HELP - LOST LINUX TO PARTITION TABLE WIPEOUT!!

HELP - LOST LINUX TO PARTITION TABLE WIPEOUT!!

Post by p_tux_ne » Tue, 21 Mar 2000 04:00:00



I have lost my linux entry in a partition table wipeout caused by a
crash.

This is what happened:
- crash corrupted my partition table
- partition table was rebuilt using Norton Utilities' command "ndd
/rebuild" which was very good at restoring the windows fat partition,
but not the linux ones (on top of that it overwrote the partition
table)
- I don't have a backup of the partition table (stupid, stupid, would
have been so easy with Norton Utilities which is installed!!)

My disk structure was as follows (approximate sizes):
        14Gb hard disk:
                2.0Gb FAT16 partition (NT4 Server)
                3.8Gb FAT32 partition (Windows 98 SE)
                1.4Gb FAT32 partition (Windows 98 SE)
                5.7Gb externded partition:
                        3.8Gb linux ext2 partition
                        128Mb linux swap partition
                        1.4Gb logical d: FAT16 partition

The above my not add up exactly, but they are fairly correct.  I use
Boot Magic.

I have actually read documentation on how to rebuild my partition
table, and feel like I could have a shot at it, but my problem is that
I CANNOT FIND THE LINUX PARTITION.  I have searched for the 55 AA hex
codes usind Norton Utilities diskedit, but it returns quite a few of
them (yes, there are quite a few even if I look that they have some
boot messages on the ascii part of diskedit).

What I need is the following:
1. a system or a utility to help me find the linux partition
2. a system or a utility to help me recreate the partition table

I have put a huge amount of work in my linux partition and I would
really appreciate any help on this subject so I can avoid rebuilding
this sytem.

The tools I have at my disposal are:
- Norton Utilities (includes ndd, diskedit)
- Partition Magic 4.0

Thank you all in advance

write to p_tux_news living at yahoo.com

Linux: the revenge of the nerds!!

 
 
 

HELP - LOST LINUX TO PARTITION TABLE WIPEOUT!!

Post by Andreas Meil » Tue, 21 Mar 2000 04:00:00


p_tux_news (p_tux_news) schrieb in Nachricht

Quote:

>My disk structure was as follows (approximate sizes):
> 14Gb hard disk:
> 2.0Gb FAT16 partition (NT4 Server)
> 3.8Gb FAT32 partition (Windows 98 SE)
> 1.4Gb FAT32 partition (Windows 98 SE)
> 5.7Gb externded partition:
> 3.8Gb linux ext2 partition
> 128Mb linux swap partition
> 1.4Gb logical d: FAT16 partition

Linux has a *powerful* fdisk command where you can do nearly everything.
Another benefit of Linux's "fdisk" is the fact that it modifies only the
partition table sector, *not* the content itself. Microsft's FDISK.EXE for
example always overwrites the first sector so remaining data are lost. In
Linux for example, I also often have "hiddened"/"disabled" partition (for
example installing a Windows 98 which should not fiddle on an existing
MS-DOS 6.22 environment or installing IBM OS/2 on a removable medium to
influence to drive letter assignment during installation). It's also
possible to delete any (primary only!) entries and recreating them later. If
you use exactly the same number of cylinders and starting cylinder itself
with the same fstype itself (for example 0x6 for DOS FAT 16bit), you will
find your filesystem's content without damages. :-)

Prerequisites for a successful recovery are to know the *exact* layout: What
was primary partition? What was on a logical drive? How many cylinders
(exact numbers!) had every partition. A good tip for preventation: Make a
"p" (Print partition table) inside "fdisk", you will get a valueful
documentation for printing out and storing on a safe place.

Because you only known the approximate sizes: You only can try working by
"trial and error": fsck will savely report "bad superblock" when you choosed
the wrong start cylinder. Note that you may run fsck in "read only" mode!
When you found the superblock, then you will get an appropriate message that
the file system size differs so try different sizes until fsck does not
longer shows any messages.

