Tuesday, January 30, 2007

Useful things when you've wiped you partition table (conclusion)

This is the concluding part of my earlier post on recovering after wiping the partition table and the first 30k or so of my harddisk. It has a happy ending.

It didn't take much more effort in the end to rebuild my laptop's partition table. It turns out that gpart was not terribly useful as I had used extended partitions and nuked the first one. It found my 2 linux partitions but refused to rebuild the partition table. It also outputs the location of the partitions in MB which is no use at all. This patch

diff -ur gpart-0.1h/src/gpart.h ../gpart-0.1h/src/gpart.h --- gpart-0.1h/src/gpart.h 2001-01-30 23:07:29.000000000 +0000 +++ ../gpart-0.1h/src/gpart.h 2007-01-03 05:07:06.000000000 +0000 @@ -171,7 +171,7 @@ struct disk_geom *disk_geometry(disk_desc *); int reread_partition_table(int); -#define s2mb(d,s) { (s)*=(d)->d_ssize; (s)/=1024; (s)/=1024; } +#define s2mb(d,s) { (s)*=(d)->d_ssize; } #define align(b,s) (byte_t *)(((size_t)(b)+(s)-1)&~((s)-1)) #include "gmodules.h"

makes it output bytes instead which I could then divide by 512 to get sectors. I had to compile it on a Debian box (not sure what vintage), it wouldn't compile under Ubuntu.

Next I used sfdisk -d /dev/sda to dump a partition table from another machine as an example and then edit that to look like

# partition table of /dev/sda unit: sectors /dev/sda1 : start= 63, size= 39053952, Id=83 /dev/sda2 : start= 39070143, size= 3903728, Id=82 /dev/sda3 : start= 42973938, size= 72260370, Id=8e /dev/sda4 : start=115234308, size= 1975932, Id=83, bootable

I worked out the sizes by subtracting the start values from each other. Saving that in a file and doing sfdisk < my_partitions.txt gave me a new partition table which amazingly worked. Of course /dev/sda1 wasn't recovered properly because it had also been partially overwritten by the format but luckily I had nothing useful on that partition.

No comments: