LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Desktop
User Name
Password
Linux - Desktop This forum is for the discussion of all Linux Software used in a desktop context.

Notices


Reply
  Search this Thread
Old 11-09-2017, 06:06 PM   #1
stf92
Senior Member
 
Registered: Apr 2007
Location: Buenos Aires.
Distribution: Slackware
Posts: 3,655

Rep: Reputation: 51
Broken msdos partition table. Desperate situation?


Hi: I lost a logical partition with valuable data. There are however other logical partitions which I can access, so the extended partition has not entirely been damaged. Lilo each time it writes a boot sector saves a copy of the previous one in /boot. Somewhere on the disk is a boot.NNNN where NNNN is some hex value, the boot sector saved by lilo. Looking for it should be easy, as the physical sector size is 512 on this disk every boot sector begins with 0xfaeb and ends with 0x55aa. Besides the are a lots of byte strings, besides these, which are the same in every msdos boot sector. I could write a C program to do the job if I knew how to read disk sectors independently of the file structure. I think there is one system call to do this.

If I am lucky and find it, then I could recuperate the data. Unless there is some program to do just that, looking for boot sectors in a disk out there. So in fact the question would be what the system call is and what it's parameters.
 
Old 11-09-2017, 06:16 PM   #2
aus9
LQ Addict
 
Registered: Oct 2003
Location: Australia
Distribution: MX 16
Posts: 5,298

Rep: Reputation: Disabled
consider test disk available on most good live cds

https://www.interworks.com/blog/smat...artition-table
 
Old 11-09-2017, 06:19 PM   #3
bigrigdriver
LQ Addict
 
Registered: Jul 2002
Location: East Centra Illinois, USA
Distribution: Debian stable
Posts: 5,898

Rep: Reputation: 353Reputation: 353Reputation: 353Reputation: 353
You may also be able to recover the partition table from one of the superblocks.
https://www.cyberciti.biz/faq/recove...ted-partition/

Testdisk mentioned by aus9 can:
Fix partition table, recover deleted partition.
Recover FAT32 boot sector from its backup.
Rebuild FAT12/FAT16/FAT32 boot sector.
Fix FAT tables.
Rebuild NTFS boot sector.
Recover NTFS boot sector from its backup.
Fix MFT using MFT mirror.
Locate ext2/ext3/ext4 Backup SuperBlock.

Be advised that testdisk must be run on an un-mounted partition.

Last edited by bigrigdriver; 11-09-2017 at 06:22 PM.
 
Old 11-09-2017, 08:28 PM   #4
jlinkels
Senior Member
 
Registered: Oct 2003
Location: Bonaire, Leeuwarden
Distribution: Debian /Jessie/Stretch/Sid, Linux Mint DE
Posts: 4,728

Rep: Reputation: 754Reputation: 754Reputation: 754Reputation: 754Reputation: 754Reputation: 754Reputation: 754
You say you lost a logical partition inside an extended partition. Then comes a whole story about LILO and boot sectors. Are you sure LILO writes the boot sector PLUS partition table?

If you are looking for boot.NNNN why do you need forensic type tools? This assumes LILO has written the boot.NNNN on the damaged logical partition. Otherwise you simply can look for the file boot.NNNN.

A logical partition is not so difficult to restore. If it was the first, it starts at the sector of the extended partition + offset. I think the offset is 2048 but I am not sure. You can check that on an arbitrary partitioned disk. Use parted and look at the start of the extended and the first logical partition.

If the logical partition was between 2 other partition, the same goes. The logical partition starts at the end of the previous logical partition. Again, check if there is any offset on a known good disk.

Remember that for reading, only the start of the partition is relevant. If you get the end wrong it creates chaos while formatting. But for reading anything goes.

jlinkels
 
Old 11-13-2017, 05:54 PM   #5
stf92
Senior Member
 
Registered: Apr 2007
Location: Buenos Aires.
Distribution: Slackware
Posts: 3,655

Original Poster
Rep: Reputation: 51
I have, somewhere on disk, some boot.NNNN files from the time the partitions were OK. The present boot.NNNN corresponds to the bootsec with the problematic partition table. When I run parted -l parted says "Error: can't have a partition outside the disk" and he exits with message "Partition table unknown". However, fdisk won't object:
Code:
root@darkstar:/home/bill/HARD/MBR# fdisk -l

Disk /dev/sda: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders, total 625142448 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x6715d19b

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *        2048     1953791      975872    c  W95 FAT32 (LBA)
/dev/sda2         1953792    41015295    19530752    c  W95 FAT32 (LBA)
/dev/sda3        41015296    82958335    20971520   83  Linux
/dev/sda4        87873536   625142447   268634456    f  W95 Ext'd (LBA)
/dev/sda5   ?  3431934351   879347767   871190356+  25  Unknown
/dev/sda6   *   536900346   625142447    44121051    7  HPFS/NTFS/exFAT

Partition table entries are not in disk order
Anyway. the entry for the extended partition has to be OK, since I can mount /dev/sda6. So the problem is only within the extended partition?

You can see the entry marked ? is realy outside the disk, but as there's no problem with the partition table, I do not see why parted has to complain.

I ran gparted and the same as parted. It says Partitions overlapping and then shows an empty partition table. There is the option Attemp to Rescue, which tries to find file systems on the disk and takes a long time. I'll run it tonight and see what happens.

Last edited by stf92; 11-13-2017 at 06:15 PM.
 
Old 11-13-2017, 06:31 PM   #6
jefro
Moderator
 
Registered: Mar 2008
Posts: 17,195

Rep: Reputation: 2562Reputation: 2562Reputation: 2562Reputation: 2562Reputation: 2562Reputation: 2562Reputation: 2562Reputation: 2562Reputation: 2562Reputation: 2562Reputation: 2562
Might be worth it to dd the drive off before you mess it up?

At one time Ranish used to be able to fix partitions pretty well but if this data is valuable then dd it off first. Then diag the copy by some or many means.
 
Old 11-13-2017, 06:37 PM   #7
jlinkels
Senior Member
 
Registered: Oct 2003
Location: Bonaire, Leeuwarden
Distribution: Debian /Jessie/Stretch/Sid, Linux Mint DE
Posts: 4,728

Rep: Reputation: 754Reputation: 754Reputation: 754Reputation: 754Reputation: 754Reputation: 754Reputation: 754
It is obvious that the start for sda5 is wrong. As you can see in sda4, the extended partition runs from 87873536 to 625142447. It is impossible for sda5 to start beyond the end of sda4.

sda6 ends at the same block as sda4 and that is fine. Since you can access it, it likely starts at the correct block as well.

So change the start of sda5. Let it start at 87873536 + 2048. If that doesn't work, try 87873536 + 1 or 87873536.

Set the end at 536900346-1 (the start of sda6) or 536900346 - 2048 (to be sure not to damage sda6)

I can't tell you with certainty where sda5 should start withing the extended partition. I read this from the partition table of my main machine. That is the only one with an extended partition which I want to enter with fdisk. But this is a repaired partition table.

Remember, you can write to the partition table and nothing changes in your file system. If it doesn't work you can edit and write again. But don't you write anything to the partitions or file system itself!

After you tried to change the settings for sda5 you can try and mount this partition. If it doesn't work, try the next option I described.

jlinkels

Edit: changing sda5 you most likely do by deleting sda5 and then recreate it. You can delete, recreate and list before you actually write to disk.

Last edited by jlinkels; 11-13-2017 at 06:39 PM.
 
1 members found this post helpful.
Old 11-13-2017, 06:52 PM   #8
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 15,997

Rep: Reputation: 2219Reputation: 2219Reputation: 2219Reputation: 2219Reputation: 2219Reputation: 2219Reputation: 2219Reputation: 2219Reputation: 2219Reputation: 2219Reputation: 2219
Quote:
Originally Posted by jlinkels View Post
Remember, you can write to the partition table and nothing changes in your file system. If it doesn't work you can edit and write again. But don't you write anything to the partitions or file system itself!
That is only true for the entries in the (primary) partition table itself. Entries for logical partitions are a linked list within the extended partition.
 
Old 11-13-2017, 07:06 PM   #9
jlinkels
Senior Member
 
Registered: Oct 2003
Location: Bonaire, Leeuwarden
Distribution: Debian /Jessie/Stretch/Sid, Linux Mint DE
Posts: 4,728

Rep: Reputation: 754Reputation: 754Reputation: 754Reputation: 754Reputation: 754Reputation: 754Reputation: 754
Quote:
Originally Posted by syg00 View Post
That is only true for the entries in the (primary) partition table itself. Entries for logical partitions are a linked list within the extended partition.
The extended partition information must be somewhere so that makes sense. Is that information perhaps written in the block between the start of the extended partition and the first partition inside this extended partition?

