Find the answer to your Linux question:
Results 1 to 10 of 10
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1

    PARTITION TABLE TOASTED - NEED help recovering data!!!

    Long story really short - this involves a windoze install on a new 2nd hardrive!!!

    OK! Stop laughing! Imagine me crying right now!

    I just bought a second harddrive so I could safely keep windoze segregated from my SuSE 9.0 distro on HDA. I even did a backup of /home to a separate partition I keep for backups only. Unfortunately I didn't burn cd's of it this time. I knew better. Every time I get mixed up with mickeysoft, it's usually very painful!

    I created a new partition on HDB for the windows install, but it didn't like that one, and proceeded to rewrite the partition table on HDA prior to install. The new partition table took the first 13-14MB of HDA (which includes /boot, swap, and part of /) and left the remainder unallocated and unformatted.

    Here's where I may have really screwed up: I didn't have the specific number of cylinders recorded for each of my old partitions, just size in MB and GB. I created a new primary partition on HDA slightly larger than my old 'backup' partition (It was the last partition on HDA, so I worked backward). I wasn't able to mount this partition, so I used reiserfsck. I was told that I had a bad superblock and to do --rebuild-sb. No luck! Told to use --rebuild-sb --no-journal-available. Still no luck!

    I thought I'd better stop there before I really toast the data, If I haven't already done that.

    My last hard backup was 4/30, so I've got 2 months worth of files from 3 users that disappear if I can't recover.



    -I'm doing a dd_rescue of this new (hopefully old) partition, to a file in /home on HDB, in hopes of being able to recover it, and prevent any more of my recovery attemps from messing with this data. Never used it before, so I'm not too sure of what I will find.

  2. #2
    Linux Guru
    Join Date
    Oct 2001
    Täby, Sweden
    Well, as long as you haven't toasted the data (dunno what reiserfsck might have done), it should be possible, and relatively easy to find it.

    I don't know the exact format of the ReiserFS superblock, but it ought to be easy to find out from the kernel source. Then you could just build a simple C program that reads a block at a time from that partition and finds out where the superblock is, and that will be the start of the old partition. Then you should just be able to dd the rest of the partition into a file and mount that with a loopback device.

    I dunno how savvy you are with programming, though - reply back if you need help with anything in particular.

  3. #3
    reiserfsck didn't do anything to it. It wasn't able to find the journal or a superblock, and I didn't want to create new ones. At present, I can't mount the new(old) partition, yet I was able to do a dd_rescue copy of it (all 29GB) to a file. How can I mount the file as a loopback device???

    I got a "C" in C programming about 7 years ago, but if that is what it takes, I'll jump in again. If I can just mount the file, that would be much nicer for me!



  4. $spacer_open
  5. #4
    Linux Guru
    Join Date
    Oct 2001
    Täby, Sweden
    Well, the mounting subsystem can only take block devices (since all filesystem drivers operate directly on block caches), so you can't mount ordinary files.

    That's where the loopback device (/dev/loop0 - /dev/loop7) comes in - you call losetup on it and give it a file (see the losetup manpage), and that loopback device will mirror the file (by reorganizing the file's own block caches), so that you can mount it.

    Your problem is, of course (or at least so I guess, please tell me if I got it wrong), that the file includes garbage at the beginning, since you made the partition you copied it from start ahead of the real superblock, right? That's why you need to create this program that reads a sector at a time (a block is 512 bytes) until it finds the real superblock. The program would look at each sector it reads and see if it can be a reiserfs superblock, and if so, strip all the sectors from the start of the file until that sector. That way, you would have the original partition image just as it once started ready to be mounted.

    At least that's the thought - I can't see any reason why it shouldn't work. =)

  6. #5
    Linux Guru
    Join Date
    Oct 2001
    Täby, Sweden
    I looked at the ReiserFS format in the kernel source (see include/linux/reiserfs_fs.h), and here's a sample program that I think should work to find the starting sector of the filesystem inside your rescued file. I haven't tried it of course (I don't really have anything to try it on... =) ), but try and see if it works. It won't destroy the file, at least.
    #include <unistd.h>
    #include <stdio.h>
    #include <stdlib.h>
    #include <fcntl.h>
    #include <string.h>
    int main&#40;int argc, char **argv&#41;
        int fd, secnum;
        char buf&#91;512&#93;;
        if&#40;argc < 2&#41;
            printf&#40;"call as %s reiserfs-file\n", argv&#91;0&#93;&#41;;
        if&#40;&#40;fd = open&#40;argv&#91;1&#93;, O_RDONLY&#41;&#41; < 0&#41;
        secnum = 0;
        setvbuf&#40;stdout, NULL, _IONBF, 0&#41;;
            if&#40;read&#40;fd, buf, 512&#41; != 512&#41;
                fprintf&#40;stderr, "could not read 512 complete bytes at sector %i!\n", secnum&#41;;
            if&#40;&#40;secnum % 128&#41; == 0&#41;
                printf&#40;"\033&#91;1G\033&#91;KChecking sector %i...", secnum&#41;;
            if&#40;!memcmp&#40;buf + 52, "ReIsEr", 6&#41;&#41;
                printf&#40;"\nPotential ReiserFS superblock found in sector %i &#40;version&#58; %c&#41;\n", secnum, buf&#91;58&#93;&#41;;

