Find the answer to your Linux question:
Results 1 to 9 of 9
I accidently zeroed out the first sector of the sda drive I had was going to wipe grub but forgot about the partition table needing to stay! I had an ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    Apr 2011
    Posts
    96

    partition problem


    I accidently zeroed out the first sector of the sda drive I had
    was going to wipe grub but forgot about the partition table needing to stay!

    I had an extended partition and 15 logical partitions in the drive (/dev/sda)
    Now my drive shows up as unallocated.

    I want to beable to recover this drive.
    I have tried part and gpart -W /dev/sda /dev/sda
    But it didn't help (it does show the extended partition but when I tried to recover it did not work).

    I am sure that nothing else other then the first sector was damaged/written to before I use these tools.

    I am in the process of trying testdisk and searching deep.
    The extended and all it's logical drives are ext4.

    If these tools don't work is their any way to manual search for the beginng of an ext4 partition. For example ntfs filesystems you can
    dd if=/dev/sdx/ | grep -a "NTFS" because each ntfs drive starts with the label NTFS on it's first partition sector (begining of filesystem).

    Not sure if their is a delimiter for ext2,3,4
    Also not sure if these software utilities like part , gpart , testdisk ,..etc support recovering ext4? (I know they say ext2/3 but 4?)

    Thanks for any help
    At the very least I would like to recover the 10th partition in the extended partition file /var/lib/tomcat6/webapps

  2. #2
    oz
    oz is offline
    forum.guy
    Join Date
    May 2004
    Location
    arch linux
    Posts
    18,733
    I think you are probably out of luck if Testdisk and/or Foremost can't recover your stuff:

    TestDisk - CGSecurity

    Foremost

    You can check the Testdisk FAQ for what it can and can't do:

    TestDisk FAQ - CGSecurity
    oz

  3. #3
    Just Joined!
    Join Date
    Apr 2011
    Posts
    96
    well I just did a deep search with testdisk on /dev/sda and it recovered one.
    That is when I do a ls -la /dev/sd*
    I get
    Code:
    brw-rw---- 1 root disk 8,  0 2011-12-01 18:42 /dev/sda
    brw-rw---- 1 root disk 8,  1 2011-12-01 20:39 /dev/sda1
    brw-rw---- 1 root disk 8,  5 2011-12-01 20:39 /dev/sda5
    in Nautilus I see one partition mounted and can easlly get files from/write to.
    However this is not the one I am manly concerned with , it's /dev/sda10 <--is the on I am looking for

    So I have sda1 which I am guessing is the extended , sda5 would be the first logical partition but where is my
    sda6 ,7,8,9,10,11,...etc partitions I had up to /dev/sda15.
    I would think the points are in linklist fashion so if I got the first partitions correct then the rest should show provided nothing touched these partitions? Is their away to specifically search for the begining of a partition using dd and grep for ext4 partition. If I can find the begining sectors I can just with a hexeditor manually add the correct LBA paritition location.

    Or at that point copy with dd into a file and mount the file

  4. #4
    Just Joined!
    Join Date
    Apr 2011
    Posts
    96
    Ok with testdisk I said yes to the VISTA partition search and it found all of them now when I do
    ls -la /dev/sda*
    I get

    Code:
    brw-rw---- 1 root disk 8,  0 2011-12-02 00:38 /dev/sda
    brw-rw---- 1 root disk 8,  1 2011-12-02 00:38 /dev/sda1
    brw-rw---- 1 root disk 8, 10 2011-12-02 00:38 /dev/sda10
    brw-rw---- 1 root disk 8, 11 2011-12-02 00:38 /dev/sda11
    brw-rw---- 1 root disk 8, 12 2011-12-02 00:38 /dev/sda12
    brw-rw---- 1 root disk 8,  2 2011-12-02 00:38 /dev/sda2
    brw-rw---- 1 root disk 8,  3 2011-12-02 00:38 /dev/sda3
    brw-rw---- 1 root disk 8,  4 2011-12-02 00:38 /dev/sda4
    brw-rw---- 1 root disk 8,  5 2011-12-02 00:38 /dev/sda5
    brw-rw---- 1 root disk 8,  6 2011-12-02 00:38 /dev/sda6
    brw-rw---- 1 root disk 8,  7 2011-12-02 00:38 /dev/sda7
    brw-rw---- 1 root disk 8,  8 2011-12-02 00:38 /dev/sda8
    brw-rw---- 1 root disk 8,  9 2011-12-02 00:38 /dev/sda9
    I found all the files I need and have everything I want I believe however
    When I open gparted gui tool to see the drive /dev/sda it shows unallocated ?
    (and it say's in the info cant have partition outside the disk)

    When I open nautlius I can easily traverse thru any partition of the /dev/sda drive and do anything with the folders and files on all my partitions again YES!!!!.

    How can I get gparted gui to show the partitions correctly for this drive again ? ( the inconsistencies make me uneasy). I am thinking the extended partition on the main sector one must have the wrong size for the ending of it. This is probably why gparted is reading this and seeing that it is bigger then the whole /dev/sda drive it self and giving an error. However I am not sure fully yet what the cause is I do know that the pointers for the linklist partition structure are correct though or I wouldn't beable to see all the files and partitions.
    Last edited by sam111; 12-02-2011 at 04:16 AM.

  5. #5
    Just Joined!
    Join Date
    Apr 2011
    Posts
    96
    well, with a little manipulation I was able to get testdisk to recover everything

    My only problem is now when I open gparted gui it says the drive is unallocated : info cant have partition outside the disk

    But when I open nautilus I can traverse thru any files on any of the recovered partitions. So everything is recovered and the partitions/filesystems are all working and their. As well as nautilus displaying all the drives correctly.

    Would be great to get gparted to display the partitions correctly again for this drive. Wonder what could be causing it?

  6. #6
    Linux Newbie reginaldperrin's Avatar
    Join Date
    Oct 2010
    Location
    Christchurch, New Zealand
    Posts
    122
    Sounds great that you have recovered everything.
    If you have recovered all your files to another disk, then just reformat the offending disk. If you haven't saved them to another, then do so first (obviously).
    Then just let Gparted do its stuff with the disk. This should put back in any unfortunately-deleted bits.

    Hope this helps.

  7. #7
    Administrator MikeTbob's Avatar
    Join Date
    Apr 2006
    Location
    Texas
    Posts
    7,864
    Glad you got it sorted to your liking. I know it's a tad late but I think it's worth repeating a thousand times if you have Important data you want to keep.
    BACKUPS BACKUPS BACKUPS!
    I do not respond to private messages asking for Linux help, Please keep it on the forums only.
    All new users please read this.** Forum FAQS. ** Adopt an unanswered post.

    I'd rather be lost at the lake than found at home.

  8. #8
    oz
    oz is offline
    forum.guy
    Join Date
    May 2004
    Location
    arch linux
    Posts
    18,733
    Quote Originally Posted by MikeTbob View Post
    I know it's a tad late but I think it's worth repeating a thousand times if you have Important data you want to keep.
    BACKUPS BACKUPS BACKUPS!
    I agree, and keep backups of my backups. Having them has paid off quite a few times over the years. It might take an hour or so each week to back it all up, but it would take several weeks to get back everything that's on those backups if it all had to be rebuilt from scratch.
    oz

  9. #9
    Just Joined!
    Join Date
    Apr 2011
    Posts
    96
    Sounds great that you have recovered everything.
    If you have recovered all your files to another disk, then just reformat the offending disk. If you haven't saved them to another, then do so first (obviously).
    Then just let Gparted do its stuff with the disk. This should put back in any unfortunately-deleted bits.
    Well , I kind of wanted to fix it totally with out having to repartition ,reformat , and reinstall the os.
    I have backed up everything I need. So I am wondering if their is away to fix it back to new without having to do the obvious and reinstall.

    Here is a hex dump of my first sector of my harddrive I believe I have only one 16byte partition entry in this 64byte partition table and it is this.
    Code:
    00 41 01 00 0f fe ff ff ff 0f - 00 00 83 88 70 74
    Correct me if I am wrong though.
    From this I see the 5th byte is 0f which is the partition type byte which indicates it is an extended partition (0x0f means extended with LBA addressing )
    Since it is an extented with LBA I would think the only thing gparted would look for is the last 8bytes begin correct (i.e where the LBA of the first partition begins and how long it is) All other bytes are just for the CHS data and seems like it would be over looked (i.e only looked at with gparted if the partition type was 0x05 extended partition with CHS addressing for really old HDD's )

    But maybe somebody see's something that would screw up gparted that I am missing
    It does hint that their is a size issue in gparted but the pointers to the link list of partitions must be correct though since if they weren't then I wouldn't beable to see all my partitions in nautlilus ?

    First sector
    Code:
    0x00000000: fc 31 c0 8e d0 31 e4 8e - d8 8e c0 be 00 7c bf 00 .1..1....@|.@
    0x00000010: 06 b9 00 01 f3 a5 be ee - 07 b0 08 ea 20 06 00 00 F.@A���G.H. F@@
    0x00000020: 80 3e b3 07 ff 75 04 88 - 16 b3 07 80 3c 00 74 04 .>.G.uD.V.G.<@tD
    0x00000030: 08 06 af 07 83 ee 10 d0 - e8 73 f0 90 90 90 90 90 HF.G..P��s......
    0x00000040: 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 90 90 ................
    0x00000050: 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 90 90 ................
    0x00000060: 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 90 90 ................
    0x00000070: 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 be be ..............��
    0x00000080: 07 b0 00 b9 04 00 80 3c - 00 75 6e fe c0 83 c6 10 G.@.D@.<@un�..P
    0x00000090: e2 f4 31 db b4 0e be 9d - 07 8a 0e af 07 ac d0 e9 ��1۴N..G.N.G�.
    0x000000a0: 73 02 cd 10 08 c9 75 f5 - b0 3a cd 10 31 c0 cd 16 sB.PH.u��.P�V
    0x000000b0: 3c 00 74 f8 be 8b 07 b9 - 02 00 e8 ba 00 3c 0d 74 @t.G.B@@<Mt
    0x000000c0: b4 3c 61 72 06 3c 7a 77 - 02 2c 20 88 c3 be 9d 07 .<arF<zwB, ..G
    0x000000d0: 8a 0e af 07 ac d0 e9 73 - 04 38 c3 74 06 08 c9 75 .N.G�.sD.tFH.u
    0x000000e0: f3 eb af b8 0d 0e 31 db - cd 10 8d 84 62 00 3c 07 �미MN�P..b@<G
    0x000000f0: 75 07 b0 1f a2 af 07 eb - 99 31 d2 b9 01 00 3c 04 uG._��G..1ҹA@<D
    0x00000100: 74 11 73 f3 30 e4 b1 04 - d2 e0 be be 07 01 c6 8a tQs.0D�྾GA..
    0x00000110: 16 b3 07 bf 05 00 56 f6 - c2 80 74 31 b4 41 bb aa V.G.E@V�.t1.A��
    0x00000120: 55 52 cd 13 5a 5e 56 72 - 1e 81 fb 55 aa 75 18 f6 UR.SZ^Vr^..U.uX�
    0x00000130: c1 01 74 13 8b 44 08 8b - 5c 0a be 8d 07 89 44 08 .AtS.DH.\J..G.DH
    0x00000140: 89 5c 0a b4 42 eb 0c 8a - 74 01 8b 4c 02 b8 01 02 .\J.B.L.tA.LB.AB
    0x00000150: bb 00 7c 50 c6 06 8f 07 - 01 cd 13 58 5e 73 05 4f .@|P.F.GA.SX^sEO
    0x00000160: 75 b4 eb 93 81 3e fe 7d - 55 aa 75 f6 ea 00 7c 00 u�..>.}U.u�@|@
    0x00000170: 00 be 83 07 b9 0a 00 50 - b4 0e 31 db ac cd 10 e2 @..G.J@P.N۬.P�
    0x00000180: fb 58 c3 54 65 73 74 44 - 69 73 6b 0d 0a 10 00 01 ..estiskMJP@A
    0x00000190: 00 00 7c 00 00 00 00 00 - 00 00 00 00 00 31 32 33 @@|@@@@@@@@@@123
    0x000001a0: 34 46 00 00 41 4e 44 54 - 6d 62 72 00 02 02 02 1f 4F@@ANDTmbr@BBB_
    0x000001b0: c7 00 00 80 00 00 00 00 - 00 00 00 00 a5 01 00 41 .@@.@@@@@@@@.A@A
    0x000001c0: 01 00 0f fe ff ff ff 0f - 00 00 83 88 70 74 00 00 A@O....O@@..pt@@
    0x000001d0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 @@@@@@@@@@@@@@@@
    0x000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 @@@@@@@@@@@@@@@@
    0x000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 55 aa @@@@@@@@@@@@@@U.
    I don't thing the first byte weather it being 0x00 not-bootable or 0x80 bootable would make any difference in gparted displaying it correctly but I can change this or any other bytes if somebody sees a problem.

    Here is the partition entry structure I am looking at
    Master boot record - Wikipedia, the free encyclopedia

    Thanks for any help with this one the HDD size is 1TB
    Last edited by sam111; 12-03-2011 at 06:54 AM.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •