Hi there, Hmm, not sure about this one, kind of in doubt here, but I know that 'fdisk /mbr' writes a new master boot record to the HD and I think it also checks the disk for the partitions and writes a new partition table with what it finds. Guess it would really hurt to try though, but remember that if you installed LILO in the MBR, it'll be gone after this. If I'm wrong about the partition table, please tell me... See ya, Emerald P.S.: If you have partition magic, you can run a check on your HD and it'll tell you if there's something wrong with your partition table or anything else, but you can also use the SuSE cd's for this (just go through the installation untill it asks where you want to install, there'll be an output of fdisk) Jason wrote:

Hi people.

I believe a Win virus did some serious damage to my drive. I used to have around 10 logical linux partitions, now they're all gone (after using Win98).

The primary partition (/dev/hda1) is still there. The extended partition is still there (no logicals now).

What I don't have is a rescue disk.

What I do have are the start and end cylinder values for each partition, the size of them, the device they're associated with, their mount points, and inode densities.

The data is still there (I feel) - but the partition table is corrupt.

Any way of fixing it?? (I remeber on a previous occasion, I tried using fdisk to recreate the partitions, using the start and end cylinder values I had - and it partially worked.. should I try this again??)

Any help would be greatly appreciated.

Regards, Jason.

-- To unsubscribe send e-mail to suse-linux-e-unsubscribe@suse.com For additional commands send e-mail to suse-linux-e-help@suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

Ok, iv'e re-entered the apporpriate cylinder boundary values, and written the partition to disk (and rebooted). Here's what it looks like now: Disk /dev/hdc: 255 heads, 63 sectors, 784 cylinders Units = cylinders of 16065 * 512 bytes Device Boot Start End Blocks Id System /dev/hdc1 * 1 127 1020096 6 FAT16 /dev/hdc2 624 784 1293232+ 83 Linux /dev/hdc4 128 637 4096575 5 Extended /dev/hdc5 128 129 16033+ 83 Linux /dev/hdc6 130 193 514048+ 83 Linux /dev/hdc7 194 321 1028128+ 83 Linux /dev/hdc8 322 334 104391 83 Linux /dev/hdc9 335 589 2048256 83 Linux /dev/hdc10 590 606 136521 82 Linux swap /dev/hdc11 607 623 136521 82 Linux swap Keep in mind devs 5-11 were re-created by me. /dev/hdc2 somehow partially survived. /dev/hdc4 had correct cylinder boundary vals so I left that alone. BUT, some block totals are off by 1 (/dev/hdc8 should be 104390, /dev/hdc9 should be 2048255, hdc10 and hdc11 should be 136520. When I try mounting them (as an ext2) i'm receiving: mount: wrong fs type, bad option, bad superblock on /dev/hdc6, or too many mounted file systems The only affected device that mounts is /dev/hdc10 - its shows me the lost+found directory. Any tips greatly appreciated. On Fri, 3 Mar 2000, Chris Reeves wrote:

Emerald wrote:

...

Hmm, not sure about this one, kind of in doubt here, but I know that 'fdisk /mbr' writes a new master boot record to the HD and I think it also checks the disk for the partitions and writes a new partition table with what it finds. Guess it would really hurt to try though, but remember that if you installed LILO in the MBR, it'll be gone after this.

If I'm wrong about the partition table, please tell me...

Well, I'm telling you ;-) fdisk /mbr will *not* rebuild your partition table, it only zeros the MBR. In this case, I don't think I'd use fdisk /mbr at all.

...

P.S.: If you have partition magic, you can run a check on your HD and it'll tell you if there's something wrong with your partition table or anything else, but you can also use the SuSE cd's for this (just go through the installation untill it asks where you want to install, there'll be an output of fdisk)

Jason wrote:

...

I believe a Win virus did some serious damage to my drive. I used to have around 10 logical linux partitions, now they're all gone (after using Win98).

The primary partition (/dev/hda1) is still there. The extended partition is still there (no logicals now).

What I don't have is a rescue disk.

Well, what you can do is boot of the CD and select 'Start Rescue System' or something similar. This will let you boot of your harddrive (assuming / is the partititon that survived, hda1). You just need to get access to fdisk somehow.

...

...

What I do have are the start and end cylinder values for each partition, the size of them, the device they're associated with, their mount points, and inode densities.

This is excellent news!! I doubt that a Windows virus could do anything to the data on your Linux partitions, unless it really tried, so it's probably just the partition table that is nackered. Since you have the start and end cylinder values for your partitions (that was very wise of you to note them down ;->> ) you should be able to just start up fdisk ('fdisk /dev/hda') and recreate your partitions with the *exact* same cylinder values. But then again, it sounds like you've done this before...

...

...

The data is still there (I feel) - but the partition table is corrupt.

I would definitely agree here. I'd say this situation is 90% recoverable, mainly due to the fact that you've got those cylinder boundaries noted down...

...

...

Any way of fixing it?? (I remeber on a previous occasion, I tried using fdisk to recreate the partitions, using the start and end cylinder values I had - and it partially worked.. should I try this again??)

Yes, but be carefull and make sure you get it right!

Good luck! And remember - any problems, you know who to call... Chris -- __ _ -o)/ / (_)__ __ ____ __ Chris Reeves /\\ /__/ / _ \/ // /\ \/ / ICQ# 22219005 _\_v __/_/_//_/\_,_/ /_/\_\

-- To unsubscribe send e-mail to suse-linux-e-unsubscribe@suse.com For additional commands send e-mail to suse-linux-e-help@suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

Jason wrote:

Ok, iv'e re-entered the apporpriate cylinder boundary values, and written the partition to disk (and rebooted). Here's what it looks like now:

Disk /dev/hdc: 255 heads, 63 sectors, 784 cylinders Units = cylinders of 16065 * 512 bytes

Device Boot Start End Blocks Id System /dev/hdc1 * 1 127 1020096 6 FAT16 /dev/hdc2 624 784 1293232+ 83 Linux /dev/hdc4 128 637 4096575 5 Extended /dev/hdc5 128 129 16033+ 83 Linux /dev/hdc6 130 193 514048+ 83 Linux /dev/hdc7 194 321 1028128+ 83 Linux /dev/hdc8 322 334 104391 83 Linux /dev/hdc9 335 589 2048256 83 Linux /dev/hdc10 590 606 136521 82 Linux swap /dev/hdc11 607 623 136521 82 Linux swap

Keep in mind devs 5-11 were re-created by me. /dev/hdc2 somehow partially survived. /dev/hdc4 had correct cylinder boundary vals so I left that alone.

BUT, some block totals are off by 1 (/dev/hdc8 should be 104390, /dev/hdc9 should be 2048255, hdc10 and hdc11 should be 136520.

Hmmm. I don't know how to correct this (although I assume it's possible somehow). Maybe it just calculates these from the values it's given, and so this isn't actually written down anywhere, but just giving you an idea... probably not though.

When I try mounting them (as an ext2) i'm receiving: mount: wrong fs type, bad option, bad superblock on /dev/hdc6, or too many mounted file systems

Well, if the blocks really are offset by one, then it may be looking in the wrong place for the superblock. However, since this is /dev/hda6 we are looking at, which has the right block values, according to you, this could just be a bad superblock. The ext2 filesystem has more that one superblock (in fact it has quite a few, spaced reasonably regularly throughout the partition). If it really was a bad superblock, I would try and copy one of the other ones overe the main one (or run e2fsck, which might fix it automatically). In fact, out of interest, have you tried running e2fsck on any of those partitions yet? I'm not 100% sure whether it's safe or not, due to the block offsets (if your blocks were all correct, I would say definitely go for it), but if you are willing, you could try it. Please, if there's anyone on the list who knows that now is *not* a good time to run e2fsck, could you raise your hand or shout out?

The only affected device that mounts is /dev/hdc10 - its shows me the lost+found directory.

Hmmm. You've got /dev/hda10 listed as a swap partition in your partition table. I didn't realise swap partitions could be mounted, or is there just some confusion here? Just out of interest - do you have a backup at all? It really is a shame that this didn't sort itself out nice and easily. I've never had a problem with this so far. It would be great if someone know how to fix the number of blocks...

On Fri, 3 Mar 2000, Chris Reeves wrote:

...

Emerald wrote:

...

Hmm, not sure about this one, kind of in doubt here, but I know that 'fdisk /mbr' writes a new master boot record to the HD and I think it also checks the disk for the partitions and writes a new partition table with what it finds. Guess it would really hurt to try though, but remember that if you installed LILO in the MBR, it'll be gone after this.

If I'm wrong about the partition table, please tell me...

Well, I'm telling you ;-) fdisk /mbr will *not* rebuild your partition table, it only zeros the MBR. In this case, I don't think I'd use fdisk /mbr at all.

...

P.S.: If you have partition magic, you can run a check on your HD and it'll tell you if there's something wrong with your partition table or anything else, but you can also use the SuSE cd's for this (just go through the installation untill it asks where you want to install, there'll be an output of fdisk)

Jason wrote:

...

I believe a Win virus did some serious damage to my drive. I used to have around 10 logical linux partitions, now they're all gone (after using Win98).

The primary partition (/dev/hda1) is still there. The extended partition is still there (no logicals now).

What I don't have is a rescue disk.

Well, what you can do is boot of the CD and select 'Start Rescue System' or something similar. This will let you boot of your harddrive (assuming / is the partititon that survived, hda1). You just need to get access to fdisk somehow.

...

...

What I do have are the start and end cylinder values for each partition, the size of them, the device they're associated with, their mount points, and inode densities.

This is excellent news!! I doubt that a Windows virus could do anything to the data on your Linux partitions, unless it really tried, so it's probably just the partition table that is nackered. Since you have the start and end cylinder values for your partitions (that was very wise of you to note them down ;->> ) you should be able to just start up fdisk ('fdisk /dev/hda') and recreate your partitions with the *exact* same cylinder values. But then again, it sounds like you've done this before...

...

...

The data is still there (I feel) - but the partition table is corrupt.

I would definitely agree here. I'd say this situation is 90% recoverable, mainly due to the fact that you've got those cylinder boundaries noted down...

...

...

Any way of fixing it?? (I remeber on a previous occasion, I tried using fdisk to recreate the partitions, using the start and end cylinder values I had - and it partially worked.. should I try this again??)

Hope that helps some more, and I hope you manage to scrape some good luck together... Chris -- __ _ -o)/ / (_)__ __ ____ __ Chris Reeves /\\ /__/ / _ \/ // /\ \/ / ICQ# 22219005 _\_v __/_/_//_/\_,_/ /_/\_\ -- To unsubscribe send e-mail to suse-linux-e-unsubscribe@suse.com For additional commands send e-mail to suse-linux-e-help@suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/