Re: [opensuse] Partition Recovery? Is it even missing to begin with or just shifted?

On 2012-08-11 02:02, David C. Rankin wrote:

All,

My son came in and said "There's a problem with my computer can you come look?", so I asked him to tell me what the problem was, to which he replied "No, come look!"

Disaster night. I just lost my /var entirely of my main system.

250G drive should have had:

sda sda1 Primary/NTFS sda2 Extended sda5 swap sda6 / ext3 sda7 /home ext4

However, it looks like something got inserted at the beginning of the disk (or something like that) that has thrown the partition number/order information off. I've never seen anything like it. My questions are: (1) does anybody recognize what happened?;

Not really...

and (2) what can I do to attempt to recover? (which tool would be best?)

gpart or testdisk.

Device Boot Start End Blocks Id System /dev/sda1 * 29 29 0 0 Empty /dev/sda2 63 315291689 157645813+ 7 HPFS/NTFS/exFAT /dev/sda3 315291690 490223474 87465892+ f W95 Ext'd (LBA) /dev/sda5 315291753 319195484 1951866 82 Linux swap / Solaris /dev/sda6 319195548 368017019 24410736 83 Linux /dev/sda7 368017083 490223474 61103196 83 Linux

At least sda1 got erased from the table. Dunno about sda2 if it is reliable. Ignore these:

sfdisk: start: (c,h,s) expected (1023,254,63) found (1023,0,1)

Now...

----------- testdisk /list /dev/sda -----------

TestDisk 6.13, Data Recovery Utility, November 2011 Christophe GRENIER http://www.cgsecurity.org Please wait... Disk /dev/sda - 251 GB / 233 GiB - CHS 30515 255 63, sector size=512

Disk /dev/sda - 251 GB / 233 GiB - CHS 30515 255 63 Partition Start End Size in sectors 2 P HPFS - NTFS 0 1 1 19625 254 63 315291627 3 E extended LBA 19626 0 1 30514 254 63 174931785 No partition is bootable 5 L Linux Swap 19626 1 1 19868 254 63 3903732 X extended 19869 0 1 22907 254 63 48821535 6 L Linux 19869 1 1 22907 254 63 48821472 [root] X extended 22908 0 1 30514 254 63 122206455 7 L Linux 22908 1 1 30514 254 63 122206392 [home]

The problem is sda1, it is missing, and testdisk doesn't make a suggestion. fdisk said:

Device Boot Start End Blocks Id System /dev/sda1 * 29 29 0 0 Empty /dev/sda2 63 315291689 157645813+ 7 HPFS/NTFS/exFAT

I would erase it, then readd it, using fdisk, starting at 1 and ending at 62. Type I don't know, fat or ntfs. I think it may be a Windows boot partition. You can also try "gpart" to guess where the partitions would be. And do a good virus scan... some are nasty. -- Cheers / Saludos, Carlos E. R. (from 12.1 "Asparagus" GM (bombadillo))