PARTITION TABLE TOASTED - NEED help recovering data!!!
Long story really short - this involves a windoze install on a new 2nd hardrive!!!
OK! Stop laughing! Imagine me crying right now!
I just bought a second harddrive so I could safely keep windoze segregated from my SuSE 9.0 distro on HDA. I even did a backup of /home to a separate partition I keep for backups only. Unfortunately I didn't burn cd's of it this time. I knew better. Every time I get mixed up with mickeysoft, it's usually very painful!
I created a new partition on HDB for the windows install, but it didn't like that one, and proceeded to rewrite the partition table on HDA prior to install. The new partition table took the first 13-14MB of HDA (which includes /boot, swap, and part of /) and left the remainder unallocated and unformatted.
Here's where I may have really screwed up: I didn't have the specific number of cylinders recorded for each of my old partitions, just size in MB and GB. I created a new primary partition on HDA slightly larger than my old 'backup' partition (It was the last partition on HDA, so I worked backward). I wasn't able to mount this partition, so I used reiserfsck. I was told that I had a bad superblock and to do --rebuild-sb. No luck! Told to use --rebuild-sb --no-journal-available. Still no luck!
I thought I'd better stop there before I really toast the data, If I haven't already done that.
My last hard backup was 4/30, so I've got 2 months worth of files from 3 users that disappear if I can't recover.
-I'm doing a dd_rescue of this new (hopefully old) partition, to a file in /home on HDB, in hopes of being able to recover it, and prevent any more of my recovery attemps from messing with this data. Never used it before, so I'm not too sure of what I will find.
Recover deleted partition table and more
Hello. While I'm really ashamed of the boo-boo I did, I'm quite proud of getting out unharmed. I found this post while looking for a solution (couldn't find one). Here how I recovered from a deleted partition table, together with the first 32MB of my notebook's hard disk (7 partitions, hda1 being Windows).
Boo-boo: While trying to investigate why a 32MB USB pen drive couldn't be formatted, I wanted to wipe it out with "dd if=/dev/zero of=/dev/sda bs=1024k count=32". Needless to say I typed /dev/hda instead and killed the first 32MB of data on my hard drive. (funny, the pendrive LED is not lighting... ESC-k, enter, ESC-k, enter, ESC-k, enter... WHATTHE*****!).
Scenario: Company's notebook with Windows XP on hda1 (NTFS), containing LOTS of important stuff, and debian linux on other partitions. The boo-boo was made at the console (no X started), at home, on my first day of a 15-day vacation. The windows partition was already mounted read-only. Because I hosed the hda, and all partitions were already mounted, I knew I could still work as long as I didn't reboot. I was aware that probably the primary NTFS 'superblock', the windows boot stuff, and possibly some files were hosed on that first 32MB too, but actual data was far from that. My USB floppy drive was at the office, but I can boot from CD.
When I realized what I had done, I immediatelly plugged the power supply (if the computer turned off, there would be no boot), plugged it on my home network, mounted a desktop disk via NFS and backed up all my windows partition data.
/proc/partitions still showed my partitions information, and df also showed sizes, but "*fdisk -l" weren't able to identify anything on the disk. I was not sure if the information from /proc/partitions or mount would be exact-to-the-byte enough to rebuild the partition (no start points, for starters).
sfdisk -V, testdisk, and gpart didn't work (maybe due to the partitions being mounted, but I wouldn't umount them!).
After MANY attempts to find a magic comand that would make *fdisk read the partition table from memory and record it back to the disk, I gave up and decided I would have to build it by hand.
I found that "sfdisk -d /dev/hdaX" will inform the start cylinder of partition X on the error message. By comparing that to my desktop's partition, I found that primary partitions end 1 cylinder before the start of the next one, and logical partitions ended 64 cylinders before the next one. So there you have it: I had the start and end cylinders for all my original partitions. I used that command to get all partitions start points.
I used "fdisk -u" to be able to enter data in cylinder units and added the partitions back. Set the NTFS partition to type to "7", swap to "82", and linux to "83", crossed my fingers and hit "w".
Then I ran grub --no-floppy, root (hd0,1), setup (hd0) to get a bootable hda back. Crossed all my 20 fingers, and rebooted.
LINUX WAS UP AND RUNNING!
Windows of course didn't (not Window's fault; but it was hda1...).
I then booted the notebook from a Windows XP installation CD, and hit R to get the recovery shell. On the first time, it didn't even find a valid c:. CHKDISK didn't work, nor did BOOTCFG. I used the FIXBOOT C: command, and rebooted from the CD. Do not use FIXMBR, or I suppose your Grub will be gone.
Now the recovery process found a c:\WINDOWS installation and asked me to type the admin password to log on to it (took me a while to remember it, but I got in). My dear data was there! Snif, snif. Rebooted to the HD's grub prompt and asked for Windows.
Windows said it didn't boot the last time and asked to load the last good configuration (I guess I could have asked "normal boot" here, but I didn't dare to).
WINDOWS STARTED! Never thought I'd be so happy to see that happening.
I right-clicked C: and asked for a disk check, which failed on phase 2 (no panic, it sometimes just schedule a scan for the next boot). Then I started Partition Magic 7, just in case. It complained and fixed some CHS stuff on the partition table (including linux). I don't think that was necessary, but I let it do it (now it's linux fdisk who complains that "Partition 1 does not end on cylinder boundary.", which it didn't before PM7 did its "magic", but that's Ok.
Rebooted, asked for Windows on the grub screen, and got the automatic scandisk scheduled by windows. It found some problems, and fixed it (I guess it fixed the primary 'superblock', from the copies).
In the end it was REALLY FUN! No data loss, and more adrenaline hit than when I bungee-jumped from 130m.
Here's my partition info now (note that the boundary stuff showed up after PM7 was used - I didn't have it before with my 'handmade' partition table, nor before the 'accident', but I suppose PM7 knows how Windows likes it, so I'll leave it like this):
delta:/home/jsveiga# fdisk -ul /dev/hda
Disk /dev/hda: 60.0 GB, 60011642880 bytes
16 heads, 63 sectors/track, 116280 cylinders, total 117210240 sectors
Units = sectors of 1 * 512 = 512 bytes
Device Boot Start End Blocks Id System
/dev/hda1 * 63 102398309 51199123+ 7 HPFS/NTFS
Partition 1 does not end on cylinder boundary.
/dev/hda2 102398310 102687479 144585 83 Linux
/dev/hda3 102687480 103073039 192780 83 Linux
/dev/hda4 103073040 117210239 7068600 5 Extended
/dev/hda5 103073103 103458599 192748+ 82 Linux swap
/dev/hda6 103458663 108342359 2441848+ 83 Linux
/dev/hda7 108342423 117210239 4433908+ 83 Linux
So here it is; I hope this helps more people. I'm making a t-shirt:
"I dd if=/dev/zero of=/dev/hda bs=1024k count=32, and survived!".
Osmar, if you are reading this, I'll still try to fix your pendrive, and If I do it, by golly I'll KEEP IT!
I'll try count=64 next time. Anyone knows what generally is on the first 32MB of a Windows XP partition? I'm wondering if actual files were harmed, or if it was all 'superblock' info (since that partition is quite big at 49GB).
Joao S Veiga