Ubuntu_User

Restore a drive/partition from backup partition table entries

In Recovery on July 29, 2009 at 11:51 am

Having detailed knowledge of your partition table is worth it’s weight in gold if you’re ever faced with a disk that just lost its partition table entries.

I was recently faced with such a tragedy, and I was only saved by virtue of the fact that I had the partition table entries to hand. I had just deleted an ext3 partition on my external drive using the Gnome Partition Editor, and then queued up two operations:

  1. Create a fat32 file system in its place
  2. Assign it a label

When I applied these operations – BOOM! – the whole partition table on the external drive just disappeared. This was the drive that held my personal data, my photos and my entire media collection – basically any data of value to me. Thankfully, I had a backup of my partition table entries and instructions on how to recreate the partition table using these entries.

So, remember to back up your partition table entries to a file and store it offsite or at multiple locations on your home network. These days there are plenty of free offsite backup options like Dropbox and Ubuntu One, so there is never an excuse not to.

Backing up your partition table

We’ll use the gpart utility to get a snapshot of the partition table, so install the package of the same name if you don’t find the gpart command on your system.


sudo apt-get install gpart

Next, run it against the disk who’s partition table needs to be backed up. Remember to do this against every disk you have, and to do this every time you change the partition table on a disk.

If you’re not sure which device corresponds to which drive, the mount command is your friend:


$ mount
/dev/sda5 on / type ext3 (rw,relatime,errors=remount-ro)
tmpfs on /lib/init/rw type tmpfs (rw,nosuid,mode=0755)
proc on /proc type proc (rw,noexec,nosuid,nodev)
sysfs on /sys type sysfs (rw,noexec,nosuid,nodev)
varrun on /var/run type tmpfs (rw,nosuid,mode=0755)
varlock on /var/lock type tmpfs (rw,noexec,nosuid,nodev,mode=1777)
udev on /dev type tmpfs (rw,mode=0755)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
devpts on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=620)
fusectl on /sys/fs/fuse/connections type fusectl (rw)
lrm on /lib/modules/2.6.28-14-generic/volatile type tmpfs (rw,mode=755)
/dev/sda2 on /media/sda2 type fuseblk (rw,nosuid,nodev,allow_other,blksize=4096)
securityfs on /sys/kernel/security type securityfs (rw)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noexec,nosuid,nodev)
//192.168.1.77/HDD_1_1_1 on /media/Elements1 type cifs (rw,mand,noexec,nosuid,nodev)
//192.168.1.77/HDD_1_1_2 on /media/Elements2 type cifs (rw,mand,noexec,nosuid,nodev)
192.168.1.77:/share/hdd/data/HDD_1_1_1 on /media/HDD_1_1_1 type nfs (rw,users,noexec,nosuid,nodev,intr,addr=192.168.1.77)
192.168.1.77:/share/hdd/data/HDD_1_1_2 on /media/HDD_1_1_2 type nfs (rw,users,noexec,nosuid,nodev,intr,addr=192.168.1.77)
192.168.1.77:/share/hdd/data/HDD_1_1_3 on /media/HDD_1_1_3 type nfs (rw,users,noexec,nosuid,nodev,intr,addr=192.168.1.77)

Once you’ve identified a disk, e.g /dev/sdb, it’s time to run the gpart command to reveal it’s partition table:


$ sudo gpart /dev/sdb

Begin scan...
Possible partition(Linux ext2), size(410002mb), offset(0mb)
Possible partition(DOS FAT), size(410002mb), offset(410002mb)
Possible partition(Linux ext2), size(133861mb), offset(820005mb)
End scan.

Checking partitions...
Partition(Linux ext2 filesystem): primary
Partition(DOS or Windows 95 with 32 bit FAT, LBA): primary
Partition(Linux ext2 filesystem): primary
Ok.

Guessed primary partition table:
Primary partition(1)
 type: 131(0x83)(Linux ext2 filesystem)
 size: 410002mb #s(839685352) s(63-839685414)
 chs:  (0/1/1)-(1023/254/63)d (0/1/1)-(52267/254/58)r

Primary partition(2)
 type: 012(0x0C)(DOS or Windows 95 with 32 bit FAT, LBA)
 size: 410002mb #s(839685420) s(839685420-1679370839)
 chs:  (1023/254/63)-(1023/254/63)d (52268/0/1)-(104535/254/63)r

Primary partition(3)
 type: 131(0x83)(Linux ext2 filesystem)
 size: 133861mb #s(274149224) s(1679370840-1953520063)
 chs:  (1023/254/63)-(1023/254/63)d (104536/0/1)-(121600/254/62)r

Primary partition(4)
 type: 000(0x00)(unused)
 size: 0mb #s(0) s(0-0)
 chs:  (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Backup this information to a file and store in a secure location.

Restoring a drive from partition table entries

Next we want to restore the partition table from the entries we backed up earlier. For this we need the parted command. If your Linux machine is unusable (because it was on the disk you wish to recover), consider creating an Ubuntu LiveCD using someone else’s computer and running that on your machine to get to a terminal where you can run parted. You do not need Ubuntu as such; all we need is a distro with the ability to run the parted command.

Once you are on a terminal:

  • Run the command sudo parted /dev/sdb.  It’ll drop you into the parted command shell, on a new line with the (parted) prompt
  • Enter “unit s” on the prompt to tell parted to use sectors as the unit to configure the partition table.
  • Enter “print” to check the disk details and confirm that you have the correct disk.
  • Next, type “rescue“. It should give you a Start? prompt. Enter the starting sector of the first partition from the partition table backup file.  It next prompts you for the ending sector: End?. Provide the ending sector for the partition. Referring to the example below, the first partition ranges from sector 63 to 839685414  “s(63-839685414)” as evidenced by this snippet from earlier:
Primary partition(1)
 type: 131(0x83)(Linux ext2 filesystem)
 size: 410002mb #s(839685352) s(63-839685414)
 chs:  (0/1/1)-(1023/254/63)d (0/1/1)-(52267/254/58)r
  • If all goes well, it should respond by saying something like “A ext3 primary partition was found at 63s -> 839685414s.  Do you want to add it to the partition table? Yes/No/Cancel?“. Say Yes and proceed.
  • Follow these steps for each partition you had on the disk.
  • Once done, type “quit” to exit the parted command.

For more detailed instructions on recovering lost partitions, look at the Ubuntu Data Recovery Community Guide.

Provided below is a sample output of a recovery session:


$ sudo parted /dev/sdb
GNU Parted 1.8.8
Using /dev/sdb
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) unit s                                                           
(parted) print                                                            
Model: WD 10EAVS External (scsi)
Disk /dev/sdb: 1953525168s
Sector size (logical/physical): 512B/512B
Partition Table: msdos

Number  Start  End  Size  Type  File system  Flags

(parted) rescue                                                           
Start? 63                                                                 
End? 839685414                                                            
Information: A ext3 primary partition was found at 63s -> 839685414s.  Do you want to add it to the partition table?
Yes/No/Cancel? yes                                                        
(parted) rescue                                                           
Start? 839685420                                                          
End? 1679370839                                                           
Information: A fat32 primary partition was found at 839685420s -> 1679370839s.  Do you want to add it to the partition
table?
Yes/No/Cancel? yes                                                        
(parted) rescue                                                           
Start? 1679370840                                                         
End? 1953520063                                                           
Information: A ext2 primary partition was found at 1679370840s -> 1953520063s.  Do you want to add it to the partition
table?
Yes/No/Cancel? yes                                                        
(parted) quit                                                             
Information: You may need to update /etc/fstab.

About these ads

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

%d bloggers like this: