[TriLUG] HD Partition Recovery

[Michael Donaghy]

Yesterday I accidentally performed this command
  dd if=boot.img of=/dev/hda bs=1440k count=1
notice the "hda" instead of "fd0".  Ooops.
Yes, I know using root isn't a good idea & that I
should back up my data more often.  :)

I've got the results of a "df" command printed right before my "dd
typo", and know that my partition table looks something like this:

DEVICE    DF 1-K Blcks
/dev/hda1 2775064
/dev/hda2 ~2GB (unmounted)
/dev/hda5 12839868
/dev/hdaX ~1GB (swap)

I ran gpart on the drive, and it said it found the following:
  Extended @ offset (4753mb)
  Linux Swap 1027mb @ 18049mb
The other values that gpart came up with for the primary
partitions were useless at best.

fdisk thinks my disk looks like this:
  /dev/hda h=255, s=63, c=2432
  units = cylinders of 16065 * 512 bytes

All of the data I want to recover is on hda5, which wasn't touched by
the "dd" command, but I've got to figure out where hda5 is on my disk.

My questions are:

1) Do utilities such as fdisk only write to the 1st 512 bytes of the
disk, or do they also write misc. info several GB into the disk for
extended partitions?  ie:  Will I be able to play guess and check games
with fdisk & fsck?

2) How do I compute the number of block that the partition takes from
the 1k-blocks from df?

Thanks for the help!

Michael