fat32 + ext2 partitions lost. How to recover?

fat32 + ext2 partitions lost. How to recover?

Post by Roberto Inzeril » Thu, 19 Apr 2001 07:25:54



Hi all,
 I have a 13Gb hard-disk which failed (obviously) after having "dd
if=boot.img of=/dev/hda" (where boot.img = boot disk for floppy Redhat
installation ~= 1.44Mb).
Now the old partions are lost   :-(

I'm not that expert of partitions, I have some basic skill with my Redhat7
Linux Box and Win98. I would like to recover all the data stored on this
hard-disk before (or even, without) reformatting it again.

Now I explain the actual situation hoping that someone would be so nice to
give me some hints. In the meanwhile I'm reading further documentation and
HOWTOs in order to have major skill of partitions, MBR and so on.

I had 5 partitions on the harddisk, 2 fat32 (Win98) , two Linux native
(ext2), and one Linux swap in the following order:

  | fat32 | ext2 | ext2 | swap| fat32 |

I don't remember exactly which was primary and which extended (and logical),
I guess they where:

 Primary : 1st fat32
 Extended :
        1st ext2
        2nd ext2
        swap
Primary: 2nd fat32 (but maybe this was in the extended partition too)

I had Lilo installed in the MBR in order to switch between the Win98 in the
1st fat32 and Redhat Linux on the 1st ext2. The second fat32 was used as
storage (like the the second ext2).

I found on the Net a very usefull utility (gpart) that gave me this result:

------- Begin of gpart
logfile ------------------------------------------------
Begin scan...
Possible partition(Linux ext2), size(2000mb), offset(4996mb)
Possible partition(Linux ext2), size(1498mb), offset(6997mb)
Possible partition(Linux swap), size(133mb), offset(8495mb)
Possible partition(DOS FAT), size(4581mb), offset(8628mb)

* Warning: short read near sector(27067635), 64512 bytes instead of 66048.
Skipping...
End scan.

Checking partitions...
Partition(Linux ext2 filesystem): primary
Partition(Linux ext2 filesystem): primary
Partition(Linux swap or Solaris/x86): primary
Partition(DOS or Windows 95 with 32 bit FAT): primary
Ok.

Guessed primary partition table:
Primary partition(1)
   type: 131(0x83)(Linux ext2 filesystem)
   size: 2000mb #s(4096512) s(10233468-14329979)
   chs:  (1023/15/63)-(1023/15/63)d (10152/4/1)-(14216/3/63)r

Primary partition(2)
   type: 131(0x83)(Linux ext2 filesystem)
   size: 1498mb #s(3068352) s(14330043-17398394)
   chs:  (1023/15/63)-(1023/15/63)d (14216/5/1)-(17260/4/63)r

Primary partition(3)
   type: 130(0x82)(Linux swap or Solaris/x86)
   size: 133mb #s(273040) s(17398458-17671497)
   chs:  (1023/15/63)-(1023/15/63)d (17260/6/1)-(17531/3/61)r

Primary partition(4)
   type: 011(0x0B)(DOS or Windows 95 with 32 bit FAT)
   size: 4581mb #s(9381897) s(17671563-27053459)
   chs:  (1023/15/63)-(1023/15/63)d (17531/5/1)-(26838/11/63)r
------- End of gpart
logfile ------------------------------------------------

I think that the erroneous command ("dd if=...") did overwrite the first
Megabytes of the /dev/hda unit, destroyng the MBR and the partition table.
Now I can really not access any partition on it. Then I decided to connect
the harddisk as secondary master, I connected anothe smaller harddisk as
primary master in which I installed win98 and Redhat in two different
partitions (i prefer to have both because Linux gives me more techical
plefixibility but Windows let me still use the machine for ordinary
productivity. Bye the way, now I can test the secondary master harddisk
without writing anything (since I dont' understand what to write and only if
needed and only with quite consciousness of how to do it).

The response of gpart tells me the it recognizes the 2 ext2 partitions, the
swap one and the second fat32. But itreally did'nt discover the first fat32,
maybe because the partition table is totally overwritten with the boot.img
bytes. This makes me very sad, because in the 1st fat32 partition I have
some files I would like to recover (I don't care instead , by now, to
recover the swap one). However the gpart logfile seems to describe very well
the real (as soon as I remember) displacement of the lost partitions on the
harddisk.

