Mailinglist Archive: opensuse (770 mails)

< Previous Next >
Re: [opensuse] Partition Recovery? Is it even missing to begin with or just shifted?

First of all: _PLEASE_ check any commands _diligently_ for correctness,
I'm quite tired now.

On Fri, 10 Aug 2012, David C. Rankin wrote:
On 08/10/2012 07:44 PM, Felix Miata wrote:
On 2012/08/10 19:02 (GMT-0500) David C. Rankin composed:
The sfdisk -l information seems to point to the problem: start: (c,h,s)
expected (1023,254,63) found (1023,1,1). How to repair that?
the process. Worse case scenario, I nuke the drive and put another
one it and go through the pain of reinstall.

Do you have space on another drive for an image?

What I think happened, is some corrupting information got written
to the first part of sda1

Actually, your drive was repartitionend and "dummy" entries in the MBR
added. As the first one points to a sector between the MBR (and
apparently after GRUB's stage 1.5), sda1 is still intact but as sda2.

that is causing the partition table to see it as a separate
partition. As such, it has renumbered the primary partition present
sda1->sda2. Since sda1 starts on sector 29 and ends on sector 29, it
looks like the answer will be along the lines of deleting sda1 and
making sure sda2 ends up back as sda1.

I'd be interested to see the actual content of the MBR and the
first EPBR:

dd if=/dev/sda of=dcr-sda-0.img bs=512 count=66
dd if=/dev/sda3 of=dcr-sda3-315291690.img bs=512 count=66
tar czf dcr-sda-imgs.tar.gz dcr-sda-0.img dcr-sda3-315291690.img

if you have time, the other EPBRs might be helpful (but the seeking is

dd if=/dev/sda of=dcr-sda-319195485.img bs=512 count=66 skip=319195485
dd if=/dev/sda of=dcr-sda-368017020.img bs=512 count=66 skip=368017020

and mail the .gz as PM (the gzipping is more for a simple "integrity"
check than for anything else ;)

Those latter 2 EPBRs are the sectors linking the "chain" of extended
partitions (logical parts), as listed as Type "X" in the output of
testdisk in your first mail. Compare:

$ echo '19869*255*63; 22908*255*63'|bc

each logical partition starts the "head" i.e. 63 sectors after the EPBR:

6 L Linux 19869 1 1 22907 254 63
X extended 22908 0 1 30514 254 63

Bad thing is: you can't access the EPBR directly as you can the first
"extended" partition (the "primary one" in the MBR, in your case now

If you have no qualms of maybe mailing me actual data, you could try
seeking (skipping) and reading by whole cylinders, which should be
much faster:

dd if=/dev/sda of=dcr-sda-319195485-cyl.img bs=8225280 count=1 skip=19869
dd if=/dev/sda of=dcr-sda-368017020-cyl.img bs=8225280 count=1 skip=22908

8225280 is 255*63*512.

You could then dd out the first sectors of each image and just mail

dd if=dcr-sda-319195485-cyl.img of=dcr-sda-319195485.img bs=512 count=66
dd if=dcr-sda-368017020-cyl.img of=dcr-sda-368017020.img bs=512 count=66

The "count=66" is for me to get the first 3 sectors of the following
FS, i.e. the ext[234]/NTFS bootsector and in your case also the
complete "weird" zero-size partitions.

Slowly I'm learning a bit more about repair, but that nagging
'uncertainty' of "do I really want to try X" certainly hangs heavy
over my head. That's why I'm hoping some smart person on the list has
done this before and can point me in the right direction :)

BTDT for myself but also for others via the -de-ML ;) But I'd like to
be more awake for that.


"Windows NT has detected the following system change:
Mouse has moved.
Click 'OK' to reboot." -- Mike Andrews
To unsubscribe, e-mail: opensuse+unsubscribe@xxxxxxxxxxxx
To contact the owner, e-mail: opensuse+owner@xxxxxxxxxxxx

< Previous Next >