I have recently erased first few megabytes of my harddisk, any experienced user know that means my harddisk is totally inaccessible
I managed to fix this issue and I thought I should share how I fixed it with everyone
Before you read you need to know what is a sector and what is a block usually sectors are 512byte and blocks are 1024byte so a block = 2 sectors
check the output of fdisk -l /dev/sda to know the size of your sector for sure
I will assume the harddisk we need to recover is /dev/sda
size in sectors = size in blocks * 2
partition start is either 63 or 2048 (try both and see which one will work)
partition end = partition start + partition size in sectors
If you know the start/end of your first partition
If your first partition won't mount then either you did something wrong or a portion of this partition was also erased along with the partition table.
if you are sure its the second case then leave it and continue recovering the other partitions
logical partitions are a little bit tricky because they don't start directly after each others and I couldn't tell where my first logical partition (sda5) starts
where 4 is your extended partition (sda4) and next two numbers are its start/end in sectors
I managed to fix this issue and I thought I should share how I fixed it with everyone
Before you read you need to know what is a sector and what is a block usually sectors are 512byte and blocks are 1024byte so a block = 2 sectors
check the output of fdisk -l /dev/sda to know the size of your sector for sure
I will assume the harddisk we need to recover is /dev/sda
How to recover erased partition table?
1. If your system (linux system) still running
- the file /proc/partitions contains valuable information about your partition table, you need to copy this file somewhere safe (memory stick, external HD, ...)
- /proc/partitions contains number of blocks (size) of each partition and its name but sadly it doesn't say where is starts or ends
- after that you will need to reboot and then continue reading next steps
2. Try testdisk
testdisk is a great tool that search for your partitions and recover it
http://www.cgsecurity.org/wiki/TestDisk
http://www.cgsecurity.org/wiki/TestDisk
if it couldn't find all your partitions, you will still be able to make it perform "deeper search"
If it found all your partitions, then you are done and there are no need to finish reading this page
If it found some of your partitions, (and some other partitions previously existed) then write down the start/end of each correct partition but don't recover them (at least I didn't take that risk) and continue reading
If it found some of your partitions, (and some other partitions previously existed) then write down the start/end of each correct partition but don't recover them (at least I didn't take that risk) and continue reading
3. Know what you are facing
OK here is the situation: to recover your partition table you need to know 2 things about each partition (where it starts and where it ends)
if you have the content of /proc/partitions then you know size of each partition in blocks, that makes it easier for you know where it ends if you knew where it starts
but how do I determine where the first partition starts?
that's easy, in the past first partition used to start at sector 63 while recent partitioning utilities would start at 2048 so its either 63 or 2048
4. Recovering first partition
Execute the following commands
parted /dev/sda <= parted is a very good tool for partitioning unit s <= that will make parted use "sectors" instead of GigabytesIf you only know the size of your first partition [ in blocks ]
size in sectors = size in blocks * 2
partition start is either 63 or 2048 (try both and see which one will work)
partition end = partition start + partition size in sectors
If you know the start/end of your first partition
mkpart primary START END <= START/END are in sectorsnow exit parted (type quit) and try to mount your first partition
If your first partition won't mount then either you did something wrong or a portion of this partition was also erased along with the partition table.
if you are sure its the second case then leave it and continue recovering the other partitions
5. Recovering other primary partitions
Now that you have recovered the first one and you know where it ends, the next partition starts at the next sector and if you have its size you can recover it in the exact same way
6. Recovering logical partitions
In my case (which is the most common) last primary partition (sda4) is made to fill the remaining disk space and is marked as extended
and inside this partition you make your logical partitions
logical partitions are a little bit tricky because they don't start directly after each others and I couldn't tell where my first logical partition (sda5) starts
to figure those out I used parted and its nice command "rescue"
follow the following steps to recover those partitions
parted /dev/sda unit s <= that will make parted use "sectors" instead of Gigabytes printin the output of print find line like this
4 102028815s 976771054s 874742240s extended
where 4 is your extended partition (sda4) and next two numbers are its start/end in sectors
then type the following command
- rescue 102028815 976771054 <= where the two numbers represent the two numbers are the numbers I got from the print statement above