  7. #6
    Linux Guru
    Join Date
    Oct 2001
    Täby, Sweden
    Some notes... I just tried it out on a real ReiserFS partition, and it seems there some things that you should note:

    1. ReiserFS seems to keep backup superblocks. This means you'll get lots of output once it starts reading the actual filesystem. You will probably want to pipe it to head or something.
    2. It seems the first superblock is really in sector 128. This means that the actual filesystem will begin 65536 bytes before that sector.
    3. Note that it outputs sector numbers, not byte numbers. Again, each sector is 512 bytes.

  8. #7
    I tried the losetup and successfully associated loop0 with the file. Mount command still states a bad superblock. "mkfs -t reiserfs" wants to format the file. (the old partition was reiser, and so when I made the new one, I made it reiser also)

    I thought about making a blank file, creating the reiserfs on it, then running dd_rescue on the new(old) partition with the output as that file. In just trying it, it says that the device does not contain enough blocks, and I'm not able to force the blocks. I'll have to think about this. Could I overwrite the reiserfs formatted file, or send the output of dd_rescue to the loop device directly?!?

    About the program: as I said, it's been over 7 years since I printed "hello" using C in unix. You'll need to walk me through it. Although I'm not sure I'll need it. My /home and /backup partitions were back to back at the end of HDA. So I have a few cylinders of my old /home along with all of my old /backup.

    Two things:

    I don't have the space to keep multiple copies of the partition (only 60 GB on HDB), and it takes a long time to copy it once (it's 29GB) before testing each theory.

    I'm leaving for a week on Friday, and have limited time tomorrow to work on this. So you know if you don't hear from me, it's because I physically can't respond to your posts. I'm definitely not ignoring you.

    Thanks much for all your help! I certainly appreciate it!


  9. #8
    Linux Guru
    Join Date
    Oct 2001
    Täby, Sweden
    I didn't mean for losetup to work immediately. It would be surprising if it did, since, like you stated yourself, you still have some garbage cylinders in front of the real filesystem of that file, so the filesystem driver won't be able to find the actual filesystem. The loopback device is just useful in order to be able to mount a file instead of dealing with the physical partitions.

    That's what the program is for - it will try and find the actual start of the filesystem, and then it will be fairly easy to just strip the garbage away from the beginning of the file.

    So just copy that program into a text file, and compile it with gcc. That will produce a file call a.out, which will be the actual program. Run it like this:
    ./a.out /path/to/the/backupfile | head
    It will begin searching for the start of the filesystem. Depending on how much garbage is in the beginning and the speed of your hard drive, it might take some time for it to find it, but it will print some nice output for you so that you can see its progress. =)

    If you don't know how to interpret its output and what to do in the end, just post the output back here and I'll do my best to help you. I've been in a hard drive crash myself, so I know very well the pain of losing one's data.

  10. #9
    Just Joined!
    Join Date
    Jul 2004

    Recover deleted partition table and more

    Hello. While I'm really ashamed of the boo-boo I did, I'm quite proud of getting out unharmed. I found this post while looking for a solution (couldn't find one). Here how I recovered from a deleted partition table, together with the first 32MB of my notebook's hard disk (7 partitions, hda1 being Windows).

    Boo-boo: While trying to investigate why a 32MB USB pen drive couldn't be formatted, I wanted to wipe it out with "dd if=/dev/zero of=/dev/sda bs=1024k count=32". Needless to say I typed /dev/hda instead and killed the first 32MB of data on my hard drive. (funny, the pendrive LED is not lighting... ESC-k, enter, ESC-k, enter, ESC-k, enter... WHATTHE*****!).

    Scenario: Company's notebook with Windows XP on hda1 (NTFS), containing LOTS of important stuff, and debian linux on other partitions. The boo-boo was made at the console (no X started), at home, on my first day of a 15-day vacation. The windows partition was already mounted read-only. Because I hosed the hda, and all partitions were already mounted, I knew I could still work as long as I didn't reboot. I was aware that probably the primary NTFS 'superblock', the windows boot stuff, and possibly some files were hosed on that first 32MB too, but actual data was far from that. My USB floppy drive was at the office, but I can boot from CD.

    When I realized what I had done, I immediatelly plugged the power supply (if the computer turned off, there would be no boot), plugged it on my home network, mounted a desktop disk via NFS and backed up all my windows partition data.

    /proc/partitions still showed my partitions information, and df also showed sizes, but "*fdisk -l" weren't able to identify anything on the disk. I was not sure if the information from /proc/partitions or mount would be exact-to-the-byte enough to rebuild the partition (no start points, for starters).

    sfdisk -V, testdisk, and gpart didn't work (maybe due to the partitions being mounted, but I wouldn't umount them!).

    After MANY attempts to find a magic comand that would make *fdisk read the partition table from memory and record it back to the disk, I gave up and decided I would have to build it by hand.

    I found that "sfdisk -d /dev/hdaX" will inform the start cylinder of partition X on the error message. By comparing that to my desktop's partition, I found that primary partitions end 1 cylinder before the start of the next one, and logical partitions ended 64 cylinders before the next one. So there you have it: I had the start and end cylinders for all my original partitions. I used that command to get all partitions start points.

    I used "fdisk -u" to be able to enter data in cylinder units and added the partitions back. Set the NTFS partition to type to "7", swap to "82", and linux to "83", crossed my fingers and hit "w".

    Then I ran grub --no-floppy, root (hd0,1), setup (hd0) to get a bootable hda back. Crossed all my 20 fingers, and rebooted.


    Windows of course didn't (not Window's fault; but it was hda1...).

    I then booted the notebook from a Windows XP installation CD, and hit R to get the recovery shell. On the first time, it didn't even find a valid c:. CHKDISK didn't work, nor did BOOTCFG. I used the FIXBOOT C: command, and rebooted from the CD. Do not use FIXMBR, or I suppose your Grub will be gone.

    Now the recovery process found a c:\WINDOWS installation and asked me to type the admin password to log on to it (took me a while to remember it, but I got in). My dear data was there! Snif, snif. Rebooted to the HD's grub prompt and asked for Windows.

    Windows said it didn't boot the last time and asked to load the last good configuration (I guess I could have asked "normal boot" here, but I didn't dare to).

    WINDOWS STARTED! Never thought I'd be so happy to see that happening.

    I right-clicked C: and asked for a disk check, which failed on phase 2 (no panic, it sometimes just schedule a scan for the next boot). Then I started Partition Magic 7, just in case. It complained and fixed some CHS stuff on the partition table (including linux). I don't think that was necessary, but I let it do it (now it's linux fdisk who complains that "Partition 1 does not end on cylinder boundary.", which it didn't before PM7 did its "magic", but that's Ok.

    Rebooted, asked for Windows on the grub screen, and got the automatic scandisk scheduled by windows. It found some problems, and fixed it (I guess it fixed the primary 'superblock', from the copies).

    In the end it was REALLY FUN! No data loss, and more adrenaline hit than when I bungee-jumped from 130m.

    Here's my partition info now (note that the boundary stuff showed up after PM7 was used - I didn't have it before with my 'handmade' partition table, nor before the 'accident', but I suppose PM7 knows how Windows likes it, so I'll leave it like this):

    delta:/home/jsveiga# fdisk -ul /dev/hda
    Disk /dev/hda: 60.0 GB, 60011642880 bytes
    16 heads, 63 sectors/track, 116280 cylinders, total 117210240 sectors
    Units = sectors of 1 * 512 = 512 bytes

    Device Boot Start End Blocks Id System
    /dev/hda1 * 63 102398309 51199123+ 7 HPFS/NTFS
    Partition 1 does not end on cylinder boundary.
    /dev/hda2 102398310 102687479 144585 83 Linux
    /dev/hda3 102687480 103073039 192780 83 Linux
    /dev/hda4 103073040 117210239 7068600 5 Extended
    /dev/hda5 103073103 103458599 192748+ 82 Linux swap
    /dev/hda6 103458663 108342359 2441848+ 83 Linux
    /dev/hda7 108342423 117210239 4433908+ 83 Linux

    So here it is; I hope this helps more people. I'm making a t-shirt:
    "I dd if=/dev/zero of=/dev/hda bs=1024k count=32, and survived!".

    Osmar, if you are reading this, I'll still try to fix your pendrive, and If I do it, by golly I'll KEEP IT!

    I'll try count=64 next time. Anyone knows what generally is on the first 32MB of a Windows XP partition? I'm wondering if actual files were harmed, or if it was all 'superblock' info (since that partition is quite big at 49GB).

    Joao S Veiga

  11. #10
    Thanks everyone for all your help!

    Apparently my vacation was much needed! My head was much clearer when I returned. I wound up finding a repair feature on the install disk for my distro. I played around with the partitioner. That in combination with my sparse notes from when I originally partitioned did the trick.

    I dumped the new windoze forced partition table altogether. There was a function which 'kind of' found my old partition table. It actually found my old boot, swap and root partitions, and it repaired root. These were primary partitions. It did not find or repair my extended or logical partitions. Restoring my extended partition was easy, seeing as how it began the cylinder after the repaired root partition and filled the rest of the drive. I then used my notes, of which I had written down MB and GB sizes of the logical partitions. I had to play around with their sizes. In using reiserfsck with these 'assumed'partitions, I was told that the first one was too small, which I enlarged by 100 cylinders at a time, until it was large enough (according to reiserfsck), then carried it down by 10's and 1's until I had the right size. I then did this with the others, until I was done.

    I had a functioning distro on my other drive, so I booted that up, mounted my old partitions, grabbed my files, and backed them up to cd. The boot partition, and my backup partition were really toasted because windoze overwrote boot when trying to install, and my first attempts to save my backup partition went south.

    Again, thanks everyone!!!


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts