Having detailed knowledge of your partition table is worth it’s weight in gold if you’re ever faced with a disk that just lost its partition table entries.
I was recently faced with such a tragedy, and I was only saved by virtue of the fact that I had the partition table entries to hand. I had just deleted an ext3 partition on my external drive using the Gnome Partition Editor, and then queued up two operations:
- Create a fat32 file system in its place
- Assign it a label
When I applied these operations – BOOM! – the whole partition table on the external drive just disappeared. This was the drive that held my personal data, my photos and my entire media collection – basically any data of value to me. Thankfully, I had a backup of my partition table entries and instructions on how to recreate the partition table using these entries.
So, remember to back up your partition table entries to a file and store it offsite or at multiple locations on your home network. These days there are plenty of free offsite backup options like Dropbox and Ubuntu One, so there is never an excuse not to.
Backing up your partition table
We’ll use the gpart utility to get a snapshot of the partition table, so install the package of the same name if you don’t find the gpart command on your system.
sudo apt-get install gpart
Next, run it against the disk who’s partition table needs to be backed up. Remember to do this against every disk you have, and to do this every time you change the partition table on a disk.
If you’re not sure which device corresponds to which drive, the mount command is your friend:
$ mount /dev/sda5 on / type ext3 (rw,relatime,errors=remount-ro) tmpfs on /lib/init/rw type tmpfs (rw,nosuid,mode=0755) proc on /proc type proc (rw,noexec,nosuid,nodev) sysfs on /sys type sysfs (rw,noexec,nosuid,nodev) varrun on /var/run type tmpfs (rw,nosuid,mode=0755) varlock on /var/lock type tmpfs (rw,noexec,nosuid,nodev,mode=1777) udev on /dev type tmpfs (rw,mode=0755) tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev) devpts on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=620) fusectl on /sys/fs/fuse/connections type fusectl (rw) lrm on /lib/modules/2.6.28-14-generic/volatile type tmpfs (rw,mode=755) /dev/sda2 on /media/sda2 type fuseblk (rw,nosuid,nodev,allow_other,blksize=4096) securityfs on /sys/kernel/security type securityfs (rw) binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noexec,nosuid,nodev) //192.168.1.77/HDD_1_1_1 on /media/Elements1 type cifs (rw,mand,noexec,nosuid,nodev) //192.168.1.77/HDD_1_1_2 on /media/Elements2 type cifs (rw,mand,noexec,nosuid,nodev) 192.168.1.77:/share/hdd/data/HDD_1_1_1 on /media/HDD_1_1_1 type nfs (rw,users,noexec,nosuid,nodev,intr,addr=192.168.1.77) 192.168.1.77:/share/hdd/data/HDD_1_1_2 on /media/HDD_1_1_2 type nfs (rw,users,noexec,nosuid,nodev,intr,addr=192.168.1.77) 192.168.1.77:/share/hdd/data/HDD_1_1_3 on /media/HDD_1_1_3 type nfs (rw,users,noexec,nosuid,nodev,intr,addr=192.168.1.77)
Once you’ve identified a disk, e.g /dev/sdb, it’s time to run the gpart command to reveal it’s partition table:
$ sudo gpart /dev/sdb Begin scan... Possible partition(Linux ext2), size(410002mb), offset(0mb) Possible partition(DOS FAT), size(410002mb), offset(410002mb) Possible partition(Linux ext2), size(133861mb), offset(820005mb) End scan. Checking partitions... Partition(Linux ext2 filesystem): primary Partition(DOS or Windows 95 with 32 bit FAT, LBA): primary Partition(Linux ext2 filesystem): primary Ok. Guessed primary partition table: Primary partition(1) type: 131(0x83)(Linux ext2 filesystem) size: 410002mb #s(839685352) s(63-839685414) chs: (0/1/1)-(1023/254/63)d (0/1/1)-(52267/254/58)r Primary partition(2) type: 012(0x0C)(DOS or Windows 95 with 32 bit FAT, LBA) size: 410002mb #s(839685420) s(839685420-1679370839) chs: (1023/254/63)-(1023/254/63)d (52268/0/1)-(104535/254/63)r Primary partition(3) type: 131(0x83)(Linux ext2 filesystem) size: 133861mb #s(274149224) s(1679370840-1953520063) chs: (1023/254/63)-(1023/254/63)d (104536/0/1)-(121600/254/62)r Primary partition(4) type: 000(0x00)(unused) size: 0mb #s(0) s(0-0) chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r
Backup this information to a file and store in a secure location.
Restoring a drive from partition table entries
Next we want to restore the partition table from the entries we backed up earlier. For this we need the parted command. If your Linux machine is unusable (because it was on the disk you wish to recover), consider creating an Ubuntu LiveCD using someone else’s computer and running that on your machine to get to a terminal where you can run parted. You do not need Ubuntu as such; all we need is a distro with the ability to run the parted command.
Once you are on a terminal:
- Run the command sudo parted /dev/sdb. It’ll drop you into the parted command shell, on a new line with the (parted) prompt
- Enter “unit s” on the prompt to tell parted to use sectors as the unit to configure the partition table.
- Enter “print” to check the disk details and confirm that you have the correct disk.
- Next, type “rescue“. It should give you a Start? prompt. Enter the starting sector of the first partition from the partition table backup file. It next prompts you for the ending sector: End?. Provide the ending sector for the partition. Referring to the example below, the first partition ranges from sector 63 to 839685414 “s(63-839685414)” as evidenced by this snippet from earlier:
Primary partition(1) type: 131(0x83)(Linux ext2 filesystem) size: 410002mb #s(839685352) s(63-839685414) chs: (0/1/1)-(1023/254/63)d (0/1/1)-(52267/254/58)r
- If all goes well, it should respond by saying something like “A ext3 primary partition was found at 63s -> 839685414s. Do you want to add it to the partition table? Yes/No/Cancel?“. Say Yes and proceed.
- Follow these steps for each partition you had on the disk.
- Once done, type “quit” to exit the parted command.
For more detailed instructions on recovering lost partitions, look at the Ubuntu Data Recovery Community Guide.
Provided below is a sample output of a recovery session:
$ sudo parted /dev/sdb GNU Parted 1.8.8 Using /dev/sdb Welcome to GNU Parted! Type 'help' to view a list of commands. (parted) unit s (parted) print Model: WD 10EAVS External (scsi) Disk /dev/sdb: 1953525168s Sector size (logical/physical): 512B/512B Partition Table: msdos Number Start End Size Type File system Flags (parted) rescue Start? 63 End? 839685414 Information: A ext3 primary partition was found at 63s -> 839685414s. Do you want to add it to the partition table? Yes/No/Cancel? yes (parted) rescue Start? 839685420 End? 1679370839 Information: A fat32 primary partition was found at 839685420s -> 1679370839s. Do you want to add it to the partition table? Yes/No/Cancel? yes (parted) rescue Start? 1679370840 End? 1953520063 Information: A ext2 primary partition was found at 1679370840s -> 1953520063s. Do you want to add it to the partition table? Yes/No/Cancel? yes (parted) quit Information: You may need to update /etc/fstab.
