something messed up my partition table. Can I get it back?
I've been have a large amount of problems recently, and my system is
rapidly degrading. I'd like to try an save my data.
I have a dual-boot windows/linux machine. Windows and linux share the same
drive. (I'm trying to change that right now. I hope it isn't too late.)
Something very bad happened to windows. I think it may be some sort of
virus or malicious coding. It could be a hardware problem too.
The partition problems began after I added a drive, partitioned it, and
then formatted it in windows. After rebooting, the boot loader (grub)
bombed with a message about the wrong type (Error 27 I think). Using a
rescue disk to get me back into linux, I found that the partition table of
my first drive was altered. Everything was the same except that the type
for the linux root partition was set to 0x93 instead of 0x83. I hadn't done
anything to this drive. I thought that maybe I made an error somewhere, so
I went into cfdisk and changed the type back to 0x83. Reboot. Everything's
fine.
Now I reboot again and go into windows to make sure that works correctly.
Everything okay. Reboot. Grub doesn't work again. Use the rescue disk to
get into linux again. Look at the partitioning. The linux partition has
been set to 0x93 again. But also, 2 adjoining windows partitions have been
merged. I used to have hda5 & hda6 as vfats. Now I have a primary hda2
instead that's the size of those two partitions together. My swap partition
is also changed to 0x92.
Is there a backup copy of the partition table stored somewhere? It seems
there should be one. If so, how do I restore it?
Also, is this a familiar problem? The linux partition was changed to 0x93
twice in a row. That doesn't seem to be random. Especially taken together
with the swap file being altered to 0x92. In both, the upper nibble has
been incremented. The other altered/merged partition (which used to be 2
vfats) has become 0x1f. 0x93 is Aoemeba filesystem type according to
cfdisk1, 0xf1 isn't defined, and 0x92 isn't defined either.
The linux and swap partitions were hidden from windows by grub. The others
were windows partitions.
Does this sound like a virus? Or a bad controller or disk? Virus scanning
hasn't turned up anything other than that the partition table has been
changed.
This has been a very bad week.
Reply to: