linux-kernel - Re: [RFH] Partion table recovery

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 20 Jul 2007 07:35:27 +0200
From:	Willy Tarreau <w@....eu>
To:	Al Boldi <a1426z@...ab.com>
Cc:	linux-raid@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [RFH] Partion table recovery

On Fri, Jul 20, 2007 at 08:13:03AM +0300, Al Boldi wrote:
> As always, a good friend of mine managed to scratch my partion table by 
> cat'ing /dev/full into /dev/sda.  I was able to push him out of the way, but 
> at least the first 100MB are gone.  I can probably live without the first 
> partion, but there are many partitions after that, which I hope should 
> easily be recoverable.
> 
> I tried parted, but it's not working out for me.  Does anybody know of a 
> simple partition recovery tool, that would just scan the disk for lost 
> partions?

The best one is simply "fdisk", because you can manually enter your
cylinders numbers. You have to find by hand the beginning of each partition,
and for this, you have to remember what filesystems you used and see how to
identify them (using a magic). Then with an hex editor, you scan the disk to
find such entries and note the possible sectors on a paper. Then comes fdisk.
You create the part, exit and try to mount it. If it fails, fdisk again and
try other values.

I've saved many disks that way, it may sound harder than it really is. It
should not take you more than half an hour to get the first part. Knowing
your approximate partitions size will help too.

Good luck!
Willy

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/