linux-kernel - Re: [RFH] Partition table recovery

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200707201429.34419.a1426z@gawab.com>
Date:	Fri, 20 Jul 2007 14:29:34 +0300
From:	Al Boldi <a1426z@...ab.com>
To:	linux-raid@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org
Subject: Re: [RFH] Partition table recovery

Jan Engelhardt wrote:
> On Jul 20 2007 07:35, Willy Tarreau wrote:
> >On Fri, Jul 20, 2007 at 08:13:03AM +0300, Al Boldi wrote:
> >> As always, a good friend of mine managed to scratch my partion table by
> >> cat'ing /dev/full into /dev/sda.  I was able to push him out of the
> >> way, but at least the first 100MB are gone.  I can probably live
> >> without the first partion, but there are many partitions after that,
> >> which I hope should easily be recoverable.
>
> Go use GPT, it's got a backup copy of the ptable at then end of the disk
> ;-)

Would that be compatible with md?

> >> I tried parted, but it's not working out for me.  Does anybody know of
> >> a simple partition recovery tool, that would just scan the disk for
> >> lost partions?
> >
> >The best one is simply "fdisk", because you can manually enter your
> >cylinders numbers. You have to find by hand the beginning of each
> > partition, and for this, you have to remember what filesystems you used
> > and see how to identify them (using a magic). Then with an hex editor,
> > you scan the disk to find such entries and note the possible sectors on
> > a paper. Then comes fdisk. You create the part, exit and try to mount
> > it. If it fails, fdisk again and try other values.
>
> Pretty easy:
> "XFSB" (offset +0),
> "ReIsErFs2" (offset +0x10034),
> "SWAPSPACE2" (offset +0xff6),
> "FAT32" (offset +0x52h, maybe harder) / "mkdofs" (+0x3)
> ext2/3 is TOUGH. (sequence 0x53ef at +0x438 - quite ambiguous!)

Actually, there is an easier way to do this with cfdisk.  Once you know where 
a partition starts, enter it into cfdisk and set the size to something 
short, then save and restart cfdisk. If the position is correct, then cfdisk 
will identify the fs type.  Now exit again and do an fsck, which will error 
out complaining about a dev-size/fs-size mismatch.  Adjust the cfdisk 
partition accordingly, and cycle through the rest of the partitions.

But, I want something much more automated.  And the partition table backup 
per partition entry isn't really a bad idea.


Thanks!

--
Al

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/