old-www/HOWTO/Partition-Rescue/x122.html

831 lines
18 KiB
HTML

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML
><HEAD
><TITLE
>Solving the problem</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.7"><LINK
REL="HOME"
TITLE="Partition-Rescue"
HREF="index.html"><LINK
REL="PREVIOUS"
TITLE="Technical info"
HREF="x88.html"><LINK
REL="NEXT"
TITLE="References"
HREF="x329.html"></HEAD
><BODY
CLASS="section"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>Partition-Rescue</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="x88.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
></TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="x329.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="section"
><H1
CLASS="section"
><A
NAME="AEN122"
></A
>4. Solving the problem</H1
><P
>Please, beware! Following the explanations given here will lead you to revert back to a previous system, losing all your recent changes, if any! You must choose... </P
><DIV
CLASS="section"
><H2
CLASS="section"
><A
NAME="AEN125"
></A
>4.1. The simpler case</H2
><P
>All is simple if you have at hand: </P
><P
></P
><UL
><LI
><P
>A disk (floppy, usb key or CD) able to start Linux by itself with fdisk available - most rescue disks of any distribution can do that; </P
></LI
><LI
><P
>A paper with the <FONT
COLOR="RED"
>fdisk -l</FONT
> and <FONT
COLOR="RED"
>fdisk -u -l</FONT
> content written down. </P
></LI
></UL
><P
>It's enough to: </P
><P
></P
><OL
TYPE="1"
><LI
><P
>Start Linux; </P
></LI
><LI
><P
>Start <FONT
COLOR="RED"
>fdisk /dev/hda</FONT
> (or whatever is the disk to rescue); </P
></LI
><LI
><P
>Use fdisk to delete (d option) all the existing partitions on the damaged disk; </P
></LI
><LI
><P
>Use fdisk to create all the primary (1 - 4) partitions mentioned on the paper; </P
></LI
><LI
><P
>Give them the appropriate tag (t option) : 82 is for Linux swap, 83 for Linux main (L gives you the list), 5 is extended and must be done before creating logical partitions, c is MS Windows FAT32, and f is MS Windows extended when 6 is MS Windows FAT16. </P
></LI
><LI
><P
>Create any logical partition. </P
></LI
></OL
><P
>On my SUSE installation and any time I had to do this for other people, this has produced good results. </P
><P
>However, I said that some fdisks may cut partitions on a sector basis, not cylinder. So the <FONT
COLOR="RED"
>fdisk -u -l</FONT
> version of the paper. </P
><P
>For using the <FONT
COLOR="RED"
>fdisk -u -l</FONT
> listing one must start <FONT
COLOR="RED"
>fdisk -u</FONT
> :-). In my opinion, using sector limit is a very bad idea, but it may have a real use I'm not aware of. The problem is that, with cylinder limit, it's easy to guess even if you don't have paper. With sector one, there are many more guesses... </P
><P
>fdisk is a small and very smart programs. There are many other makes of fdisk, but I always prefer the bare bones one. (I speak of Linux ones, of course, not the others....) </P
><P
>Be aware that fdisk doesn't write anything to disk before you hit w and return. If you fear a mistake, hit q (quit) or Ctrl C (^C) to quit safe without saving changes. </P
><P
>When your new partition table is written, start your Linux. It's possible you might not be able to do that as usual: lilo/grub may have been damaged also, and you thus may need a boot floppy or CD. Choose the option "booting the installed partition". </P
><P
>If you are accustomed to booting with lilo, as soon as you are logged in as root, key in "lilo" and hit return to reinstall your favourite boot loader. Right now, I'm not sure that the same thing is as easy with GRUB, but it should not be very difficult, either. </P
><P
>Your Linux should be all here; test it. Try, also, to start MS Windows if applicable. If you can't, there is a (very small) chance you can read your data from Linux, maybe with a raw sector-by-sector read. If you can identify the disk sectors your data is on, using dd you can copy it to a file. This is wise for text only. This recovery is NOT in the scope of this mini-HOWTO. </P
></DIV
><DIV
CLASS="section"
><H2
CLASS="section"
><A
NAME="AEN161"
></A
>4.2. A not-so-simple case</H2
><DIV
CLASS="section"
><H3
CLASS="section"
><A
NAME="AEN163"
></A
>4.2.1. By hand</H3
><P
>This is when the previous case can't be used, for lack of fdisk paper, or if it won't work for use of an out-of-date one. </P
><P
><STRONG
>Warning</STRONG
> </P
><P
>You can only try <EM
>primary</EM
> partitions with no fear. <EM
>logical</EM
> partition uses ordinary sectors of the disk to store their own housekeeping data, so, each time you write some logical partition with fdisk, you write some sectors, erasing the data content, if any. There is still a chance you don't have any data there or the data is unimportant, but, the less often you do such tries, the better. </P
><P
>First, be aware that as soon as you don't write to the disk (except with fdisk), you don't erase your data, so that you can use a block-by-block try. That is you need to know the beginning of the partition to start it. If, say a 153 doesn't fit, try a 154, and so on. </P
><P
>This can be tiresome, but, if you remember approximately the size of the Linux partition, there is a chance to win. </P
></DIV
><DIV
CLASS="section"
><H3
CLASS="section"
><A
NAME="AEN173"
></A
>4.2.2. Linux's own info and other hacks</H3
><DIV
CLASS="section"
><H4
CLASS="section"
><A
NAME="AEN175"
></A
>4.2.2.1. Kernel</H4
><P
>If you just destroyed your own partition table, but have not rebooted Linux: Don't reboot! You can still retrieve the partition information stored in the Kernel: </P
><P
><FONT
COLOR="RED"
>cat /proc/partitions</FONT
> gives </P
><DIV
CLASS="informaltable"
><A
NAME="AEN180"
></A
><P
></P
><TABLE
BORDER="1"
CLASS="CALSTABLE"
><TBODY
><TR
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> major </P
></TD
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> minor </P
></TD
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> #blocks </P
></TD
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> name </P
></TD
></TR
><TR
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> 3 </P
></TD
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> 0 </P
></TD
><TD
WIDTH="25%"
ALIGN="RIGHT"
VALIGN="MIDDLE"
><P
> 19535040 </P
></TD
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> hda </P
></TD
></TR
><TR
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> 3 </P
></TD
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> 1 </P
></TD
><TD
WIDTH="25%"
ALIGN="RIGHT"
VALIGN="MIDDLE"
><P
> 2096451 </P
></TD
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> hda1 </P
></TD
></TR
><TR
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> 3 </P
></TD
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> 2 </P
></TD
><TD
WIDTH="25%"
ALIGN="RIGHT"
VALIGN="MIDDLE"
><P
> 4980150 </P
></TD
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> hda2 </P
></TD
></TR
><TR
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> 3 </P
></TD
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> 3 </P
></TD
><TD
WIDTH="25%"
ALIGN="RIGHT"
VALIGN="MIDDLE"
><P
> 1 </P
></TD
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> hda3 &#60;--- this marks an extended partition </P
></TD
></TR
><TR
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> 3 </P
></TD
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> 5 </P
></TD
><TD
WIDTH="25%"
ALIGN="RIGHT"
VALIGN="MIDDLE"
><P
> 4980118 </P
></TD
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> hda5 </P
></TD
></TR
><TR
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> 3 </P
></TD
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> 6 </P
></TD
><TD
WIDTH="25%"
ALIGN="RIGHT"
VALIGN="MIDDLE"
><P
> 4972086 </P
></TD
><TD
WIDTH="25%"
ALIGN="LEFT"
VALIGN="MIDDLE"
><P
> hda6 </P
></TD
></TR
></TBODY
></TABLE
><P
></P
></DIV
></DIV
><DIV
CLASS="section"
><H4
CLASS="section"
><A
NAME="AEN250"
></A
>4.2.2.2. hdparm</H4
><P
><FONT
COLOR="RED"
