Linux - SoftwareThis forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Introduction to Linux - A Hands on Guide
This guide was created as an overview of the Linux Operating System, geared toward new users as an exploration tour and getting started guide, with exercises at the end of each chapter.
For more advanced trainees it can be a desktop reference, and a collection of the base knowledge needed to proceed with system and network administration. This book contains many real life examples derived from the author's experience as a Linux system and network administrator, trainer and consultant. They hope these examples will help you to get a better understanding of the Linux system and that you feel encouraged to try out things on your own.
Click Here to receive this Complete Guide absolutely free.
I recently cleared my partition table (by accident) and now im trying to recover it.
I have a question regarding the CHS addressing that testdisk uses...
I have 2 drives, each with 2 partitions.
I found the first partition using testdisk but it cannot find the second one so i have to create it manually, but it asks me for the CHS address, which i dont know...
The situation is as follows:
Each disk has 30401 cylinders, 255 heads and 63 sectors.
My first partition starts at 0 1 1 (CHS) and ends at 2671 254 63 (CHS)
My second partition starts at 2672 ? ? (CHS) and ends at 30400 ? ? (CHS)
So my main problem is finding out what should be under the questionmarks... Help me out someone!
It seems the situation is not as simple i previously stated it...ive got dynamic partitions, so except for the bios restriction workaround stuff u reffered to as "lies" these partitions say they are bigger than the actual disk itself is (each disk is 250 and the striped partition is 424 gb--shown below)
I have two of these 250 gb disks and they were partitioned as follows... (italics because the partitions are still there, only the partition table is screwed)
Note to Moderators
Although this thread turns out to involve NTFS & data recovery, it is still about using GNU/Linux tools & is technical. If you feel the need to move it, please put it somewhere other than "General".
I don't do "Winders (tm)" anymore, at least not on my own boxen -- the last died mid-May 2005 & I never rebuilt it.
My girl friend is still running 2k Pro & my new 250's are still in burn-in, so I might be able to duplicate your problem; but only if all else fails.
That out of the way, let's get some more background.
Note 0: These Q's are presented as a numbered list to to facilitate providing numbered answers w/o having to waste space requoting ea. Q.
Note 1: Some of these are included for onlookers & those who follow, please take no offense.
How important is ea. of these partitions?
How soon do you need this done? -- What is your time limit?
How much effort, time, money are you willing to spend?
What resources do you have in the way of:
OS's? (esp. incl. live CD's)
spare HD's? (It would be, however unlikely, wonderful if you happened to have an unformatted matching pair of HD's. )
Point of interest -- what is the make & model of the HD's?
What software (& OS) set these up?
What is dmdiag?
Does #1 (C) still boot?
What happened -- How did the PT's (part. tables) get trashed?
Did the entire MBR's get cleared? or just the PT's?
Have you dumped the MBR's? Although I assume you know how, here's the code for others' benefit:
dd if=/dev/hdx bs=512 count=1 of=filename # dump MBR
dd if=/dev/hdx bs=512 count=1 | hd | less # display MBR
to dump only the PT:
dd if=/dev/hdx bs=1 count=64 skip=446 of=filename
(No offense, but...) how did you verify that the contents are still there?
What have you already done to try to recover? (In addition to testdisk.)
Under what OS are you running testdisk?
What searches have you done:
The testdisk man page is brief in the extreme, how deep have you gone into the wiki?
Does the 2nd disk have your SuSE Linux distro. When the boot loader wrote over the MBR, it first made a backup of the MBR and saved it at /boot/backup_mbr. If you can access this file using a live distro or rescue disk, you might try writing this over the defunct one using the dd command.
Hey archtoad6, I see you're putting a lot of effort into this and let me just tell you how much I appreciate it!!!
1) This is a matter of opinion, but I've got almost everything on those drives...
Partition "C" (what windows would call "drive C",) holds win32 XP pro all of my documents and programs...
Not THAT important considering all the docs are backed up on a memory stick... and the programs are easily reinstallable, besides any windows pc likes a fresh reinstall atleast every couple of years...
Partition "D" stores all of the big stuff... hashtables, ISO's, ftp server stuff, music, movies, etc... Its extremely important for me I definately do NOT want to loose this, especially since its 422 gb worth of stuff (only 2 gb were free last time that partition was up)!
Partition "E" stores all the sensitive data, things like encrypted stuff, it holds my PGP drive, logs are all there, my website (and all the php scripts which ive ever written), all the code for all the programs ive ever written (a lot of whose most recent versions are not backep up), and vmware virtual machines as well... I also definately do not want to loose this...
2) I would like to get this done as soon as possible, but if that means loosing the data or taking a risk which can be avoided... I'm prepared to wait a little longer!
3) I'm willing to spend:
Time: As much as is neccesary
Money: I'm not going to a data recovery center that will charge me some astronomical amount of cash / gb if thats what you mean...
a) A laptop, operational network (router, switches)
b) Ive got a 50cd cake box full of OS's...
Windows: 95, 98se, me, 2k, xp pro, xp x64, vista rc1,
5) Same make like you, and probably the same model Whats the chance of another drive having *exactly* the same number of C,H and S
2* Seagate 7200.8 SATA 250gb
6) Windows XP setup created partition "C", Windows xp disk manager (not exactly sure what its called, under administrative tools>disk management snap-in) created "D" and "E".
7) dmiag.exe is a windows utility which can read backed up partiton info (which I presume it find on the last sector of the drive--atleast thats what i cud make out of the microsoft articles)
"official" description: http://technet2.microsoft.com/Window....mspx?mfr=true
8) Yes, testdisk managed to find this partition and restored it succesfully (running on a knoppix 5 livedvd)
9) Was installing linux on that small 40gb drive, and the partition manager must have cleared the PT on the main disks...
10) Not sure, im assuming both the PT's and the MBR (btw: do SATA drives still use MBR???), however when I recovered partition "C" with testdisk, I also wrote "a classic new copy of the mbr" to the first sector, because i assumed this was broken too as the bios did not give any error whilest booting (it went though all other boot devices trying to find a valid one until it tried booting from the network, at which point i noticed something was off =/).
12) Im assuming they are, since i managed to recover partition "C" with all ITS data still intact
13) I've tried using testdisk to find the missing partitions and recreate the pratition table, I've tried to use microsoft dskprobe.exe (a low level disk editing tool for windows) according to the instructions on this page, but I was unable to make out what exactly to do (it doesn't explicitly mention dynamic disks):http://support.microsoft.com/kb/153973
And some vague instructions here which are unhelpful...: http://support.microsoft.com/kb/245725
16) The wiki is also pretty brief, couldn't find anything to fix the dynamic volume...
Hope this helps...
BTW: a few things to add:
testdisk does manage to find something... http://entos.free-speicher1.de/hosted/testdisk.txt
but recovering it is impossible (as the dump so kindly explains ), i.e. disk is smaller than the partition
the dmdiag dump is cery helpful, but there is something strange with the disk numbering...
sda > disk 1
sdb > disk 0
O_o a bit strange no?
Thank you for taking your time!
Don't use SuSe anymore (just edited my distro list)... (im sorry to say but i might just as well get windows instead then)
I run slack inside vmware, ubuntu 6.10 server on a small server, knoppix and backtrack are LiveCDs, and debian is a model for stability so i just had to include it
8-2) How thoroughly have you read 3, 8, 9, & 10? They looking long, apt, & boring. And I'm feeling lazy. Could I persuade you to invest the time in going through each fairly thoroughly & sharing the key insights as well as any Q's they leave you w/?
add new Q's
add add'l links
Last edited by archtoad6; 11-28-2006 at 12:41 PM.
Reason: see "Edits"
1) Thats from before the accident...
2) #3 doesnt say much... dmdiag is basically a tool which somehow gets the ldm data which is stored at the last MegaByte of each disk (as opposed to the dos partition table which is at the beginning and has 4 entries)
#8 Talks about how NTFS has backup partition info stored at the end of the partition, and basically the article walks you through a tool they call dskprobe.exe (which i gather is something--norton diskedit--they bought from symantec and changed), on how to find this backup info and restore it to the proper sector (however this does not apply entirely to my situation because im using a dynamic disk with id 0*42, and they mention extended disks... O_o)
#9 This is what #9 has to say...
1. Re-create the exact same volume but choose not to format it. This may be difficult if you do not remember the exact size you had created originally, especially because the Disk Management snap-in tends to round partition sizes.
2. Using Dskprobe.exe, recover the backup boot sector for the NTFS volume from the end of the volume. Because it is a dynamic volume you may need to use Dmdiag.exe to help find the backup boot sector, or search for it by using Dskprobe.exe (on the Tools menu, click Search Sectors).
3. After rewriting the NTFS boot sector, quit Dskprobe.
4. In Disk Management, click Rescan Disks on the Action menu. This should mount the volume for immediate use.
All in all, #8 could hold the key to fixing this but to me it seems that some info from #10 and #8 contradicts...
I think the simplest thing to do would be to simply follow the procedure i went through when creating the partitioning (install win on a 20gb part. on beginning of disk0 > once in win, goto diskmanager and create a new striped dynamic volume of 424 gb spanning the end of disk0 and beginning of disk1 > create a simple partition on the remaining space on disk1 > reboot just in case ), then just copy those partition tables over onto my "broken" disks...
Problem is i dont have 2 spare 250 gig disks *wink* *wink*
...Or figuring out how this damn partitioning works with LDM and 0x42 etc.... which ive been trying for the last 3 days without much success...
Note: Everything from here back to post #7 was posted while this was in preparation & may seem out of context.
You're welcome. Your problem is interesting & is helping me learn; both how to solve it, as well as how to do that from afar. This helps me hone both my trouble shooting & teaching skills.
If Eric Raymond were to paraphrase Clint Eastwood (as Dirty Harry), it might come out:
Go ahead, make my day -- ask me an interesting question.
(Please correct any obvious misunderstandings on my part.)
0) New: I am assuming that, like so many of us, you don't have decent back ups.
Side/Personal Note 1: I bought my 4 250's to make a pair of RAID 1 arrays
Side/Personal Note 2: I have 3 inaccessible (Linux, ext3) partitions on a 160 that I am trying to learn how to recover.
1) And ironically C:, the least crucial, is the 1 you have recovered.
2 & 3) Can you afford 1 or 2 add'l 250 or better HD's if it would facilitate this?
4) You're better equipped than I am . However, you don't mention a GNU/Linux box, may I assume that all Linux tests have been done in place using a live CD?
5) Actually mine are:
# smartctl -i /dev/hdh
smartctl version 5.34 [i686-pc-linux-gnu] Copyright (C) 2002-5 Bruce Allen
Home page is http://smartmontools.sourceforge.net/
=== START OF INFORMATION SECTION ===
Model Family: Western Digital Caviar SE family
Device Model: WDC WD2500JB-00REA0
Serial Number: WD-<various>
Firmware Version: 20.00K20
User Capacity: 250,059,350,016 bytes
Device is: In smartctl database [for details use: -P show]
ATA Version is: 7
ATA Standard is: Exact ATA specification draft version not indicated
Local Time is: Wed Nov 29 08:26:36 2006 EST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled
That is also a demo of the usefulness of smartctl, sorry if it adds too much length to my post.
6) As I suspected.
7) Thanks for the A.
8) Ah hah, an A to my 4) above. Also, this is excellant news & may be the key to full recovery (Post #10).
9) This may be the key:
What distro were you installing?
Did you wipe the 40?
There may a copy of the the orig. MBR (incl. the PT) saved on this disk.
10 & 11) SATA drives do still use MBR -- see your links. Actually, the PT info is exactly what I am looking for. Here is an annotated excerpt: