Corrupt Partition Table Recovery.

2004 Dec 2 at 21:24 » Tagged as :

This is the story of a corrupt partition table recovery in linux, a story with a happy ending.

The hard disk in question was a 40Gg Maxtor, after one of it's partitions was deleted fdisk started reporting a partition which was well in excess of the disk size. The result was a system that refused to boot, recovery proved to be quite a strugle.

Fedora Core installer only gives you the option of choosing between ext2 and ext3 for your filesystem. The better journaling file system for linux however is reiserfs. So there I was pruning and grafting my partitions trying migrate them from ext3 to reiser when the partition table became damaged.

As a first step parted was tried and failed because it refused to work with a slice that was larger than the physical disk size. The second attempt involved gpart, which did look the part. After a scan it produced a report that resembled the last valid partition table but I didn't have the confidence to proceed with it because gpart does not officially support ext3.

However gpart did give me enough information to realise that if I deleted the offending partition, which appeared after all others, I might be able to recover the rest. So it was fdisk that was called up again to delete the unwanted partition, that didn't solve all the problems because the so called secondary partition now appeared to be flattened and it's individual slices (logical drives) were not showing up.

parted was called on once again, this time to attempt to recover the logical drives. The approach is to run the rescue command of parted. It requires a start and end parameter (both in megabytes). It's safe to use the end value for the primary partition for the start parameter, the end parameter has to be guessed from the approximate size of the hard disk.

This is the approach I adapted after increasing the ending value by small amounts and running the rescue command several times it finally detected the frist slice with in the secondary partition which I promptly recovered and fscked. The rest I don't really care about and abandoned it.

Of course both these programs were exectued after booting the system with a rescue cd. Instead of a rescue CD you could use a live linux cd such as knoppix if one is avaialable. Not writing anything at all to the hard disk is crucial if you want to recover your data, since knoppix and rescue CDs write their data to a ram disk they are safe to use.

The reiserfs home page is at http://www.namesys.com/, it's amazing how many sites errornously link to http://www.reiserfs.org instead. Be warned that the above site takes an eternity to load if you are on a slow connection.