[TriLUG] RE: HD Partition Recovery

[Scott Marks]

You might be in luck.  It looks like /dev/hda5 was the first "logical"
parition inside /dev/hda2, the "extended partition".  If that is right, then
you don't have too much math to do.

Some facts:

1-K blocks are 2 512-byte sectors.

The partition table is written in track 0, head 0, sector 1, a/k/a/ LBA 0,
a/k/a the first sector on the disk (Sectors are numbered from 1 in the CHS
format).  It gives the location of up to four "physical partitions", with
the usual setup being /dev/hda1 being a physical partition, and /dev/hda2
being the "extended" partition, with "logical" partitions /dev/hda5,
/dev/hda6 ... contained inside it.

This scheme is actually more-or-less repeated, so each "logical" partition
has a Master Boot Record (MBR) that claims it is a real partition with a
following extended partition.


An important question is whether the 2432/255/63 geometry you wrote onto the
disk from boot.img is the right one.  It probably is; does
2432*255*63*512=20,003,880,960 bytes=20GB sound right?  The other
possibility, usually indicated in your BIOS setup as the "Other" choice
instead of the "DOS" choice, is ccccc/16/63, or sometimes choice, is
ccccc/15/63.  Since most of the partitioning software still fantasizes about
the existence of cylinders, the practical effect here is one of granularity:
255*63*512=8225280~=8MB, whereas 16*63*512=516096, so if you can size
partitions within a half-MB (1008 sectors), you are probably using the
Other/Native setup, whereas if they seem to have an 8MB (16065 sector)
granularity, you are probably using the DOS setup.  You might look on the
Advanced page in you BIOS setup for more info.

Since you are only worried about /dev/hda1 and /dev/hda5, you should be able
to fiddle about with fdisk until you get a partition table that matches the
one you had.

The approach I actually use for these disasters (note the plural;  I never
learn! :} ) is to slap the disk in a Windows NT-or-later machine, and use
the NT Resource Kit program dskprobe.exe to hack the partition table (the
first sector) and the variout boot sectors, in conjunction with a bootable
Linux rescue CD in the CD/DVD reader, so I can bounce back and forth as I
try to get things back to reality.

Just so you can really hurt yourself, I have attached dskprobe and its help
files in a .zip.

You probably should Google some stuff on disk geometry and partitions to get
some context.

HTH,
Scott

-----Original Message-----
From: lug-owner at lists.ncsu.edu [mailto:lug-owner at lists.ncsu.edu]On
Behalf Of Michael Donaghy
Sent: Friday, May 16, 2003 11:41 AM
To: lug at lists.ncsu.edu; trilug at trilug.org
Subject: HD Partition Recovery


Yesterday I accidentally performed this command
  dd if=boot.img of=/dev/hda bs=1440k count=1
notice the "hda" instead of "fd0".  Ooops.
Yes, I know using root isn't a good idea & that I
should back up my data more often.  :)

I've got the results of a "df" command printed right before my "dd
typo", and know that my partition table looks something like this:

DEVICE    DF 1-K Blcks
/dev/hda1 2775064
/dev/hda2 ~2GB (unmounted)
/dev/hda5 12839868
/dev/hdaX ~1GB (swap)

I ran gpart on the drive, and it said it found the following:
  Extended @ offset (4753mb)
  Linux Swap 1027mb @ 18049mb
The other values that gpart came up with for the primary
partitions were useless at best.

fdisk thinks my disk looks like this:
  /dev/hda h=255, s=63, c=2432
  units = cylinders of 16065 * 512 bytes

All of the data I want to recover is on hda5, which wasn't touched by
the "dd" command, but I've got to figure out where hda5 is on my disk.

My questions are:

1) Do utilities such as fdisk only write to the 1st 512 bytes of the
disk, or do they also write misc. info several GB into the disk for
extended partitions?  ie:  Will I be able to play guess and check games
with fdisk & fsck?

2) How do I compute the number of block that the partition takes from
the 1k-blocks from df?

Thanks for the help!

Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: DSKPROBE.zip
Type: application/x-zip-compressed
Size: 70426 bytes
Desc: not available
URL: <http://www.trilug.org/pipermail/trilug/attachments/20030516/19a1596b/attachment.bin>