In this case of the OP it should not make any difference as he should write only values in the linked list. He does not change the position of the extended partition, nor the number of extended partitions.

jlinkels
 
Old 11-13-2017, 07:15 PM   #10
stf92
Senior Member
 
Registered: Apr 2007
Location: Buenos Aires.
Distribution: Slackware
Posts: 3,655

Original Poster
Rep: Reputation: 51
Quote:
Originally Posted by jefro View Post
Might be worth it to dd the drive off before you mess it up?

At one time Ranish used to be able to fix partitions pretty well but if this data is valuable then dd it off first. Then diag the copy by some or many means.
Unfortunately I don't have a backup medium to dd the drive to it. I'll have to risk directly writing to it. I ran testdisk_static from cgsecurity dot org and it's a wonder how it restored all lost partitions. Now as a final step I'll have to tell it to write to disk, but the root partition is naturally mounted. Suppose the program know what it does.

Last edited by stf92; 11-13-2017 at 07:37 PM.
 
Old 11-13-2017, 07:43 PM   #11
stf92
Senior Member
 
Registered: Apr 2007
Location: Buenos Aires.
Distribution: Slackware
Posts: 3,655

Original Poster
Rep: Reputation: 51
Quote:
Originally Posted by jlinkels View Post
It is obvious that the start for sda5 is wrong. As you can see in sda4, the extended partition runs from 87873536 to 625142447. It is impossible for sda5 to start beyond the end of sda4.
Thanks. I wrote a program to find all sectors containing boot sectors and it found eight of them. I was examining them when it hit me I couldn't repair the partition by playing with the partition table as the damage was in the extended partition itself. So I took courage and ran tesdisk_static, a command line program. It immediately found all lost partitions.

As a dividend, every time I ran cfisk in the past cfisk complained and did not let me see the partition table, it immediately exit. I always could, however use all partition and even parted did not find any problem. Now I can also run cfdisk!
 
Old 11-13-2017, 08:11 PM   #12
jlinkels
Senior Member
 
Registered: Oct 2003
Location: Bonaire, Leeuwarden
Distribution: Debian /Jessie/Stretch/Sid, Linux Mint DE
Posts: 4,728

Rep: Reputation: 754Reputation: 754Reputation: 754Reputation: 754Reputation: 754Reputation: 754Reputation: 754
So your problem is solved? And what does fdisk show as partition table now?

jlinkels
 
Old 11-13-2017, 08:38 PM   #13
stf92
Senior Member
 
Registered: Apr 2007
Location: Buenos Aires.
Distribution: Slackware
Posts: 3,655

Original Poster
Rep: Reputation: 51
Code:
root@darkstar:~# fdisk -l

Disk /dev/sda: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders, total 625142448 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x6715d19b

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *        2048     1953791      975872    b  W95 FAT32
/dev/sda2         1953792    41015295    19530752    7  HPFS/NTFS/exFAT
/dev/sda3        41015296    82958335    20971520   83  Linux
/dev/sda4        82958336   625142447   271092056    f  W95 Ext'd (LBA)
/dev/sda5        85938176    87873535      967680    c  W95 FAT32 (LBA)
/dev/sda6        87875584   457031679   184578048   83  Linux
/dev/sda7       457033728   497829887    20398080   83  Linux
/dev/sda8       536900346   625142447    44121051    7  HPFS/NTFS/exFAT
root@darkstar:~#
 
Old 11-14-2017, 06:08 PM   #14
stf92
Senior Member
 
Registered: Apr 2007
Location: Buenos Aires.
Distribution: Slackware
Posts: 3,655

Original Poster
Rep: Reputation: 51
I sang victory too early. One of the logical partitions is gone for good. But it was the one with the OS and it did not contained important data. I can see free space that exactly matches in size the size of the lost partition (20GB). I used parted, the text mode version, its rescue command, giving it the limits of the free space, but it didn't do anything. Bad luck.

Last edited by stf92; 11-14-2017 at 06:10 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Rebuild UEFI windows 7 or 10, dual boot, mint17 Linux, GPT vs msdos partition table rtoney5 Linux - General 2 07-14-2017 11:03 AM
[SOLVED] 3TB partition with msdos partition table - how is this possible ? stoorky Linux - Hardware 2 09-01-2015 12:00 PM
Migration from MSDOS partition table to GPT davepi Linux - General 4 10-01-2012 12:30 AM
msdos partition table.... bad? ok? (understanding parted output) emailbuilder88 Linux - General 10 04-30-2010 04:53 PM
partition table broken ? dmedhora Linux - Hardware 3 11-26-2007 06:28 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Desktop

All times are GMT -5. The time now is 01:06 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration