Banner

Banner
Ramast
Linux Developer

Sunday, June 10, 2012

Recovering lost partition table

I have recently erased first few megabytes of my harddisk, any experienced user know that means my harddisk is totally inaccessible
I managed to fix this issue and I thought I should share how I fixed it with everyone

Before you read you need to know what is a sector and what is a block usually sectors are 512byte and blocks are 1024byte so a block = 2 sectors
check the output of fdisk -l /dev/sda to know the size of your sector for sure
I will assume the harddisk we need to recover is  /dev/sda

How to recover erased partition table?

1. If your system (linux system) still running

  • the file /proc/partitions contains valuable information about your partition table, you need to copy this file somewhere safe (memory stick, external HD, ...)
  • /proc/partitions contains number of blocks (size) of each partition and its name but sadly it doesn't say where is starts or ends
  • after that you will need to reboot and then continue reading next steps

2. Try testdisk

testdisk is a great tool that search for your partitions and recover it
http://www.cgsecurity.org/wiki/TestDisk
if it couldn't find all your partitions, you will still be able to make it perform "deeper search" 
If it found  all your partitions, then you are done and there are no need to finish reading this page
If it found some of your partitions, (and some other partitions previously existed) then write down the start/end of each correct partition but don't recover them (at least I didn't take that risk) and continue reading

3. Know what you are facing

OK here is the situation: to recover your partition table you need to know 2 things about each partition (where it starts and where it ends)

if you have the content of /proc/partitions then you know size of each partition in blocks, that makes it easier for you know where it ends if you knew where it starts

but how do I determine where the first partition starts?
that's easy, in the past first partition used to start at sector 63 while recent partitioning utilities would start at 2048 so its either 63 or 2048

4. Recovering first partition

Execute the following commands
parted /dev/sda <= parted is a very good tool for partitioning
unit s <= that will make parted use "sectors" instead of Gigabytes
If you only know the size of your first partition [ in blocks ]
size in sectors = size in blocks * 2
partition start is either 63 or 2048 (try both and see which one will work)
partition end = partition start + partition size in sectors

If you know the start/end of your first partition  
mkpart primary START END <= START/END are in sectors
now exit parted (type quit) and try to mount your first partition

If your first partition won't mount then either you did something wrong or a  portion of this partition was also erased along with the  partition table.
if you are sure its the second case then leave it and continue recovering the other partitions

5. Recovering other primary partitions

Now  that you have recovered the first one and you know where it ends, the next partition starts at the next sector and if you have its size you can recover it in the exact same way

6. Recovering logical partitions

In my case (which is the most common) last primary partition (sda4) is made to fill the remaining disk space and is marked as extended
and inside this partition you make your logical partitions

logical partitions are a little bit tricky because they don't start directly after each others and I couldn't tell where my first logical partition (sda5) starts

to figure those out I used parted and its nice command "rescue"
follow the following steps to recover those partitions
parted /dev/sda
unit s <= that will make parted use "sectors" instead of Gigabytes
print
in the output of print find line like this
 4      102028815s  976771054s  874742240s  extended

where 4 is your extended partition (sda4) and next two numbers are its start/end in sectors
then type the following command
  •  rescue 102028815  976771054 <= where the two numbers represent the two numbers are the numbers I got from the print statement above
parted should tell you it found some partitions and ask you if you wish to add them, say Yes


The END