partition problem

[sam111]

I accidently zeroed out the first sector of the sda drive I had
was going to wipe grub but forgot about the partition table needing to stay!

I had an extended partition and 15 logical partitions in the drive (/dev/sda)
Now my drive shows up as unallocated.

I want to beable to recover this drive.
I have tried part and gpart -W /dev/sda /dev/sda
But it didn't help (it does show the extended partition but when I tried to recover it did not work).

I am sure that nothing else other then the first sector was damaged/written to before I use these tools.

I am in the process of trying testdisk and searching deep.
The extended and all it's logical drives are ext4.

If these tools don't work is their any way to manual search for the beginng of an ext4 partition. For example ntfs filesystems you can
dd if=/dev/sdx/ | grep -a "NTFS" because each ntfs drive starts with the label NTFS on it's first partition sector (begining of filesystem).

Not sure if their is a delimiter for ext2,3,4
Also not sure if these software utilities like part , gpart , testdisk ,..etc support recovering ext4? (I know they say ext2/3 but 4?)

Thanks for any help
At the very least I would like to recover the 10th partition in the extended partition file /var/lib/tomcat6/webapps

[oz]

I think you are probably out of luck if Testdisk and/or Foremost can't recover your stuff:

TestDisk - CGSecurity

Foremost

You can check the Testdisk FAQ for what it can and can't do:

TestDisk FAQ - CGSecurity

[sam111]

well I just did a deep search with testdisk on /dev/sda and it recovered one.
That is when I do a ls -la /dev/sd*
I get

brw-rw---- 1 root disk 8,  0 2011-12-01 18:42 /dev/sda
brw-rw---- 1 root disk 8,  1 2011-12-01 20:39 /dev/sda1
brw-rw---- 1 root disk 8,  5 2011-12-01 20:39 /dev/sda5

in Nautilus I see one partition mounted and can easlly get files from/write to.
However this is not the one I am manly concerned with , it's /dev/sda10 <--is the on I am looking for

So I have sda1 which I am guessing is the extended , sda5 would be the first logical partition but where is my
sda6 ,7,8,9,10,11,...etc partitions I had up to /dev/sda15.
I would think the points are in linklist fashion so if I got the first partitions correct then the rest should show provided nothing touched these partitions? Is their away to specifically search for the begining of a partition using dd and grep for ext4 partition. If I can find the begining sectors I can just with a hexeditor manually add the correct LBA paritition location.

Or at that point copy with dd into a file and mount the file

[sam111]

Ok with testdisk I said yes to the VISTA partition search and it found all of them now when I do
ls -la /dev/sda*
I get

brw-rw---- 1 root disk 8,  0 2011-12-02 00:38 /dev/sda
brw-rw---- 1 root disk 8,  1 2011-12-02 00:38 /dev/sda1
brw-rw---- 1 root disk 8, 10 2011-12-02 00:38 /dev/sda10
brw-rw---- 1 root disk 8, 11 2011-12-02 00:38 /dev/sda11
brw-rw---- 1 root disk 8, 12 2011-12-02 00:38 /dev/sda12
brw-rw---- 1 root disk 8,  2 2011-12-02 00:38 /dev/sda2
brw-rw---- 1 root disk 8,  3 2011-12-02 00:38 /dev/sda3
brw-rw---- 1 root disk 8,  4 2011-12-02 00:38 /dev/sda4
brw-rw---- 1 root disk 8,  5 2011-12-02 00:38 /dev/sda5
brw-rw---- 1 root disk 8,  6 2011-12-02 00:38 /dev/sda6
brw-rw---- 1 root disk 8,  7 2011-12-02 00:38 /dev/sda7
brw-rw---- 1 root disk 8,  8 2011-12-02 00:38 /dev/sda8
brw-rw---- 1 root disk 8,  9 2011-12-02 00:38 /dev/sda9

I found all the files I need and have everything I want I believe however
When I open gparted gui tool to see the drive /dev/sda it shows unallocated ?
(and it say's in the info cant have partition outside the disk)

When I open nautlius I can easily traverse thru any partition of the /dev/sda drive and do anything with the folders and files on all my partitions again YES!!!!.

How can I get gparted gui to show the partitions correctly for this drive again ? ( the inconsistencies make me uneasy). I am thinking the extended partition on the main sector one must have the wrong size for the ending of it. This is probably why gparted is reading this and seeing that it is bigger then the whole /dev/sda drive it self and giving an error. However I am not sure fully yet what the cause is I do know that the pointers for the linklist partition structure are correct though or I wouldn't beable to see all the files and partitions.

[sam111]

well, with a little manipulation I was able to get testdisk to recover everything

My only problem is now when I open gparted gui it says the drive is unallocated : info cant have partition outside the disk

But when I open nautilus I can traverse thru any files on any of the recovered partitions. So everything is recovered and the partitions/filesystems are all working and their. As well as nautilus displaying all the drives correctly.

Would be great to get gparted to display the partitions correctly again for this drive. Wonder what could be causing it?

[reginaldperrin]

Sounds great that you have recovered everything.
If you have recovered all your files to another disk, then just reformat the offending disk. If you haven't saved them to another, then do so first (obviously).
Then just let Gparted do its stuff with the disk. This should put back in any unfortunately-deleted bits.

Hope this helps.

[MikeTbob]

Glad you got it sorted to your liking. I know it's a tad late but I think it's worth repeating a thousand times if you have Important data you want to keep.
BACKUPS BACKUPS BACKUPS!

[oz]

I know it's a tad late but I think it's worth repeating a thousand times if you have Important data you want to keep.
BACKUPS BACKUPS BACKUPS!

I agree, and keep backups of my backups. Having them has paid off quite a few times over the years. It might take an hour or so each week to back it all up, but it would take several weeks to get back everything that's on those backups if it all had to be rebuilt from scratch.

[sam111]

Sounds great that you have recovered everything.
If you have recovered all your files to another disk, then just reformat the offending disk. If you haven't saved them to another, then do so first (obviously).
Then just let Gparted do its stuff with the disk. This should put back in any unfortunately-deleted bits.

Well , I kind of wanted to fix it totally with out having to repartition ,reformat , and reinstall the os.
I have backed up everything I need. So I am wondering if their is away to fix it back to new without having to do the obvious and reinstall.

Here is a hex dump of my first sector of my harddrive I believe I have only one 16byte partition entry in this 64byte partition table and it is this.

00 41 01 00 0f fe ff ff ff 0f - 00 00 83 88 70 74

Correct me if I am wrong though.
From this I see the 5th byte is 0f which is the partition type byte which indicates it is an extended partition (0x0f means extended with LBA addressing )
Since it is an extented with LBA I would think the only thing gparted would look for is the last 8bytes begin correct (i.e where the LBA of the first partition begins and how long it is) All other bytes are just for the CHS data and seems like it would be over looked (i.e only looked at with gparted if the partition type was 0x05 extended partition with CHS addressing for really old HDD's )

But maybe somebody see's something that would screw up gparted that I am missing
It does hint that their is a size issue in gparted but the pointers to the link list of partitions must be correct though since if they weren't then I wouldn't beable to see all my partitions in nautlilus ?