I know that in such a process, it's easy to even destroy more than recover.
So if you have a secound harddisk drive where there's at least so much free
space as the size of your destroyed disk drive, then you can make a backup
with

dd if=/dev/hda of=/mnt/fullsave/fullsave_disk_c.bin

Do this *before* every kind of recovery attempt! This saves *every* sector,
so you can restore to the state like at the beginning to get a further
chance for restoring when something went wrong by using "dd
if=/mnt/fullsave/fullsave_disk_c.dat of=/dev/hda".

                 Andreas

 
 
 

HELP - LOST LINUX TO PARTITION TABLE WIPEOUT!!

Post by p_tux_ne » Thu, 23 Mar 2000 04:00:00


Thank you very much for your help.  Since then, there have been a
couple of developments.

I have used diskedit.exe (part of Norton Utilities) to create an
extended partition entry covering all the remaining space (up to the
1024 cylynder limitation).  My Boot Magic can now see my linux
partition and I can boot from it.  The problem is that Partition Magic
now complains.  The reason why it complains is that it says that the
partitions within the extended partition exceed the upper limit of the
extended partition itself (again, this is because of the 1024 cylinder
limit).  I feel like something was done to get around this when the
extended partition was created the first time, but since my repair,
that has kind of gone out of synch.

-> I don't know enough about extended partitions, but can anyone help
me with this and tell me what I need to fix so that it doesn't look
like the partitions within the extended partition are going beyond the
upper limit of the extended partition itself?

Also, since recreating the extended partition, I was able to run
partinfo (part of the Partition Magic suite) and obtain the exact
location of the various sectors.  Here is the data:

============================================================================================

Partition Information for Disk 1:    13481.0 Megabytes

Volume  PartitionType   Status  Size MB PartSect        #
StartSect       TotalSects      UsedSects       FreeSects
============================================================================================

*:EMPTY Hidden FAT16B   Pri     2037.6  0       0       63
4,173,057       4,173,057       0
C:WIN98_HDA1    FAT32   Pri,Boot        3802.1  0       1
4,173,183       7,786,737       3,985,158       3,801,579
*:TMP98_HDA1    Hidden FAT32    Pri     1388    0       2
11,959,920      2,842,560       1,827,972       1,014,588
        Extended        Pri     332.2   0       3       14,802,480
680,400 680,400 0
        EPBR    Log     4732.4  None    --      14,802,480
9,691,920       9,691,920       0
Warning #113: EPBR partition starting at 14802480 overlaps extended
partition.

        Linux Ext2      Log     4732.4  14802480        0
14,802,543      9,691,857       3,135,047       6,556,810
Error #113: Logical starting at 14802543 overlaps extended partition.

        Free Space      Pri     5921    None    --      15,482,880
12,126,240      0       12,126,240
        EPBR    Log     132.9   14802480        1       24,494,400
272,160 272,160 0
Warning #113: EPBR partition starting at 24494400 overlaps extended
partition.

        Linux Swap      Log     132.9   24494400        0
24,494,463      272,097 272,097 0
Error #113: Logical starting at 24494463 overlaps extended partition.

        EPBR    Log     1388    24494400        1       24,766,560
2,842,560       2,842,560       0
Warning #113: EPBR partition starting at 24766560 overlaps extended
partition.

D:WIN98_HDA2    FAT16B  Log     1387.9  24766560        0
24,766,623      2,842,497       351,735 2,490,762
Error #113: Logical starting at 24766623 overlaps extended partition.

QEUSTION -> I guess I have the sector numbers to rebuild the table
with linux fdisk now.  Are we absolutely sure that linux fdisk is NOT
like dos fdisk and it only touches the partition tables, leaving the
boot sectors alone?

PS -> I cannot dd to another hard disk.  I forgot to mention that this
is a laptop (yes, with a 14Gb hard disk).



>p_tux_news (p_tux_news) schrieb in Nachricht

>>My disk structure was as follows (approximate sizes):
>> 14Gb hard disk:
>> 2.0Gb FAT16 partition (NT4 Server)
>> 3.8Gb FAT32 partition (Windows 98 SE)
>> 1.4Gb FAT32 partition (Windows 98 SE)
>> 5.7Gb externded partition:
>> 3.8Gb linux ext2 partition
>> 128Mb linux swap partition
>> 1.4Gb logical d: FAT16 partition

>Linux has a *powerful* fdisk command where you can do nearly everything.
>Another benefit of Linux's "fdisk" is the fact that it modifies only the
>partition table sector, *not* the content itself. Microsft's FDISK.EXE for
>example always overwrites the first sector so remaining data are lost. In
>Linux for example, I also often have "hiddened"/"disabled" partition (for
>example installing a Windows 98 which should not fiddle on an existing
>MS-DOS 6.22 environment or installing IBM OS/2 on a removable medium to
>influence to drive letter assignment during installation). It's also
>possible to delete any (primary only!) entries and recreating them later. If
>you use exactly the same number of cylinders and starting cylinder itself
>with the same fstype itself (for example 0x6 for DOS FAT 16bit), you will
>find your filesystem's content without damages. :-)

>Prerequisites for a successful recovery are to know the *exact* layout: What
>was primary partition? What was on a logical drive? How many cylinders
>(exact numbers!) had every partition. A good tip for preventation: Make a
>"p" (Print partition table) inside "fdisk", you will get a valueful
>documentation for printing out and storing on a safe place.

>Because you only known the approximate sizes: You only can try working by
>"trial and error": fsck will savely report "bad superblock" when you choosed
>the wrong start cylinder. Note that you may run fsck in "read only" mode!
>When you found the superblock, then you will get an appropriate message that
>the file system size differs so try different sizes until fsck does not
>longer shows any messages.

>I know that in such a process, it's easy to even destroy more than recover.
>So if you have a secound harddisk drive where there's at least so much free
>space as the size of your destroyed disk drive, then you can make a backup
>with

>dd if=/dev/hda of=/mnt/fullsave/fullsave_disk_c.bin

>Do this *before* every kind of recovery attempt! This saves *every* sector,
>so you can restore to the state like at the beginning to get a further
>chance for restoring when something went wrong by using "dd
>if=/mnt/fullsave/fullsave_disk_c.dat of=/dev/hda".

>                 Andreas

write to p_tux_news living at yahoo.com

linux: the revenge of the nerds!!

 
 
 

1. HELP!! - LOST LINUX TO PARTITION TABLE WIPEOUT

I have lost my linux entry in a partition table wipeout caused by a
crash.

This is what happened:
- crash corrupted my partition table
- partition table was rebuilt using Norton Utilities' command "ndd
/rebuild" which was very good at restoring the windows fat partition,
but not the linux ones (on top of that it overwrote the partition
table)
- I don't have a backup of the partition table (stupid, stupid, would
have been so easy with Norton Utilities which is installed!!)

My disk structure was as follows (approximate sizes):
        14Gb hard disk:
                2.0Gb FAT16 partition (NT4 Server)
                3.8Gb FAT32 partition (Windows 98 SE)
                1.4Gb FAT32 partition (Windows 98 SE)
                5.7Gb externded partition:
                        3.8Gb linux ext2 partition
                        128Mb linux swap partition
                        1.4Gb logical d: FAT16 partition

The above my not add up exactly, but they are fairly correct.  I use
Boot Magic.

I have actually read documentation on how to rebuild my partition
table, and feel like I could have a shot at it, but my problem is that
I CANNOT FIND THE LINUX PARTITION.  I have searched for the 55 AA hex
codes usind Norton Utilities diskedit, but it returns quite a few of
them (yes, there are quite a few even if I look that they have some
boot messages on the ascii part of diskedit).

What I need is the following:
1. a system or a utility to help me find the linux partition
2. a system or a utility to help me recreate the partition table

I have put a huge amount of work in my linux partition and I would
really appreciate any help on this subject so I can avoid rebuilding
this sytem.

The tools I have at my disposal are:
- Norton Utilities (includes ndd, diskedit)
- Partition Magic 4.0

Thank you all in advance
write to p_tux_news living at yahoo.com

linux: the revenge of the nerds!!

2. Firewall & NetBus

3. help - please urgent help needed to get back the lost or corrupted partition table

4. Transform IP numbers

5. Lost Partition Table/How to find partition boundaries

6. pppd problems

7. Lost partition table:help!

8. Festfrequenzmonitor

9. Please help with lost partition table !!!

10. NEED HELP, lost partition table

11. Lost Partition Table [HELP!]