Search:  
Gentoo Wiki

HOWTO_Recovering_a_Deleted_Partition_Table


This article is part of the HOWTO series.
Installation Kernel & Hardware Networks Portage Software System X Server Gaming Non-x86 Emulators Misc

Contents

Introduction

This HOWTO will explain the process of recovering accidently deleted partition tables from linux partition, this has been tested with EXTFS so far, if you have tested this procedure with other file system types, please edit this paragraph.

Search for partition block.

Create a partition at least the same size as your first partition was. You can make it bigger than your old partition, what we do on the next step will identify the require block size. If you make the partition too small you'll just waste time. Run Fdisk on command prompt as under:

# Command (m for help): n
  Command action
  e   extended
  p   primary partition (1-4)
# p
# Partition number (1-4): 1
# First cylinder (1-45785, default 1): <HIT ENTER>
  Using default value 1
# Last cylinder or +size or +sizeM or +sizeK (1-42105, default 42105): 39002
# Command (m for help): w

Dumpe2fs Util

We will run dumpe2fs on the first partition and grep out the block count value.

# dumpe2fs /dev/sda1 | grep "Block count:"
 Block count:              84253584

Verify Partition

If this value is not what you wanted, repeat Step 1 with a bigger partition size. If the block count changes, then you mis-calculated the size of the original partition. Repeat Step 1 until you get a correct block count.

# Command (m for help): d
# Partition number (1-4): 1
           

Create Partition

Make a new partition with the exact size you got from the block count. Since you cannot enter block size in fdisk, you need to figure out how many cylinders to request. Here is the formula:

(number of needed cylinders) = (number of blocks) / (block size)
(block size) = (unit size) / 1024
(unit size) = (number of cylinders) * (number of heads) * (number of sectors/cylinder) * (number of bytes/sector)

Consider the following example, where a hard drive has been partitioned into four primary partitions of 1, 2, 4, and 8 cylinders.

# disk /dev/sda
16 heads, 63 sectors, 23361 cylinders
Units = cylinders of 1008 * 512 bytes
Device Boot    Start       End    Blocks   Id  System
     /dev/sda1             1         2       976+  83  Linux
     /dev/sda2             3         5      1512   83  Linux
     /dev/sda3             6        10      2520   83  Linux
     /dev/sda4            11        19      4536   83  Linux

fdisk provides the configuration information I need in the head of the output. The unit size is 516096 ( 16 heads * 63 sectors/cyl * 512 bytes/sector ). The block size is 504 ( 516096 / 1024 ). The number of needed cylinders for the second partition is therefore 3 ( 1512 blocks / 504 ). The partition table shows that this is indeed the case: the first cylinder is 3, the second 4, and the last is 5, for a total of three cylinders. The number of needed cylinders for the third partition is calculated similarly: 2520 blocks / 504 = 5, which corresponds to blocks 6,7,8,9,10 . Notice that this calculation does not work for the first partition because the block count is wrong ( 976 instead of 1008 ). The plus sign indicates that not all the blocks are included in the fdisk value. When you try the calculation ( 976 / 504 ) you get 1.937. Knowing that the number of cylinders must be an integer, you can simply round up.

Verify Partitions

Run e2fsck on it to verify that you can read the new partition. Repeat Steps 1-5 on remaining partitions. Remount your partitions. Amazingly, all of your data will be there.

Alternatives

Testdisk

Multi-platform tool to check and undelete partition, supports reiserfs, ntfs, fat32, ext2/3 and many others. Also includes

# emerge testdisk -av

PhotoRec

Recover pictures from digital camera memory Photo_Recovery_From_Defective_Memory_Card.

Credits

Changelog

Retrieved from "http://www.gentoo-wiki.info/HOWTO_Recovering_a_Deleted_Partition_Table"

Last modified: Fri, 05 Sep 2008 06:34:00 +0000 Hits: 4,101