Re: recover partition table
Hello, Stephen Powell wrote: > On Sat, 26 Mar 2011 13:42:15 -0400 (EDT), Geronimo wrote: > > I don't want to offend you, but all that you wrote I already > > found from google and friends. > > ... But I can make some educated guesses. For example, here's an excerpt > from my /var/log/installer/partman file: > ... > The first number after "OUT" is probably the partition number. As in my partman log there where millions of OUT - lines, I focussed to the lines that look quit similar to fdisk output, like: == === Model: ATA INTEL SSDSA2M040 Path: /dev/sdd Sector size: 512 Sectors: 78165360 Sectors/track: 63 Heads: 255 Cylinders: 4865 Partition table: yes Type: msdos Partitions: # id length typefs pathname (0,0,0) (0,0,62)-1 0-32255 32256 primary label /dev/sdd-1 (0,1,0) (2611,254,62) 1 32256-21484431359 21484399104 primary ext4 /dev/sdd1 (2612,0,0) (2612,27,38)-1 21484431360-21485322239 890880 pri/log free/dev/sdd-1 (2612,27,39)(2660,173,8)2 21485322240-21884829695 399507456 primary ext3/dev/sdd2 (2660,173,9)(4865,122,56) 3 21884829696-40019951615 18135121920 primary ext4/dev/sdd3 (4865,122,57) (4865,144,62) -1 40019951616-40020664319 712704 pri/log free/dev/sdd-1 == === ... and these lines confused me, as wiki said, that biggest value from chs is 1023 - and for me the values in round brakets looked like chs values. As I'm no hero in juggling hex numbers by mind, I wrote a little helper, that dumped the mbr infos. Trying then your advice with "parted -I" I got values similar to the output of my dumper, but not matching the values from partman, so I came to the same conclusion as you - where I had to look at the man pages of parted to find a smaller unit than sectors. So I added little math to my dumping tool and finally the values matched. From manual I already read about the rescue option and as you recommended the same, I gave it a try. ... but I got an error, about missing or wrong label. - Huh? Did not used any label yet. So I added writing capabilities to my dumper and created a mbr, where I thought, should match. Then I wrote it to the drives mbr using dd and rebooted ... Voila - drive is recognized and all works well. Thank you very much for your patience and assistance. kind regards Gero P.S. on writing my dumper and checking all drives against partman log, may be I found a little bug from partman (don't know, whether it has any relevance): According to wiki, head and cylinder are 0-based, whereas sector is 1- based. So I think, a value of (0, 1, 0) as above is invalid and should not occure. I happen to notice 0-based sectors on every drive. -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/201103271453.52148.geronimo...@arcor.de
Re: recover partition table
On Sat, Mar 26, 2011 at 02:59:20PM +0100, Geronimo wrote: > Hello, > > thank your for your assistance. > > Hans-J. Ullrich wrote: > > Am Samstag, 26. März 2011 schrieb Geronimo: > > > Can anybody please shine me a light, how to patch the partition tables > > > with informations from that file, so it might be possible to gain access > > > to data ... > > > > > maybe you can fix it, when you use fdisk, > > Not sure about fdisk. Does fdisk write partition table entry only? > > ... or does it have side effects on existing data - like wiping out > superblock > of existing fs, so you have to format the partition? > I don't want to increase the damage, therefore I ask before doing anything. > I would dd the disk to another disk or file before trying any recovery steps that you're not sure of. -Rob -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20110326213816.gb27...@aurora.owens.net
Re: recover partition table
On Sat, 26 Mar 2011 13:42:15 -0400 (EDT), Geronimo wrote: > > I don't want to offend you, but all that you wrote I already > found from google and friends. > > What I did not find is some info about partman logging. > Searching debian MLs for partman has millions of hits, > so its the same like no hits - can't read all that. > > As partman is internal to d-i, where can I find some info > about the numbers shown around partition informations? Sorry. I guess I didn't understand what you were asking for. In answer to your question, probably nowhere. But I can make some educated guesses. For example, here's an excerpt from my /var/log/installer/partman file: - . . . /lib/partman/choose_partition/35crypto/choices: IN: PARTITIONS =dev=hda parted_server: Read command: PARTITIONS parted_server: command_partitions() parted_server: Opening outfifo parted_server: OUT: OK parted_server: OUT: 1 32256-526417919 526385664 primary linux-swap /dev/hda1 parted_server: OUT: 2 526417920-37523727359 36997309440 primary ext3 /dev/hda2 parted_server: OUT: 3 37523727360-3536639 2475809280 primary ext3 /dev/hda3 parted_server: Partitions printed . . . - The first number after "OUT" is probably the partition number. Next is two numbers separated by a hyphen. I'm guessing that that is the starting and ending sector numbers. Then comes a third number. I'm guessing that that is the total number of sectors in the partition. Next comes the partition type (primary) and the type of file system in the partition (ext3). Now if my guesses are correct, then the ending sector number minus the starting sector number plus one should equal the number of sectors in the partition. Let's see. Hmm. Yes, the math holds up in all the above examples. Let's double check that with the current output of "parted /dev/sda unit s print free". Hmm. No, these are not sector numbers, these are byte offsets. Converting them to sector numbers gives 1 63-1028159 1028097 primary linux-swap 2 1028160-73288529 72260370 primary ext3 3 73285530-78124094 4835565 primary ext3 And this agrees with the output of "parted /dev/sda unit s print free". (To convert the starting byte offset to the starting sector number, simply divide by 512. The same procedure works to convert the number of bytes to the number of sectors: simply divide by 512. To convert an ending byte offset to an ending sector number, the formula is a little more complicated: add 1, divide by 512, then subtract 1.) The corresponding commands to create these partitions would be: parted /dev/sda unit s mkpart primary linux-swap 63 1028159 parted /dev/sda unit s mkpart primary ext3 1028160 73288529 parted /dev/sda unit s mkpart primary ext3 73285530 78124094 It's a "seat of the pants" kind of thing. You won't likely find any official documentation on it. Hmm. I just discovered a "rescue" command in parted. It's description is "rescue a lost partition". The corresponding syntax for "rescue" is parted /dev/sda unit s rescue 63 1028159 parted /dev/sda unit s rescue 1028160 73288529 parted /dev/sda unit s rescue 73285530 78124094 I would think "rescue" would be safer to use than "mkpart". Obviously if you're going to rescue a partition, you wouldn't want any blocks of binary zeros written to the beginning, now would you? Of course, you only want to "rescue" partitions that are not already defined. And rescuing a partition may change the numbers of existing partitions, so watch out for that. -- .''`. Stephen Powell : :' : `. `'` `- -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/2146860404.1737077.1301167555714.javamail.r...@md01.wow.synacor.com
Re: recover partition table
On Sat, 26 Mar 2011, Geronimo wrote: Can anybody please shine me a light, how to patch the partition tables with informations from that file, so it might be possible to gain access to data ... This may not be what you are looking for, but if your aim is to get the partition table back, did you try this utility 'gpart', which guesses the partition table using the device name. It helped me sometime back. Hope it does right in your case :) Regards, Vivek. -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/alpine.deb.2.00.1103262332480.2...@xnqqnccn.tnynkl.pbz
Re: recover partition table
Hello, Stephen Powell wrote: > On Sat, 26 Mar 2011 12:36:08 -0400 (EDT), Geronimo wrote: > > I'm a bit confused. > > > > I tried to read partition info from hex-dump of first block and compare > > that with the values from /var/log/installer/partman ... > > > > According to partition info from wiki the biggest number of chs is 0x3FF, > > > > which is 1023 decimal - and partman output contains entries like: > > (91201,0,0) (91201,80,62) > > > > So is there another way to interpret entries from partition table? > > The master boot record is the first sector of the disk (512 bytes). > ... > is further down in the file than the CHS information. I don't want to offend you, but all that you wrote I already found from google and friends. What I did not find is some info about partman logging. Searching debian MLs for partman has millions of hits, so its the same like no hits - can't read all that. As partman is internal to d-i, where can I find some info about the numbers shown around partition informations? You wrote, that disc addressing could be converted, if size is smaller than 8 Gig - none of my partitions fits this condition, so how can I calculate a sector from informations of partman log? kind regards Gero -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/201103261842.15804.geronimo...@arcor.de
Re: recover partition table