What do I do now?
                    Please help.
                                     Roberto

--
GMX - Die Kommunikationsplattform im Internet.
http://www.gmx.net

--
Posted from mx0.gmx.net [213.165.64.100]
via Mailgate.ORG Server - http://www.Mailgate.ORG

 
 
 

fat32 + ext2 partitions lost. How to recover?

Post by L.V.Gand » Thu, 19 Apr 2001 11:40:17


On Tue, 17 Apr 2001 22:25:54 +0000 (UTC), Roberto Inzerillo

>Hi all,
> I have a 13Gb hard-disk which failed (obviously) after having "dd

If you have boot disk of win98, boot with it and do
fdisk /mbr.
This should start win98 when you start pc next time. there is a program
called explore2fs. get hold of it. You can copy the your boot image of linux
from linux partition in windows. You can get your / partition detail also
here. You can then get loadlin from your linux distro disk. you then start
pc in dos mode.
do
loadlin vmlinuz root=/dev/hdxx
where vmlinuz is the boot image got from your linux partition and xx is the
number of / partition.
Now in linux do lilo.
Thus you can have both win and linux back.

--
L.V.Gandhi
MECON, 5th Floor, RTC Complex, Visakhapatnam AP 530020 INDIA


 
 
 

fat32 + ext2 partitions lost. How to recover?

Post by Svend Olaf Mikkels » Thu, 19 Apr 2001 16:13:30



>The response of gpart tells me the it recognizes the 2 ext2 partitions, the
>swap one and the second fat32. But itreally did'nt discover the first fat32,
>maybe because the partition table is totally overwritten with the boot.img
>bytes. This makes me very sad, because in the 1st fat32 partition I have
>some files I would like to recover (I don't care instead , by now, to
>recover the swap one). However the gpart logfile seems to describe very well
>the real (as soon as I remember) displacement of the lost partitions on the
>harddisk.

>What do I do now?
>                    Please help.
>                                     Roberto

It seems as the gpart search was done using a 16 heads setting, while
the original partition tables were made using a 255 heads setting.
This however is not the explanation that the primary FAT32 partition
was not found.

When the image file was written to hda, the beginning of the primary
FAT32 partition was overwritten.

The partition was 4096 MB. Assuming a 4 KB cluster size, which would
be the usual for a partition this size, the FAT size per copy would be
about 9974 sectors.

The size of a floppy boot image would be 2847 sectors.

This means that the second FAT copy will be OK, and that the partition
probably can be repaired, or all the data probably can be successfully
copied to another disk using recovery tools.

If you want my help, you can get Findpart at

http://inet.uni2.dk/~svolaf/utilities.htm

do (assuming the disk is disk 2):

findpart 2 heads 255 fp.txt

and

findpart tables fp1.txt

and mail me the files fp.txt and fp1.txt.
--
Svend Olaf

 
 
 

fat32 + ext2 partitions lost. How to recover?

Post by Roberto Inzeril » Fri, 20 Apr 2001 02:07:25


Hi Svend,

 I agree with the assumption that the 2nd FAT32 is ok.
I read an article with an example of a 2Mb fat32 for a 2Gb hard-disk, then
the second fat32 should begin after the first 2Mb of the hard-disk; hence, if
my 1st fat32 partition is 5Gb (not 4Gb as you supposed; remember that the
first ext2 partition begins at offset 4996Mb as stated by gpart, and I suppose
it is right) at least the 2nd fat32 should be far away from these first
corrupted sectors. I'd like to recover it in order to access the files on this
partition, but how ?!?

I've downloaded Findpart and run it, but the logfile is incredibly complex
to interpret (at least it is to me :-(  ). Now I'm at the office (without the
harddisk at hand). In two hours I'll be back at home, I'll fire again
Findpart and will post the result and write an email to you with the logfile
attached.

In the meanwhile I'm reading about "dd" and "loopback" in Linux; I read that
dd is capable of making a complete raw backup of the device (the corrupted
/dev/hda ), writing a file that could be mounted as a loopback device. I
think I'm not wrong supposing that it is possible to make some test on the
loopback device (the one created with the copy of the corrupted disk) in order to
recreate the partition tables, the MBR and the FATs. Am I right? I don't like
to write anything yet over my harddisk without some more knowledge. That's
why I will not make any "fdisk /mbr" before attemping to recover the data in
readonly mode.

Why do you think that gpart should have used a 255 heads setting instead of
16? My Quantum Fireball Plus KA has 16 Logical Heads.

 Roberto

--
GMX - Die Kommunikationsplattform im Internet.
http://www.gmx.net

--
Posted from mx0.gmx.de [213.165.64.100]
via Mailgate.ORG Server - http://www.Mailgate.ORG

 
 
 

fat32 + ext2 partitions lost. How to recover?

Post by Peter T. Breue » Fri, 20 Apr 2001 03:36:03



> In the meanwhile I'm reading about "dd" and "loopback" in Linux; I read that
> dd is capable of making a complete raw backup of the device (the corrupted
> /dev/hda ), writing a file that could be mounted as a loopback device. I
> think I'm not wrong supposing that it is possible to make some test on the
> loopback device (the one created with the copy of the corrupted disk) in order to
> recreate the partition tables, the MBR and the FATs. Am I right? I don't like

All completely correct. "findpart".

Quote:> to write anything yet over my harddisk without some more knowledge. That's
> why I will not make any "fdisk /mbr" before attemping to recover the data in
> readonly mode.

Well, that would only zero the first few bytes of your first sector on
your disk. The partition table is in the upper bytes of the first
sector (512 bytes). You only have to mess with those 512 bytes if you
are worried about the table!

Quote:> Why do you think that gpart should have used a 255 heads setting instead of
> 16? My Quantum Fireball Plus KA has 16 Logical Heads.

No it doesn't. It has as many as you like to tell it it has. That's the
point of "logic".

Peter

 
 
 

fat32 + ext2 partitions lost. How to recover?

Post by Svend Olaf Mikkels » Sun, 22 Apr 2001 18:03:08



>Hi all,
> I have a 13Gb hard-disk which failed (obviously) after having "dd
>if=boot.img of=/dev/hda" (where boot.img = boot disk for floppy Redhat
>installation ~= 1.44Mb).
>Now the old partions are lost   :-(

>I'm not that expert of partitions, I have some basic skill with my Redhat7
>Linux Box and Win98. I would like to recover all the data stored on this
>hard-disk before (or even, without) reformatting it again.

>Now I explain the actual situation hoping that someone would be so nice to
>give me some hints. In the meanwhile I'm reading further documentation and
>HOWTOs in order to have major skill of partitions, MBR and so on.

>I had 5 partitions on the harddisk, 2 fat32 (Win98) , two Linux native
>(ext2), and one Linux swap in the following order:

>  | fat32 | ext2 | ext2 | swap| fat32 |

>I don't remember exactly which was primary and which extended (and logical),
>I guess they where:

> Primary : 1st fat32
> Extended :
>        1st ext2
>        2nd ext2
>        swap
>Primary: 2nd fat32 (but maybe this was in the extended partition too)

>I had Lilo installed in the MBR in order to switch between the Win98 in the
>1st fat32 and Redhat Linux on the 1st ext2. The second fat32 was used as
>storage (like the the second ext2).

>I found on the Net a very usefull utility (gpart) that gave me this result:

>------- Begin of gpart
>logfile ------------------------------------------------
>Begin scan...
>Possible partition(Linux ext2), size(2000mb), offset(4996mb)
>Possible partition(Linux ext2), size(1498mb), offset(6997mb)
>Possible partition(Linux swap), size(133mb), offset(8495mb)
>Possible partition(DOS FAT), size(4581mb), offset(8628mb)

>* Warning: short read near sector(27067635), 64512 bytes instead of 66048.
>Skipping...
>End scan.

>Checking partitions...
>Partition(Linux ext2 filesystem): primary
>Partition(Linux ext2 filesystem): primary
>Partition(Linux swap or Solaris/x86): primary
>Partition(DOS or Windows 95 with 32 bit FAT): primary
>Ok.

>Guessed primary partition table:
>Primary partition(1)
>   type: 131(0x83)(Linux ext2 filesystem)
>   size: 2000mb #s(4096512) s(10233468-14329979)
>   chs:  (1023/15/63)-(1023/15/63)d (10152/4/1)-(14216/3/63)r

>Primary partition(2)
>   type: 131(0x83)(Linux ext2 filesystem)
>   size: 1498mb #s(3068352) s(14330043-17398394)
>   chs:  (1023/15/63)-(1023/15/63)d (14216/5/1)-(17260/4/63)r

>Primary partition(3)
>   type: 130(0x82)(Linux swap or Solaris/x86)
>   size: 133mb #s(273040) s(17398458-17671497)
>   chs:  (1023/15/63)-(1023/15/63)d (17260/6/1)-(17531/3/61)r

>Primary partition(4)
>   type: 011(0x0B)(DOS or Windows 95 with 32 bit FAT)
>   size: 4581mb #s(9381897) s(17671563-27053459)
>   chs:  (1023/15/63)-(1023/15/63)d (17531/5/1)-(26838/11/63)r
>------- End of gpart
>logfile ------------------------------------------------

>I think that the erroneous command ("dd if=...") did overwrite the first
>Megabytes of the /dev/hda unit, destroyng the MBR and the partition table.
>Now I can really not access any partition on it. Then I decided to connect
>the harddisk as secondary master, I connected anothe smaller harddisk as
>primary master in which I installed win98 and Redhat in two different
>partitions (i prefer to have both because Linux gives me more techical
>plefixibility but Windows let me still use the machine for ordinary
>productivity. Bye the way, now I can test the secondary master harddisk
>without writing anything (since I dont' understand what to write and only if
>needed and only with quite consciousness of how to do it).

>The response of gpart tells me the it recognizes the 2 ext2 partitions, the
>swap one and the second fat32. But itreally did'nt discover the first fat32,
>maybe because the partition table is totally overwritten with the boot.img
>bytes. This makes me very sad, because in the 1st fat32 partition I have
>some files I would like to recover (I don't care instead , by now, to
>recover the swap one). However the gpart logfile seems to describe very well
>the real (as soon as I remember) displacement of the lost partitions on the
>harddisk.

>What do I do now?
>                    Please help.
>                                     Roberto

The problem was solved by copying FAT copy 2 to FAT copy 1 in the
primary FAT32 partition, editing the boot sector of this partition,
and editing the partition tables.

The partition tables were originally made, and repaired, using a 255
heads translation.
--
Svend Olaf

 
 
 

fat32 + ext2 partitions lost. How to recover?

Post by Roberto Inzeril » Wed, 25 Apr 2001 02:44:32


Thanks to Svend Olaf, who gave me full support in every step of the
repairing process, the problem was solved without any loss of data (I said ANY).

I thank very much Svend Olaf for the help. He gave me a very precious
support in using the software he produced (findpart, cyldir etc...) in order to
fully recreate MBR, partitiona tables and fats.

--
GMX - Die Kommunikationsplattform im Internet.
http://www.gmx.net

--
Posted from mx0.gmx.de [213.165.64.100]
via Mailgate.ORG Server - http://www.Mailgate.ORG

 
 
 

1. ext2 partition between FAT32 partitions

I recently posted here getting advice about partitioning my hdd.  And
although it was just what I needed I have now just found out that it might
not be possible.
I want to do the following
2gb - Win98SE
5gb - Linux
10gb - Windows Data
10gb - windows Data
3gb - spare

However, upon reading my installation manual (SUSE 6.4) it read that I
couldnt have the linux partition in between windows partitions.  Is this
true?  It said that YaST2 didnt support this type of installation so I
suppose i would have to use YaST.  Is it possible?

I would be very grateful for any help on this matter.  I could use the final
3gb for linux, but have read that I need to keep the linux boot below the
1024 cluster (I will be booting linux from floppy not Lilo!).
I would rather have linux in the 5gb partition though.

Cheers
Rich.

2. ldconfig: warning: can't unlinuk /usr/lib/ (operation not permitted)

3. Recovering ext2 partition

4. chatscript, multi ^M^M

5. Recovering data from a damaged ext2 partition?

6. pppd working now need route help please

7. NTFS, FAT32, ext2 multi-boot possible with Partition Magic4.0?

8. diskless sun boot

9. Recovering /lost /usr partition - The final verdict

10. recovering lost partitions

11. Lost partition table -- How to recover?

12. HELP!!! Recover lost partition

13. HELP!! Lost partition, need tools to recover