[SLE] Desperate situation: partition table is gone
I have windows :( and Suse 5.3 :) on the same disk. I got a virus on the windows partition and I cleaned it with McAfee VirusScan. It happened that the virus was in the "partition table" and McAfee removed the partition table, and replaced it by one which contains only one DOS-16 partition. What can I do ? Is it possible to retrieve the old information of the partition table ? Thank you a lot. Daciana ======================================================= DACIANA BOCHIS Universidad de Cantabria, Facultad de Ciencias, Departamento de Matematicas, Estadistica y Computacion, Santander, SPAIN ======================================================= -- To unsubscribe send e-mail to suse-linux-e-unsubscribe@suse.com For additional commands send e-mail to suse-linux-e-help@suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/
Daciana Bochis wrote:
I have windows :( and Suse 5.3 :) on the same disk. I got a virus on the windows partition and I cleaned it with McAfee VirusScan. It happened that the virus was in the "partition table" and McAfee removed the partition table, and replaced it by one which contains only one DOS-16 partition. What can I do ? Is it possible to retrieve the old information of the partition table ?
Thank you a lot.
Yes, you can. There is an EXCELLENT paper available on the web which outlines how trashed partition tables can be repaired. I have the document at home, and will post it's URL tomorrow. The basic outline is: - Empty the partition table to start with a clean sleeve (write 512 null bytes) - Take Norton's Disk Editor and have it find the partition bounderies - Enter the found partition bounderies in the partition table So, the only prerequisite is that you vaguely know where your partitions were. NDE will find the bounderies and you only have to decide if these are correct. You can safely try other suggestions without penalty :-) Koos Pol ---------------------------------------------------------------------- S.C. Pol T: +31 20 3116122 Systems Administrator F: +31 20 3116200 Compuware Europe B.V. E: koos_pol@nl.compuware.com Amsterdam PGP public key available -- To unsubscribe send e-mail to suse-linux-e-unsubscribe@suse.com For additional commands send e-mail to suse-linux-e-help@suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/
On Tue, 1 Feb 2000, Koos Pol wrote:
Daciana Bochis wrote:
I have windows :( and Suse 5.3 :) on the same disk. I got a virus on the windows partition and I cleaned it with McAfee VirusScan. It happened that the virus was in the "partition table" and McAfee removed the partition table, and replaced it by one which contains only one DOS-16 partition. What can I do ? Is it possible to retrieve the old information of the partition table ?
Thank you a lot.
Yes, you can. There is an EXCELLENT paper available on the web which outlines how trashed partition tables can be repaired. I have the document at home, and will post it's URL tomorrow. The basic outline is: - Empty the partition table to start with a clean sleeve (write 512 null bytes) - Take Norton's Disk Editor and have it find the partition bounderies
Interesting to know this information is recoverable. I wonder if there is a linux tool that can do this... Of course, the best solution is to have a hardcopy printout of your partition table, as the SuSe manual recommends, or be _sure_ about the exact sequence and sizes of your partitions.
- Enter the found partition bounderies in the partition table
This is probably not enough. Using linux "fdisk" you have to specify correctly the partition types for linux partitions, including the swap. It is important to remember that the partitions are recoverable only as long as you haven't written anything to the area of the disk where they are. I would recommend to boot linux in rescue mode (the 6.3 version does this nicely with the installation floppy, I don't know about 5.3) and to try to mount the partitions in readonly mode e.g. mount -t ext2 -o ro /dev/hda5 /mnt # replace hda5 by your linux partition ls -l /mnt if your files are listed, you are probably OK. If not, the partition table is not as it should be! It's probably a good idea to run fsck also, but in a readonly mode at first, in case some of the partition boundaries are wrong. Good luck, Teddy -- To unsubscribe send e-mail to suse-linux-e-unsubscribe@suse.com For additional commands send e-mail to suse-linux-e-help@suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/
Here is the promised URL for the partition rescue paper. http://www.datarescue.com/partition.htm I used it with great succes. Thanks to a very stupid mistake, I trashed my partition table including the partition boot block of a HPFS partition. With an HPFS tool I recreated the boot block of the HPFS partion. Afterwards I used the aforementioned paper to repair the partition table and got it all up and running again! Lost nothing!! It was hard manual labour and cost me several nights, but then again.... :-) Koos Pol ---------------------------------------------------------------------- S.C. Pol T: +31 20 3116122 Systems Administrator F: +31 20 3116200 Compuware Europe B.V. E: koos_pol@nl.compuware.com Amsterdam PGP public key available -- To unsubscribe send e-mail to suse-linux-e-unsubscribe@suse.com For additional commands send e-mail to suse-linux-e-help@suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/
Daciana Bochis wrote:
I have windows :( and Suse 5.3 :) on the same disk. I got a virus on the windows partition and I cleaned it with McAfee VirusScan. It happened that the virus was in the "partition table" and McAfee removed the partition table, and replaced it by one which contains only one DOS-16 partition. What can I do ? Is it possible to retrieve the old information of the partition table ?
It is possible, and it *can* be quite easy (although very nerve-wracking) to recover the partition table. However, in order to have a (relatively) easy life, you need to know the *exact* sizes of the partitions. You don't happen to know where the cylinder boundaries are for the partitions do you? Good luck, Chris -- __ _ -o)/ / (_)__ __ ____ __ Chris Reeves /\\ /__/ / _ \/ // /\ \/ / ICQ# 22219005 _\_v __/_/_//_/\_,_/ /_/\_\ -- To unsubscribe send e-mail to suse-linux-e-unsubscribe@suse.com For additional commands send e-mail to suse-linux-e-help@suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/
participants (4)
-
chris.reeves＠iname.com -
dacib＠hall.matesco.unican.es -
koos.pol＠nl.compuware.com -
Theodore.Todorov＠cern.ch