>hdparm -g /dev/hda1/dev/hda1</FONT
> : </P
><P
>geometry = 2432/255/63, sectors = 4192902, start = 63 </P
><P
>You'll need to do a few unit conversions. "blocks" are usually 1K in length. "Sectors" are disk sectors, often 512 bytes. But usually the disk partitioning tools work in units of cylinders. (Here, 255*63=16065 sectors.) Using this information, you can build a new partition table. </P
></DIV
><DIV
CLASS="section"
><H4
CLASS="section"
><A
NAME="AEN256"
></A
>4.2.2.3. I know the start of the partition, but not the end.</H4
><P
>If you know the start of a Linux partition, but not the end, you can still mount it, and learn about the structure. Set the partition table start correctly, and set the end to something very large. See if you guessed correctly with: </P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><FONT
COLOR="#000000"
><PRE
CLASS="screen"
>e2fsck -n /dev/hd??</PRE
></FONT
></TD
></TR
></TABLE
><P
>You can even mount the partition and check the size: </P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><FONT
COLOR="#000000"
><PRE
CLASS="screen"
>mount -r /dev/hd?? /mnt
df -T</PRE
></FONT
></TD
></TR
></TABLE
><P
>This won't directly tell you where the next partition starts, because of rounding issues. But it can help you get close. Be sure to use the "-n" and "-r" flags, to treat the system as read-only!!! </P
></DIV
><DIV
CLASS="section"
><H4
CLASS="section"
><A
NAME="AEN263"
></A
>4.2.2.4. Other places partition information is stored</H4
><P
>Some distributions record partition information in a file. Of course, you probably won't be able to get to this file when you need it. But, just in case: </P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><FONT
COLOR="#000000"
><PRE
CLASS="screen"
>SuSE: /var/lib/YaST/install.inf</PRE
></FONT
></TD
></TR
></TABLE
><P
>(if you are aware of others, please e-mail the maintainer of this document) </P
></DIV
><DIV
CLASS="section"
><H4
CLASS="section"
><A
NAME="AEN268"
></A
>4.2.2.5. gpart</H4
><P
>But there is a better way if you can still access the Net or have "gpart" on hand. gpart is available in most distribution, at <A
HREF="http://freshmeat.net/"
TARGET="_top"
>http://freshmeat.net/</A
> or directly from <A
HREF="http://www.stud.uni-hannover.de/user/76201/gpart"
TARGET="_top"
>http://www.stud.uni-hannover.de/user/76201/gpart</A
>. </P
><P
>Please note that gpart is <STRONG
>not</STRONG
> gparted - the GNOME partition editor. </P
><P
>"gpart - guess PC-type hard disk partitions" as the first line of the it's man page states (man gpart). And goes on to say: </P
><P
>"gpart tries to guess which partitions are on a hard disk. If the primary partition table has been lost, overwritten, or destroyed, the partitions still exist on the disk, but the operating system cannot access them." </P
><P
>This is exactly what we need. gpart is a very useful tool. </P
><P
>The problem is the following: the first block of any partition is marked. But it's never "unmarked" if not overwritten. So, many "first partition block" exist on an old disk, and gpart tries to do its best guessing what is the good one. In fact, it's not too difficult to try; nothing is written on the disk by gpart. </P
><P
>Here is the result of gpart on the previously seen disk, hdb: </P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><FONT
COLOR="#000000"
><PRE
CLASS="screen"
>root@charles:/home/jdd &#62; gpart /dev/hdb
Begin scan...
Possible partition(Linux ext2), size(1200Mb), offset(0Mb)
Possible partition(Windows NTFS), size(1200Mb), offset(1200Mb)
Possible partition(Linux ext2), size(1004Mb), offset(2402Mb)
Possible partition(Windows NTFS), size(1600Mb), offset(4102Mb)
End scan.
Checking partitions...
* Warning: partition(OS/2 HPFS, NTFS, QNX or Advanced UNIX) ends beyond disk end .
Partition(Linux ext2 filesystem): primary
Partition(OS/2 HPFS, NTFS, QNX or Advanced UNIX): primary
Partition(Linux ext2 filesystem): primary
Partition(OS/2 HPFS, NTFS, QNX or Advanced UNIX): invalid primary
Ok.
Guessed primary partition table:
Primary partition(1)
type: 131(0x83)(Linux ext2 filesystem)
size: 1200mb #s(2457880) s(63-2457942)
chs: (0/1/1)-(152/254/61)d (0/1/1)-(152/254/61)r
Primary partition(2)
type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
size: 1200mb #s(2457880) s(2457944-4915823)
chs: (152/254/63)-(305/253/60)d (152/254/63)-(305/253/60)r
Primary partition(3)
type: 131(0x83)(Linux ext2 filesystem)
size: 1004mb #s(2056256) s(4919781-6976036)
chs: (306/61/49)-(434/60/47)d (306/61/49)-(434/60/47)r
Primary partition(4)
type: 000(0x00)(unused) size: 0mb #s(0) s(0-0) chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r</PRE
></FONT
></TD
></TR
></TABLE
><P
>As you see, primary partition can be recovered, but, for extended ones, it's still to be done. </P
><P
>DOS partitions are labelled "Windows NTFS" because they were created while trying to install MS Windows 2000 (a very awful experience in year 2000!). The "invalid" one is, in fact the extended partition. </P
><P
>With this, one can use fdisk and try re-creating the partition table. (Remember, this is risk-free given the original one is already lost.) </P
><P
>gpart is updated on a weekly basis <SPAN
CLASS="inlinemediaobject"
><IMG
SRC="http://wiki.tldp.org/moin_static172/gugiel/img/smile.png"
WIDTH="16"
HEIGHT="16"></SPAN
> and so new versions may be more powerful than I know. </P
></DIV
><DIV
CLASS="section"
><H4
CLASS="section"
><A
NAME="AEN290"
></A
>4.2.2.6. Recovering partitions inside an extended partition</H4
><P
>Extended partition information is scattered on the disk, not stored with the primary partition. To recover these often requires more work. The process is: </P
><P
></P
><OL
TYPE="1"
><LI
><P
>Scan for the start of the first partition (using gpart's -k option); </P
></LI
><LI
><P
>Create a temporary primary partition entry with the true start position and a fake end position. (This may drive you to delete an actual primary partition if no one is available - this is risk free if you don't reuse the sectors of the deleted partition); </P
></LI
><LI
><P
>Use "<FONT
COLOR="RED"
>e2fsk -n</FONT
>", "<FONT
COLOR="RED"
>mount -r</FONT
>", and "<FONT
COLOR="RED"
>df</FONT
>" to determine the true end point. Write this value down (warning: read the man page for each program mentioned, and use the read-only options; you do not want to write to your disk until all partitions are in the correct place); </P
></LI
><LI
><P
>Repeat this process for each partition to be recovered; </P
></LI
><LI
><P
>Build a complete new correct partition table. </P
></LI
></OL
></DIV
><DIV
CLASS="section"
><H4
CLASS="section"
><A
NAME="AEN307"
></A
>4.2.2.7. If your hard drive has errors</H4
><P
>If your hard drive has errors, you may have real trouble mounting, checking, or using data. (The drive read errors get in the way.) Gpart may not even find it. But if you know the start of the partition, you can easily copy the data to a temporary file stored on a different drive. Sectors with read errors will usually be set to zero by this process: </P
><P
></P
><UL
><LI
><P
>Copy the partition data to a file. You must know the start block of the partition; </P
></LI
></UL
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><FONT
COLOR="#000000"
><PRE
CLASS="screen"
>dd if=/dev/hd?? of=/tmp/recover_hd?? bs=512 skip=XXXX count=YYY</PRE
></FONT
></TD
></TR
></TABLE
><P
>XXX is the sector start and YYY the sector count (can be guessed). </P
><P
></P
><UL
><LI
><P
>Mount the file as a loop file system. </P
></LI
></UL
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><FONT
COLOR="#000000"
><PRE
CLASS="screen"
>mount -r -t ext2 -o loop /tmp/recover_hd?? /mnt/recover</PRE
></FONT
></TD
></TR
></TABLE
><P
>Use <FONT
COLOR="RED"
>dd_rescue</FONT
> if the disk is really badly damaged. </P
></DIV
></DIV
></DIV
><DIV
CLASS="section"
><H2
CLASS="section"
><A
NAME="AEN321"
></A
>4.3. The rich man's case</H2
><P
>Partition Magic is a commercial (and proprietary) software product, not so cheap given the little use one can have (approx a hundred bucks in France), but with a very high reputation all around there. However, I never use it and will not rate it. It's said to be able to do anything with partitions, including restoring them. </P
><P
>Ralf's original partition-rescue mini HOWTO was essentially based around the use of Partition Magic, so I assume it's a very good solution, if you have valuable data on your Linux partition and little Linux capability. However, there are now much more recent releases of Partition Magic and I think it's better for you to read the manual. </P
></DIV
><DIV
CLASS="section"
><H2
CLASS="section"
><A
NAME="AEN325"
></A
>4.4. PMagic</H2
><P
><A
HREF="http://partedmagic.com/wiki/PartedMagic.php"
TARGET="_top"
>PartedMagic</A
> if the tool of choice for any partition work, including recovery. Extremely good product (and open, of course). Read the HOWTO anyway, because you may need it to prevent disasters, but all the tools are on pmagic, this is the best recovery cd ever... </P
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="x88.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="x329.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Technical info</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
>&nbsp;</TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>References</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>