Re: RECOVERY: partition table

Steve Dodd (dirk@loth.demon.co.uk)
Sun, 11 Jul 1999 03:20:28 +0100


On Sat, Jul 10, 1999 at 06:46:25PM -0600, Trever Adams wrote:

> I found block lengths etc of my partitions... I accidentally blew away
> my partition table (fd0!=hda) and unfortunately I have no way to do a
> backup and so have little. The system is still up and running. Is
> there anyway I can recreate exactly the same partition table?

We had a discussion a while back (toward the end of April) about guessing the
partition table just from other data on the disk. The subject was
"WAY OT--Crisis...virus! Need help" if you want to search for it. The upshot
is that you can do it by hand, or that there were some programs out there that
come do it, with varying levels of success. Here are some quotes (sorry, I've
omitted the author's names, too tired):

-

"Somehow during all this "crisis" (which has nothing to do with the kernel,
BTW) nobody mentioned that on
ftp://metalab.unc.edu/pub/Linux/system/filesystems/ there is a credible
utility for an automatic guessing of lost partition tables. It is
called gpart<something-or-another>.

I think also that Gordon Chaffee had also another one on his web page
(http://bmrc.berkeley.edu/people/chaffee/, I believe)."

-

"Thanks! So we now have 3 utilities.
At very first sight (looking at the source) Michail Brzitwa's gpart looks best.
However, it is very slow (took a quarter of an hour on the first disk I tried)
and gave zero output in my case.
Gordon Chaffee's fixdisktable is fast, and gave the wrong answer after only
a few seconds.
The thingy I wrote yesterday evening is the most limited (no support for
all these filesystems recognized by gpart and fixdisktable), but is the
fastest, and, not surprising, gives the right answer for my disks.
Probably some merging would produce something that improves on each of these."

-

"I added a lttle bit of partition table knowledge and FAT knowledge
to yesterdays version. Try ftp.cwi.nl /pub/aeb/rescuept.c"

> I imagine
> all the information is in /proc, but I can't find it. Any help would be
> greatly appreciated. OBviously, especially with bad power quality here,
> time is of the essense.

You'd think, wouldn't you? :) But I couldn't see it. /proc/partitions has
the size in blocks however, which would make life easier if you were hunting
for the data by hand. Other than that, rebuild /usr/src/linux/vmlinux with
debugging symbols, fire up gdb /usr/src/linux/vmlinux /proc/kcore, and start
digging the partition table data in the kernel (genhd.c handles this sort of
stuff, or did until very recent in 2.3.x..)

Hopefully someone else here might have more ideas.

-- 
QOTD: "Sure, I turned down a drink once. Didn't understand the question."

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/