Re: undelete for partition tables?
"Jaldhar H. Vyas" wrote:
>
> Partition records exactly as they appear in MBR (EMBR):
>
> Starting Ending Starting Number of
> # HD FS Cyl Head Sect Cyl Head Sect sector sectors
> (0,0,1):
> 1 00 00 0 0 0 0 0 0 0 0
> 2 00 00 0 0 0 0 0 0 0 0
> 3 00 00 0 0 0 0 0 0 0 0
> 4 00 83 1,023 63 63 1,023 63 63 34,186,320 1,044,225
>
> Unfortunately I don't remember exactly which raw devices mapped to which
> partitions when I set up this computer (and my colleague may have moved
> them around anyway) but putting our heads together we think the layout was
> something like this:
>
> fs type size (MB) location (not sure)
> / ext2 512 /dev/hda7
> /usr ext2 4096 /dev/hda8
> /home ext2 2048 /dev/hda9
> /var ext2 2048 /dev/hda10
> swap swap 512 /dev/hda4
>
> The first and second primary partitions were the DOS ones he created and
> may have had logical drives in them, he isn't sure.
>
> Thanks for your help, we really appreciate it.
Well, it may be possible, but this one won't be too easy. One thing I
notice right away is that /dev/hda4 is an ext2 partition (type 83), not
a swap partition (type 82) as is shown in your list. That's the only
partition remaining in the MBR partition table.
Putting aside that and other possible complications for now....since
(apparently) the bulk of Linux was inside an extended partition, the key
to recovering those partitions (hda7 thru hda10) would be to find the
first partition sector of the extended partition. Once that is found,
the chain of logical partitions should be able to be rebuilt, as each
one will point to the next one.
Finding that sector may not be so easy though since the extended
partition itself has been deleted from the MBR partition table. That
entry in the partition table would have told us where the extended
partition started.
In fact, I don't even know how he deleted that partition with DOS fdisk
since it normally is not capable of deleting an extended partition that
still contains non-DOS logical drives - which it also can't delete.
Question: Was that possibly a Linux extended partition (type 85) as
opposed to a DOS extnded partition? That would explain why DOS fdisk
could delete it.
Question: Is there any guess as to what was on /dev/hda5 and /dev/hda6
which are not accounted for?
I have used Norton's Disk Editor in the past to search for a sector when
I have some knowledge of what's in that sector. For example, all
partition sectors end with the signature "55 AA" as the last two bytes.
However, even the newest version of the Disk Editor (from NU4) is not
able to search a disk past 1023 cylinders (8 GB), and your disk is 17 GB
The best I can suggest right now is if you have a copy of Norton's Disk
Editor around, post back and I can give you a rundown on how to search
for that sector - understanding that it may not work because of the size
of the disk.
Failing that, maybe someone reading this list knows a way to attack this
problem using Linux tools. There's always a way, but it may come down to
how much time and effort you and your colleague are willing to devote to
this.
Good luck,
Tom
Reply to: