[Techtalk] Partitioning issues.

[Travis Casey]

Friday, July 25, 2003, 12:27:00 PM, Staci wrote:
> On Fri, 25 Jul 2003, Travis Casey wrote:

>> was on a Trustix Linux system, using fdisk.  Once I re-entered the
>> partition table information, all was well.

> And how exactly did you dO that?  Not by just remaking the partition using fdisk.....

That was all I did.  There was no damage to the disk or the data --
someone else who works here had just overwritten the partition table,
but hadn't tried to mount it, fsck it, or anything like that.

Note that there's a command-line flag to fdisk to tell it to use
either cylinders or sectors as units.  If the initial partitioning was
done with fdisk -u (which does it by sectors), then it may not be
possible to restore the same partitions without using the -u option
again.

One possibility that comes to mind, but which I can't really be sure
of without testing, is that some distributions might use the -u option
to be able to use more space on the disk.  If only cylinder boundaries
can be used, then without -u, one might have to leave the entire first
cylinder untouched so that the MBR and partition table can sit there.
With -u, it might be able to put the start of the first partition
right after those.

Note as well that the filesystems will have to be marked with the
appropriate tags:  82 for Linux swap, 83 for Linux "regular"
partitions.

The Partition-Rescue HOWTO

  http://www.tldp.org/HOWTO/Partition-Rescue/index.html

mentions simply re-running fdisk as one way to recover, if you have
the data about where the partition(s) started and ended.  Note that
the author says he's done it successfully multiple times.

There's also a section "Recovering a Deleted Partition" in the Linux
Partition HOWTO:

  http://www.tldp.org/HOWTO/Partition/recovering.html

There again, fdisk is used to re-create the old partition table.

>> I know that in the Windows world, there are utilities specifically for
>> backing up and restoring partition tables, since some viruses destroy
>> the partition table, but not the data on the disk.
>>
>> A web search turned up gpart:
>>
>>   http://www.stud.uni-hannover.de/user/76201/gpart/

> I have gpart, but it gives me this:

[snip table]

> And I really think that would be a bad idea to write to the partition
> table. :P

Well, it certainly wouldn't be of any help.  Have you tried it with
the -f option, to tell it to use the "slow" method?  From the docs, it
does some skipping around heuristically by default to make it faster,
which may keep it from finding things in some situations.

For a last note, there's more than one kind of partition table.
Everything I can find for Linux seems to talk about the MS-DOS type,
but fdisk also understands BSD and Solaris partition tables.  I don't
know whether the Linux kernel does.  Gpart only understand MS-DOS
ones.

-- 
Travis Casey
efindel at earthlink.net