here is a request for help on reclaiming an NTFS partition that has been corrupted. This is on a large hard drive in which I attempted to install a Mepis over an existing win2K partition, using a dual boot under grub. The grub script was written to hda's MBR.

Can anyone help ??

The lost NTFS partition is the first logical partition in the extended partition (hda5). Everything is on one drive. Mepis root is in hda6, which is the second logical partition right after it. In mepis, I used Qtparted to change the size of the hda5 partition. upon qtparted rewriting the partition table, immediately the NTFS partition stopped having its filesystem recognized. This is apparently a known bug in Qtparted under the 2.6 kernel, involvbing incorrect reporting of the partition offsets during resizing. The Mepis install was successful, but hda5 (non-boot) was fouled up, and the windows boot under grub failed. So I essentially have Mepis to try and recover the data on hda5 (hda1 is OK).

To follow is the dump from (a) cfdisk and (b) gpart. The partition I am trying to recover is in bold.

What I'd like to know from anyone out there is,

a) can you offer advice as to what strategy to take in re-partitioning hda5 to recover its filesystem?

b) what software do you suggest for doing this. I am leery of using gpart which is listed as being very experimental

Thanks for any help you can offer



root@0[~]# cfdisk /dev/hda -P s
Partition Table for /dev/hda

First Last
# Type Sector Sector Offset Length Filesystem Type (ID) Flag
-- ------- ----------- ----------- ------ ----------- -------------------- ----
1 Primary 0 51199154* 63 51199155*HPFS/NTFS (07) Boot
2 Primary 51199155* 234356219* 0 183157065*W95 Ext'd (LBA) (0F) None
5 Logical 51199155* 220020191 189# 168821037*HPFS/NTFS (07) None
Logical 220020192 221044381* 0 1024190*Free Space None
7 Logical 221044382* 222068447 1# 1024066*Linux swap (82) None
Logical 222068448 222068509* 0 62*Free Space None
6 Logical 222068510* 234355967 1# 12287458*Linux (83) None
Pri/Log 234355968 234374111 0 18144 Free Space None


root@0[~]#gpart /dev/hda -iv

Guessed primary partition table:
Primary partition(1)
type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
size: 24999mb #s(5119908 s(63-51199150)
chs: (0/1/1)-(1023/15/63)d (0/1/1)-(50792/12/59)r
hex: 00 01 01 00 07 0F FF FF 3F 00 00 00 70 3C 0D 03

Primary partition(2)
type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
size: 82428mb #s(168812544) s(51199218-220011761)
chs: (1023/15/63)-(1023/15/63)d (50792/14/1)-(218265/10/12)r
hex: 00 0F FF FF 07 0F FF FF F2 3C 0D 03 00 E0 0F 0A

Primary partition(3)
type: 131(0x83)(Linux ext2 filesystem)
size: 5999mb #s(12287456) s(220020255-232307710)
chs: (1023/15/63)-(1023/15/63)d (218274/1/1)-(230463/15/62)r
hex: 00 0F FF FF 83 0F FF FF 1F 3E 1D 0D E0 7D BB 00

Primary partition(4)
type: 130(0x82)(Linux swap or Solaris/x86)
size: 500mb #s(1024064) s(232307775-23333183
chs: (1023/15/63)-(1023/15/63)d (230464/1/1)-(231479/15/62)r
hex: 00 0F FF FF 82 0F FF FF 3F BC D8 0D 40 A0 0F 00

root@0[~]#

gpart's partition 2 is hda5, the corrupted NTFS partition, that can be seen but not mounted in Mepis. Note the large discrepancy in the sector map between gpart and fdisk. The tail end estimates disagree. But there are minor differences between all the sector estimates. Note that the offset is included in the gpart estimates of where the partitions separate.

I am leery of using gpart's rewriting of the partition except as a "last gasp".