On Sat, 26 Mar 2011 12:36:08 -0400 (EDT), Geronimo wrote: > > I'm a bit confused. > > I tried to read partition info from hex-dump of first block and compare that > with the values from /var/log/installer/partman ... > > According to partition info from wiki the biggest number of chs is 0x3FF, > which is 1023 decimal - and partman output contains entries like: > (91201,0,0) (91201,80,62) > > So is there another way to interpret entries from partition table? The master boot record is the first sector of the disk (512 bytes). Its LBA value is 0 and its CHS value is 0:0:1 (cylinder 0, head 0, record 1). The partition table is contained within the master boot record. Assuming that your disk is partitioned using the standard MS-DOS disk partitioning scheme, the partition table is at offset 0x1be (decimal 446). The total size of the partition table is 64 bytes. It consists of four 16-byte entries. Each entry describes a primary partition or an extended partition. There can be a maximum of one (minimum of zero) extended partitions. Logical partitions, if any, are described in the extended partition table in the first sector of the extended partition. See, for example, http://en.wikipedia.org/wiki/Master_boot_record for more details. Each partition table entry contains the starting sector of the partition in both CHS format and LBA format. It also contains the total number of sectors in the partition and the CHS address of the last sector in the partition. LBA values and CHS values can be converted back and forth to each other as long as (1) the disk geometry is known, and (2) the partition is completely contained within the portion of the disk which is addressable in CHS format. In the best case scenario, CHS values can address only the first 8.4G of the disk. The LBA values can address up to 2T (2 terabytes). Unfortunately, not all disk partitioning programs agree on the disk geometry; so what to use for LBA values depends on which program was used to partition the disk. I address this topic to some extent in my LILO web page http://users.wowway.com/~zlinuxman/lilo.htm That's why I recommend that you concentrate on the sector numbers, which are essentially the same as LBA values. The sector information is further down in the file than the CHS information. -- .''`. Stephen Powell : :' : `. `'` `- -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/2008653358.1735863.1301160403861.javamail.r...@md01.wow.synacor.com
Re: recover partition table
Hello, thank you all for your attention and assistance. Stephen Powell wrote: > On Sat, 26 Mar 2011 06:37:44 -0400 (EDT), Geronimo wrote: > > That logfile looks like having reasonable partition informations of all > > drives. > > > > Can anybody please shine me a light, how to patch the partition tables > > with informations from that file, so it might be possible to gain access > > to data ... > > I looked at my /var/log/installer/partman file, and it does indeed look as > though the exact sector information for the partitions is there. I'm a bit confused. I tried to read partition info from hex-dump of first block and compare that with the values from /var/log/installer/partman ... According to partition info from wiki the biggest number of chs is 0x3FF, which is 1023 decimal - and partman output contains entries like: (91201,0,0) (91201,80,62) So is there another way to interpret entries from partition table? kind regards Gero -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/201103261736.08186.geronimo...@arcor.de
Re: recover partition table
Am Samstag, 26. März 2011 schrieb Geronimo: > Hello, > > thank your for your assistance. > > Hans-J. Ullrich wrote: > > Am Samstag, 26. März 2011 schrieb Geronimo: > > > Can anybody please shine me a light, how to patch the partition tables > > > with informations from that file, so it might be possible to gain > > > access to data ... > > > > maybe you can fix it, when you use fdisk, > > Not sure about fdisk. Does fdisk write partition table entry only? > > ... or does it have side effects on existing data - like wiping out > superblock of existing fs, so you have to format the partition? > I don't want to increase the damage, therefore I ask before doing anything. > > > kind regards > > Gero I do not know. I suppose, it is just writining a new partition table without changing data and formation. So do NOT formate under any circumstances. As I wrote, I got success without loosing any data by jusdt rewriting a new partition table. If this is working in your case, I cannot grant. But maybe other people got some better ideas. Have fun! Greetz Hans -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/201103261625.39372.hans.ullr...@loop.de
Re: recover partition table
On Sat, 26 Mar 2011 09:59:20 -0400 (EDT), Geronimo wrote: > > Not sure about fdisk. Does fdisk write partition table entry only? > > ... or does it have side effects on existing data - like wiping out > superblock > of existing fs, so you have to format the partition? > I don't want to increase the damage, therefore I ask before doing anything. That's an excellent point, Geronimo. Sometimes partitioning programs do stuff like that. I know the old FDISK command from MS-DOS used to write out a few blocks of binary zeros to each partition it allocated to avoid left-over data from causing problems. In the case of Linux fdisk, parted, etc. I don't know the answer to that question. One thing you can try is to allocate a small partition in an area that you know was free space, format it, put some data in it, delete the partition, then reallocate it exactly where it was before, and see if you can still read the data. Then delete the partition again. -- .''`. Stephen Powell : :' : `. `'` `- -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/350791612.1732927.1301148600853.javamail.r...@md01.wow.synacor.com
Re: recover partition table
On Sat, 26 Mar 2011 06:37:44 -0400 (EDT), Geronimo wrote: > > recently I wiped out all but one partition tables by stupidness and hasty > reading ... > > Thanks to testdisk, most of the damage is already fixed. > > There are 2 drives, that testdisk could not find the partion informations for. > Accidently I discovered "/var/log/installer/partman", which looks like being > from the time before my dumb Chuck-Norris-Roundhouse-Kick ;) > > That logfile looks like having reasonable partition informations of all > drives. > > Can anybody please shine me a light, how to patch the partition tables with > informations from that file, so it might be possible to gain access to data > ... I looked at my /var/log/installer/partman file, and it does indeed look as though the exact sector information for the partitions is there. I would suggest using the "parted" command from the package of the same name. It can allocate partitions and report on them at the sector level. For example, parted /dev/sda unit s print free parted /dev/sda unit s mkpart ... -- .''`. Stephen Powell : :' : `. `'` `- -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/2015154596.1732737.1301148012639.javamail.r...@md01.wow.synacor.com
Re: recover partition table
Hello, thank your for your assistance. Hans-J. Ullrich wrote: > Am Samstag, 26. März 2011 schrieb Geronimo: > > Can anybody please shine me a light, how to patch the partition tables > > with informations from that file, so it might be possible to gain access > > to data ... > > > maybe you can fix it, when you use fdisk, Not sure about fdisk. Does fdisk write partition table entry only? ... or does it have side effects on existing data - like wiping out superblock of existing fs, so you have to format the partition? I don't want to increase the damage, therefore I ask before doing anything. kind regards Gero -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/201103261459.20598.geronimo...@arcor.de
Re: recover partition table
Am Samstag, 26. März 2011 schrieb Geronimo: > Hello, > > recently I wiped out all but one partition tables by stupidness and hasty > reading ... > > Thanks to testdisk, most of the damage is already fixed. > > There are 2 drives, that testdisk could not find the partion informations > for. Accidently I discovered "/var/log/installer/partman", which looks > like being from the time before my dumb Chuck-Norris-Roundhouse-Kick ;) > > That logfile looks like having reasonable partition informations of all > drives. > > Can anybody please shine me a light, how to patch the partition tables with > informations from that file, so it might be possible to gain access to data > ... > > > kind regards > > Gero Hi Gero, maybe you can fix it, when you use fdisk, delete all partitions and create exactly the same partitions withe the exactly size as before. But do NOT formate!!! This worked for me, when I accidently loosing my partitions by using a mirror tool from windows. I lost my ext3 partitions that day. Maybe another option, to rescue data might be using the tool "dd",but I am not experienced with it. Testdisk might also be able to rescue the partitions. Another good tools are on SuperRescueCD or UltimatebootCD for Windows. Google for it. Good luck Hans -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/201103261443.15385.hans.ullr...@loop.de
recover partition table
Hello, recently I wiped out all but one partition tables by stupidness and hasty reading ... Thanks to testdisk, most of the damage is already fixed. There are 2 drives, that testdisk could not find the partion informations for. Accidently I discovered "/var/log/installer/partman", which looks like being from the time before my dumb Chuck-Norris-Roundhouse-Kick ;) That logfile looks like having reasonable partition informations of all drives. Can anybody please shine me a light, how to patch the partition tables with informations from that file, so it might be possible to gain access to data ... kind regards Gero -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/201103261137.44240.geronimo...@arcor.de
