start End Blocks Id System /dev/sdc1 1 8843 71031366 f W95 Ext'd (LBA) /dev/sdc2 * 8844 9726 7092697+ 83 Linux /dev/sdc5 1 3039 24410704+ 83 Linux /dev/sdc6 3040 6686 29294496 83 Linux /dev/sdc7 6687 8510 14651248+ 83 Linux /dev/sdc8 8511 8692 1461883+ 83 Linux /dev/sdc9 8693 8753 489951 83 Linux /dev/sdc10 8754 8765 96358+ 83 Linux /dev/sdc11 8766 8843 626503+ 82 Linux swap / Solaris SDA is the mirrored drive with ddrescue. SDB is the Ubuntu install drive. SDC is the original 80GB hdd. I'm in Ubuntu right now. |
A few posts back, you gave some partition table info for sda, but the data matches what fdisk is telling you for sdb.......So, please confirm:
You are running from sdb and all is well on that drive? Which partitions can you NOT mount? From the fdisk output, sda (and c) have a very strange setup, but should still work. None of these disks shows evidence of the boot sector having been wiped out. Quote:
Note also that the partition table entries don't line up with the hexdump output. That one partition table above actually starts 2 bytes back at offset 000001be. If there were another, it would be at 000001ce |
Well, I _did_ switch the sata cables around once to check what was going on in the BIOS but that was before I replied to your post about the partition table. However, when I switched the cables around between two drives, Ubuntu booted from one of the 250GB hdd's (where it should be) instead of the 80GB hard drive (the original drive) as it had prior to my doing this.
Is it possible that fdisk output was incorrect, just as seems to be the case in the BIOS? I wouldn't imagine so... Quote:
Quote:
I don't know how the Ubuntu bootloader was installed on all of the drives but all the partition tools I've run still show the identical partition structure that I recreated. edit: I'm still curious what this means in testdisk... No EXT2, JFS, Reiser, cramfs or XFS marker. I've never been able to figure it out. |
Quote:
What is the current state? With reference to the fdisk output you posted, what now works, and what does not? |
All times are GMT -5. The time now is 10:31 AM. |