If you have ever made a typo when deleting or
restoring the MBR, you probably also have trashed your partition
table. Use gpart, included on the Knoppix disc, to restore lost
partition tables.
you had a little too much fun with the previous hack, ignored the
warnings, accidentally typed 512 when you should have typed 446, and
now your partition table is gone. Or maybe you accidentally ran
fdisk on the wrong drive. No problem. Just
restore from the backup you made before you started. You did back up
your MBR, right? Don’t worry; it happens to the best
of us. The last time I trashed my partition table, I was trying to
update grub on my laptop using
dd. Like an idiot, I followed the instructions
to create a grub boot floppy and applied them to
install grub on my laptop’s
hard drive. Overwriting the first 512 bytes of a
floppy with the grub boot
sector is fine; overwriting the first 512 bytes of my hard
drive is not. I was unable to boot and had no partition
table. For many people, this might have been the time to reinstall,
but I knew the files and partitions were there—I just
couldn’t get to them. If only I had a tool to figure
out where the partitions began and ended, I could then recreate my
partition table and everything would be back to normal.
Lucky for me, there is such a tool:
(short for “guess partition”).
Gpart scans a hard drive for signs of a
partition’s start by comparing a list of
filesystem-recognition modules it has with the sectors it is
scanning, and then creates a partition table based on these guesses.
Doubly lucky for me, gpart comes included with
Knoppix, so I was able to restore my laptop’s MBR
without having to take apart the laptop and hook the drive to a
desktop machine. I ran gpart, checked over its
guesses, which matched my drive, and voila! My partitions were back.
Gpart is an incredibly useful tool, and I am
grateful for it; however, it does have its limitations.
Gpart works best when you are restoring a
partition table of primary partitions. In the case of extended
partitions, gpart tries its best to recover the
partition information, but there is less of a chance of recovery.
To recover your partition table, run gpart, and
then tell it to scan your drive:
knoppix@ttyp0[knoppix]$ sudo gpart /dev/hda
By default, gpart only scans the drive and
outputs results; it does not actually write to the drive or overwrite
your MBR. This is important because gpart may
not correctly guess all of your partitions, so you should check its
guesses before you actually write them to disk.
Gpart scans through the hard drive and outputs
possible partition tables as it finds them. When it is finished
scanning the drive, gpart outputs a complete
list of partition tables it has found. Read through this list of
partitions and make sure that it reflects the partitions you have
created on the disk. It might be that gpart can
recover only some of the partitions on the drive. Once you have
reviewed the partitions that gpart has guessed,
run gpart again but with the
-W option to write the guessed partition table to
the disk:
knoppix@ttyp0[knoppix]$ sudo gpart -W /dev/hda /dev/hda
This isn’t a typo; you do actually put
/dev/hda twice in the command. You can
potentially tell gpart to write the partition
table to a second drive, based on what it detected on the first
drive. Once the partition table has been written, reboot and attempt
to access the drives again. If you get errors when mounting the
drives, check the partitioning within Knoppix with a tool like
fdisk, cfdisk, or
qtparted to see whether
gpart has incorrectly guessed where your
partition ends. I’ve had to modify a partition that
gpart ended 4 MB too early, but afterwards, the
filesystem mounted correctly, and I was able to access all of my
files.
It is scary to be in a position where you must think about
partition-table recovery. At least with Knoppix and
gpart, it’s possible to recover
the partition table without completely reinstalling the operating
system.]]>