4. Solving the problem

4.2.2.1. Kernel

If you just destroyed your own partition table, but have not rebooted Linux: Don't reboot! You can still retrieve the partition information stored in the Kernel:

cat /proc/partitions gives

4.2.2.2. hdparm

hdparm -g /dev/hda1/dev/hda1 :

geometry = 2432/255/63, sectors = 4192902, start = 63

You'll need to do a few unit conversions. "blocks" are usually 1K in length. "Sectors" are disk sectors, often 512 bytes. But usually the disk partitioning tools work in units of cylinders. (Here, 255*63=16065 sectors.) Using this information, you can build a new partition table.

4.2.2.3. I know the start of the partition, but not the end.

If you know the start of a Linux partition, but not the end, you can still mount it, and learn about the structure. Set the partition table start correctly, and set the end to something very large. See if you guessed correctly with:

e2fsck -n /dev/hd??

You can even mount the partition and check the size:

mount -r /dev/hd?? /mnt
df -T

This won't directly tell you where the next partition starts, because of rounding issues. But it can help you get close. Be sure to use the "-n" and "-r" flags, to treat the system as read-only!!!

4.2.2.4. Other places partition information is stored

Some distributions record partition information in a file. Of course, you probably won't be able to get to this file when you need it. But, just in case:

SuSE: /var/lib/YaST/install.inf

(if you are aware of others, please e-mail the maintainer of this document)

4.2.2.5. gpart

But there is a better way if you can still access the Net or have "gpart" on hand. gpart is available in most distribution, at http://freshmeat.net/ or directly from http://www.stud.uni-hannover.de/user/76201/gpart.

Please note that gpart is not gparted - the GNOME partition editor.

"gpart - guess PC-type hard disk partitions" as the first line of the it's man page states (man gpart). And goes on to say:

"gpart tries to guess which partitions are on a hard disk. If the primary partition table has been lost, overwritten, or destroyed, the partitions still exist on the disk, but the operating system cannot access them."

This is exactly what we need. gpart is a very useful tool.

The problem is the following: the first block of any partition is marked. But it's never "unmarked" if not overwritten. So, many "first partition block" exist on an old disk, and gpart tries to do its best guessing what is the good one. In fact, it's not too difficult to try; nothing is written on the disk by gpart.

Here is the result of gpart on the previously seen disk, hdb:

root@charles:/home/jdd > gpart /dev/hdb
Begin scan...
Possible partition(Linux ext2), size(1200Mb), offset(0Mb)
Possible partition(Windows NTFS), size(1200Mb), offset(1200Mb)
Possible partition(Linux ext2), size(1004Mb), offset(2402Mb)
Possible partition(Windows NTFS), size(1600Mb), offset(4102Mb)
End scan.
Checking partitions...
* Warning: partition(OS/2 HPFS, NTFS, QNX or Advanced UNIX) ends beyond disk end .
Partition(Linux ext2 filesystem): primary
Partition(OS/2 HPFS, NTFS, QNX or Advanced UNIX): primary
Partition(Linux ext2 filesystem): primary
Partition(OS/2 HPFS, NTFS, QNX or Advanced UNIX): invalid primary
Ok.
Guessed primary partition table:
Primary partition(1)
type: 131(0x83)(Linux ext2 filesystem)
size: 1200mb #s(2457880) s(63-2457942)
chs: (0/1/1)-(152/254/61)d (0/1/1)-(152/254/61)r
Primary partition(2)
type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
size: 1200mb #s(2457880) s(2457944-4915823)
chs: (152/254/63)-(305/253/60)d (152/254/63)-(305/253/60)r
Primary partition(3)
type: 131(0x83)(Linux ext2 filesystem)
size: 1004mb #s(2056256) s(4919781-6976036)
chs: (306/61/49)-(434/60/47)d (306/61/49)-(434/60/47)r
Primary partition(4)
type: 000(0x00)(unused) size: 0mb #s(0) s(0-0) chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

As you see, primary partition can be recovered, but, for extended ones, it's still to be done.

DOS partitions are labelled "Windows NTFS" because they were created while trying to install MS Windows 2000 (a very awful experience in year 2000!). The "invalid" one is, in fact the extended partition.

With this, one can use fdisk and try re-creating the partition table. (Remember, this is risk-free given the original one is already lost.)

gpart is updated on a weekly basis and so new versions may be more powerful than I know.

4.2.2.6. Recovering partitions inside an extended partition

Extended partition information is scattered on the disk, not stored with the primary partition. To recover these often requires more work. The process is:

1. Scan for the start of the first partition (using gpart's -k option);

2. Create a temporary primary partition entry with the true start position and a fake end position. (This may drive you to delete an actual primary partition if no one is available - this is risk free if you don't reuse the sectors of the deleted partition);

3. Use "e2fsk -n", "mount -r", and "df" to determine the true end point. Write this value down (warning: read the man page for each program mentioned, and use the read-only options; you do not want to write to your disk until all partitions are in the correct place);

4. Repeat this process for each partition to be recovered;

5. Build a complete new correct partition table.

4.2.2.7. If your hard drive has errors

If your hard drive has errors, you may have real trouble mounting, checking, or using data. (The drive read errors get in the way.) Gpart may not even find it. But if you know the start of the partition, you can easily copy the data to a temporary file stored on a different drive. Sectors with read errors will usually be set to zero by this process:

• Copy the partition data to a file. You must know the start block of the partition;

dd if=/dev/hd?? of=/tmp/recover_hd?? bs=512 skip=XXXX count=YYY

XXX is the sector start and YYY the sector count (can be guessed).

• Mount the file as a loop file system.

mount -r -t ext2 -o loop /tmp/recover_hd?? /mnt/recover

Use dd_rescue if the disk is really badly damaged.