Is there a program that can locate "valid" ntfs partitions in a hard drive? Suppose the Partition Table got busted. I think that a program could find the NTFS "partition magic mark" and see (somehow.. using the NTFS partition format) if it's a valid partition and then tell me where it is.

testdisk will do most of that if not all.

Thanks man! I'll go check (someone else will work on the drive, but I'm assisting him).

Is this a drive from a Windows XP computer. If so, then the first partition probably starts at block 63.

You can try:
sudo /sbin/losetup -fs -o $((512*63))

to attach a loop device to it and then use
sudo file -s /dev/loop0
to analyse if there is a filesystem there.

If so, then you can mount it with
sudo mount -t ntfs /dev/loop0 /mnt

Once it is mounted you can use "df --block-size 512 /mnt" to determine the size of the filesystem. If there is another partition, it may be located at an offset of the size df returned plus the original 512*63 byte offset. So you can keep going and use losetup on the next partition.

That sounds quite logical. The distance MS sets between partitions is 63 sectors?

I've also looked at usb drives and they start at sector 63 as well. My newish laptop is from Hitachi & it came with Vista. The first partition starts on Sector 2048. I don't know it this has something to do with Vista, or Hitachi.

When trying to locate or restore a partition, I would recommend using 512 byte sectors in all your tools. E.G. fdisk -lu, df --block-size 512, etc. If you work with cylinder sizes you could cause a rounding error. Especially on the first partition.

You can also use "losetup" and "file" in a for loop, attaching & detaching the loop device inside the loop. If you filter out ": data" results with "grep -v", you will have fewer locations to try out. For the second and later partitions, you could figure out cylinder size and try cylinder boundaries first. That could save a lot of time.

---

I'd also recommend taking an old pendrive, repartition & format it, and add some file. Now try using losetup and df to locate the start and size of the partitions on the pendrive. Use dd to wipe out the partition table and see if you can use losetup, df and fdisk to reconstruct it. This practice may become invaluable in the future.

In my example, in post #4, I used bash to calculate the byte offset. $((512*63)).