First sector

0x00000000: fc 31 c0 8e d0 31 e4 8e - d8 8e c0 be 00 7c bf 00 .1..1....@|.@
0x00000010: 06 b9 00 01 f3 a5 be ee - 07 b0 08 ea 20 06 00 00 F.@A���G.H. F@@
0x00000020: 80 3e b3 07 ff 75 04 88 - 16 b3 07 80 3c 00 74 04 .>.G.uD.V.G.<@tD
0x00000030: 08 06 af 07 83 ee 10 d0 - e8 73 f0 90 90 90 90 90 HF.G..P��s......
0x00000040: 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 90 90 ................
0x00000050: 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 90 90 ................
0x00000060: 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 90 90 ................
0x00000070: 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 be be ..............��
0x00000080: 07 b0 00 b9 04 00 80 3c - 00 75 6e fe c0 83 c6 10 G.@.D@.<@un�..P
0x00000090: e2 f4 31 db b4 0e be 9d - 07 8a 0e af 07 ac d0 e9 ��1۴N..G.N.G�.
0x000000a0: 73 02 cd 10 08 c9 75 f5 - b0 3a cd 10 31 c0 cd 16 sB.PH.u��.P�V
0x000000b0: 3c 00 74 f8 be 8b 07 b9 - 02 00 e8 ba 00 3c 0d 74 @t.G.B@@<Mt
0x000000c0: b4 3c 61 72 06 3c 7a 77 - 02 2c 20 88 c3 be 9d 07 .<arF<zwB, .þ.G
0x000000d0: 8a 0e af 07 ac d0 e9 73 - 04 38 c3 74 06 08 c9 75 .N.G�.sD.tFH.u
0x000000e0: f3 eb af b8 0d 0e 31 db - cd 10 8d 84 62 00 3c 07 �미MN�P..b@<G
0x000000f0: 75 07 b0 1f a2 af 07 eb - 99 31 d2 b9 01 00 3c 04 uG._��G..1ҹA@<D
0x00000100: 74 11 73 f3 30 e4 b1 04 - d2 e0 be be 07 01 c6 8a tQs.0D�྾GA..
0x00000110: 16 b3 07 bf 05 00 56 f6 - c2 80 74 31 b4 41 bb aa V.G.E@V�.t1.A��
0x00000120: 55 52 cd 13 5a 5e 56 72 - 1e 81 fb 55 aa 75 18 f6 UR.SZ^Vr^..U.uX�
0x00000130: c1 01 74 13 8b 44 08 8b - 5c 0a be 8d 07 89 44 08 .AtS.DH.\J..G.DH
0x00000140: 89 5c 0a b4 42 eb 0c 8a - 74 01 8b 4c 02 b8 01 02 .\J.B.L.tA.LB.AB
0x00000150: bb 00 7c 50 c6 06 8f 07 - 01 cd 13 58 5e 73 05 4f .@|P.F.GA.SX^sEO
0x00000160: 75 b4 eb 93 81 3e fe 7d - 55 aa 75 f6 ea 00 7c 00 u�..>.}U.u�@|@
0x00000170: 00 be 83 07 b9 0a 00 50 - b4 0e 31 db ac cd 10 e2 @..G.J@P.N۬.P�
0x00000180: fb 58 c3 54 65 73 74 44 - 69 73 6b 0d 0a 10 00 01 ..estiskMJP@A
0x00000190: 00 00 7c 00 00 00 00 00 - 00 00 00 00 00 31 32 33 @@|@@@@@@@@@@123
0x000001a0: 34 46 00 00 41 4e 44 54 - 6d 62 72 00 02 02 02 1f 4F@@ANDTmbr@BBB_
0x000001b0: c7 00 00 80 00 00 00 00 - 00 00 00 00 a5 01 00 41 .@@.@@@@@@@@.A@A
0x000001c0: 01 00 0f fe ff ff ff 0f - 00 00 83 88 70 74 00 00 A@O....O@@..pt@@
0x000001d0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 @@@@@@@@@@@@@@@@
0x000001e0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 @@@@@@@@@@@@@@@@
0x000001f0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 55 aa @@@@@@@@@@@@@@U.

I don't thing the first byte weather it being 0x00 not-bootable or 0x80 bootable would make any difference in gparted displaying it correctly but I can change this or any other bytes if somebody sees a problem.

Here is the partition entry structure I am looking at
Master boot record - Wikipedia, the free encyclopedia

Thanks for any help with this one the HDD size is 1TB