restore GPT partition table?
OK, so I did this dd if=some.iso of=/dev/sdb oops -- that's not the USB key! that's my internal m.2 drive! The partition table is gone, but it used to contain 2 partitions, both of them in an LVM, one of them part of an extended logical volume that added space to /home on my overburdened main drive. I haven't lost much data (just the first 700mb were overwritten), and amazingly my laptop continues to run just fine -- even though lvscan reports a missing drive, apparently the data is still findable. I'd like to restore the partition table but I don't know where the partition boundaries are, and in any case I don't know how to write a partition table (!). What tools should I use? Preferably without turning off my laptop, since I'm afraid it won't boot back up again!
On Oct 25, 2016 7:33 AM, "Matt Price via talk" <talk@gtalug.org> wrote:
OK, so I did this
dd if=some.iso of=/dev/sdb
oops -- that's not the USB key! that's my internal m.2 drive!
Your not the only one. https://www.linux.com/learn/how-fix-mangled-partition-table-linux I really like this spin. http://www.system-rescue-cd.org/SystemRescueCd_Homepage Hope this helps.
The partition table is gone, but it used to contain 2 partitions, both of
them in an LVM, one of them part of an extended logical volume that added space to /home on my overburdened main drive. I haven't lost much data (just the first 700mb were overwritten), and amazingly my laptop continues to run just fine -- even though lvscan reports a missing drive, apparently the data is still findable.
I'd like to restore the partition table but I don't know where the
partition boundaries are, and in any case I don't know how to write a partition table (!). What tools should I use? Preferably without turning off my laptop, since I'm afraid it won't boot back up again!
--- Talk Mailing List talk@gtalug.org https://gtalug.org/mailman/listinfo/talk
Russell Sent from mobile.
The partition table is still in memoryso you will have some luck till you reboot or force the system to do a partprobe. The following link points to how to recover your partition from the in system data: http://unix.stackexchange.com/questions/43922/how-to-read-the-in-memory-kern... That being said first you should back up all the data you can to an external drive If your going to play with testdisk then it is best to learn on an image of the broken drive so copy the whole drive off to some other system to play with. I have trashed enough systems in my time to know that a good backup is the best way to insure that things go well. On 10/25/2016 07:33 AM, Matt Price via talk wrote:
OK, so I did this
dd if=some.iso of=/dev/sdb
oops -- that's not the USB key! that's my internal m.2 drive!
The partition table is gone, but it used to contain 2 partitions, both of them in an LVM, one of them part of an extended logical volume that added space to /home on my overburdened main drive. I haven't lost much data (just the first 700mb were overwritten), and amazingly my laptop continues to run just fine -- even though lvscan reports a missing drive, apparently the data is still findable.
I'd like to restore the partition table but I don't know where the partition boundaries are, and in any case I don't know how to write a partition table (!). What tools should I use? Preferably without turning off my laptop, since I'm afraid it won't boot back up again!
--- Talk Mailing List talk@gtalug.org https://gtalug.org/mailman/listinfo/talk
-- Alvin Starr || voice: (905)513-7688 Netvel Inc. || Cell: (416)806-0133 alvin@netvel.net ||
On 16-10-25 08:07 AM, Alvin Starr via talk wrote:
The following link points to how to recover your partition from the in system data: http://unix.stackexchange.com/questions/43922/how-to-read-the-in-memory-kern...
The information on that page is from 2012. It doesn't apply to current versions of the kernel. When I tried to use the technique showed to see if it would show the size of my drive partitions the referenced file doesn't exist. -- Cheers! Kevin. http://www.ve3syb.ca/ |"Nerds make the shiny things that distract Owner of Elecraft K2 #2172 | the mouth-breathers, and that's why we're | powerful!" #include <disclaimer/favourite> | --Chris Hardwick
On 10/25/2016 11:35 AM, Kevin Cozens wrote:
On 16-10-25 08:07 AM, Alvin Starr via talk wrote:
The following link points to how to recover your partition from the in system data: http://unix.stackexchange.com/questions/43922/how-to-read-the-in-memory-kern...
The information on that page is from 2012. It doesn't apply to current versions of the kernel. When I tried to use the technique showed to see if it would show the size of my drive partitions the referenced file doesn't exist.
Kind of weird because it worked for me on a Centos 7 system and another F22 system. [alvin@alvin ~]$ cat /sys/block/sda/sda1/size 40960000 [alvin@alvin ~]$ cat /sys/block/sda/sda1/start 2048 -- Alvin Starr || voice: (905)513-7688 Netvel Inc. || Cell: (416)806-0133 alvin@netvel.net ||
On Tue, 25 Oct 2016 11:42:09 -0400 Alvin Starr via talk <talk@gtalug.org> wrote:
On 10/25/2016 11:35 AM, Kevin Cozens wrote:
On 16-10-25 08:07 AM, Alvin Starr via talk wrote:
The following link points to how to recover your partition from the in system data: http://unix.stackexchange.com/questions/43922/how-to-read-the-in-memory-kern... The information on that page is from 2012. It doesn't apply to current versions of the kernel. When I tried to use the technique showed to see if it would show the size of my drive partitions the referenced file doesn't exist. Kind of weird because it worked for me on a Centos 7 system and another F22 system. [alvin@alvin ~]$ cat /sys/block/sda/sda1/size 40960000 [alvin@alvin ~]$ cat /sys/block/sda/sda1/start 2048
works by me too...
On 25/10/16 12:33, Matt Price via talk wrote:
OK, so I did this
dd if=some.iso of=/dev/sdb
oops -- that's not the USB key! that's my internal m.2 drive!
The partition table is gone, but it used to contain 2 partitions, both of them in an LVM, one of them part of an extended logical volume that added space to /home on my overburdened main drive. I haven't lost much data (just the first 700mb were overwritten), and amazingly my laptop continues to run just fine -- even though lvscan reports a missing drive, apparently the data is still findable.
I'd like to restore the partition table but I don't know where the partition boundaries are, and in any case I don't know how to write a partition table (!). What tools should I use? Preferably without turning off my laptop, since I'm afraid it won't boot back up again!
Apart from the data loss, right now you're in a good position to recover things. First, make a copy of /proc/partitions for reference in case you need to restore from it. You have a few options: 1. Restore LVM since you're using that: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/htm... Those backups have saved me on multiple occasions. 2. testdisk is a great tool for these kinds of problems. Download and run it from /dev/shm. It may not find the deleted partitions or see in memory stuff, but it won't hurt to try. 3. Use your /proc/partitions as a reference, since it has a list of the partitions from before the dd operation. With it you could reconstruct a partition table if the LVM restore steps don't work. http://prefetch.net/blog/index.php/2009/12/20/using-the-linux-parted-utility... for more on that approach. Good luck!
oh man, all of that looks really helpful, folks. At work now (with my laptop safely plugged in and not hibernating!!) -- I will try when I get back home. I'll report back when I'm (hopefully) successful. On Tue, Oct 25, 2016 at 8:22 AM, Jamon Camisso via talk <talk@gtalug.org> wrote:
On 25/10/16 12:33, Matt Price via talk wrote:
OK, so I did this
dd if=some.iso of=/dev/sdb
oops -- that's not the USB key! that's my internal m.2 drive!
The partition table is gone, but it used to contain 2 partitions, both of them in an LVM, one of them part of an extended logical volume that added space to /home on my overburdened main drive. I haven't lost much data (just the first 700mb were overwritten), and amazingly my laptop continues to run just fine -- even though lvscan reports a missing drive, apparently the data is still findable.
I'd like to restore the partition table but I don't know where the partition boundaries are, and in any case I don't know how to write a partition table (!). What tools should I use? Preferably without turning off my laptop, since I'm afraid it won't boot back up again!
Apart from the data loss, right now you're in a good position to recover things.
First, make a copy of /proc/partitions for reference in case you need to restore from it.
You have a few options:
1. Restore LVM since you're using that: https://access.redhat.com/documentation/en-US/Red_Hat_ Enterprise_Linux/7/html/Logical_Volume_Manager_ Administration/mdatarecover.html
Those backups have saved me on multiple occasions.
2. testdisk is a great tool for these kinds of problems. Download and run it from /dev/shm. It may not find the deleted partitions or see in memory stuff, but it won't hurt to try.
3. Use your /proc/partitions as a reference, since it has a list of the partitions from before the dd operation. With it you could reconstruct a partition table if the LVM restore steps don't work.
http://prefetch.net/blog/index.php/2009/12/20/using- the-linux-parted-utility-to-re-create-a-lost-partition-table/ for more on that approach.
Good luck! --- Talk Mailing List talk@gtalug.org https://gtalug.org/mailman/listinfo/talk
On Tue, Oct 25, 2016 at 07:33:30AM -0400, Matt Price via talk wrote:
OK, so I did this
dd if=some.iso of=/dev/sdb
oops -- that's not the USB key! that's my internal m.2 drive!
The partition table is gone, but it used to contain 2 partitions, both of them in an LVM, one of them part of an extended logical volume that added space to /home on my overburdened main drive. I haven't lost much data (just the first 700mb were overwritten), and amazingly my laptop continues to run just fine -- even though lvscan reports a missing drive, apparently the data is still findable.
I'd like to restore the partition table but I don't know where the partition boundaries are, and in any case I don't know how to write a partition table (!). What tools should I use? Preferably without turning off my laptop, since I'm afraid it won't boot back up again!
Luckily gpt has two copies. One at the start of the disk and one at the end. Any gpt compatible partition tool should actually offer to copy the backup from the end of the device. For example: root@lsorensen-debian:~# cd /tmp/ root@lsorensen-debian:/tmp# dd if=/dev/zero of=disk.img bs=1M count=100 100+0 records in 100+0 records out 104857600 bytes (105 MB, 100 MiB) copied, 0.10877 s, 964 MB/s root@lsorensen-debian:/tmp# modprobe loop max_part=8 root@lsorensen-debian:/tmp# losetup /dev/loop0 disk.img root@lsorensen-debian:/tmp# gparted /dev/loop0 Created symlink /run/systemd/system/-.mount → /dev/null. Created symlink /run/systemd/system/boot-efi.mount → /dev/null. Created symlink /run/systemd/system/boot.mount → /dev/null. Created symlink /run/systemd/system/media-sf_Downloads.mount → /dev/null. Created symlink /run/systemd/system/run-user-1000.mount → /dev/null. Created symlink /run/systemd/system/tmp.mount → /dev/null. ====================== libparted : 3.2 ====================== /dev/loop0: unrecognised disk label Removed /run/systemd/system/-.mount. Removed /run/systemd/system/boot-efi.mount. Removed /run/systemd/system/boot.mount. Removed /run/systemd/system/media-sf_Downloads.mount. Removed /run/systemd/system/run-user-1000.mount. Removed /run/systemd/system/tmp.mount. root@lsorensen-debian:/tmp# gdisk /dev/loop0 GPT fdisk (gdisk) version 1.0.1 Partition table scan: MBR: not present BSD: not present APM: not present GPT: not present Creating new GPT entries. Command (? for help): n Partition number (1-128, default 1): First sector (34-204766, default = 2048) or {+-}size{KMGTP}: Last sector (2048-204766, default = 204766) or {+-}size{KMGTP}: Current type is 'Linux filesystem' Hex code or GUID (L to show codes, Enter = 8300): Changed type of partition to 'Linux filesystem' Command (? for help): w Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING PARTITIONS!! Do you want to proceed? (Y/N): y OK; writing new GUID partition table (GPT) to /dev/loop0. The operation has completed successfully. root@lsorensen-debian:/tmp# gdisk -l /dev/loop0 GPT fdisk (gdisk) version 1.0.1 Partition table scan: MBR: protective BSD: not present APM: not present GPT: present Found valid GPT with protective MBR; using GPT. Disk /dev/loop0: 204800 sectors, 100.0 MiB Logical sector size: 512 bytes Disk identifier (GUID): 5946A311-C895-4DAE-94CF-9C96EB8E14C1 Partition table holds up to 128 entries First usable sector is 34, last usable sector is 204766 Partitions will be aligned on 2048-sector boundaries Total free space is 2014 sectors (1007.0 KiB) Number Start (sector) End (sector) Size Code Name 1 2048 204766 99.0 MiB 8300 Linux filesystem root@lsorensen-debian:/tmp# dd if=/dev/zero bs=1M count=5 > /dev/loop0 5+0 records in 5+0 records out 5242880 bytes (5.2 MB, 5.0 MiB) copied, 0.0397727 s, 132 MB/s root@lsorensen-debian:/tmp# gdisk /dev/loop0 GPT fdisk (gdisk) version 1.0.1 Caution: invalid main GPT header, but valid backup; regenerating main header from backup! Caution! After loading partitions, the CRC doesn't check out! Warning! Main partition table CRC mismatch! Loaded backup partition table instead of main partition table! Warning! One or more CRCs don't match. You should repair the disk! Partition table scan: MBR: not present BSD: not present APM: not present GPT: damaged Found invalid MBR and corrupt GPT. What do you want to do? (Using the GPT MAY permit recovery of GPT data.) 1 - Use current GPT 2 - Create blank GPT Your answer: 1 Command (? for help): w Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING PARTITIONS!! Do you want to proceed? (Y/N): y OK; writing new GUID partition table (GPT) to /dev/loop0. The operation has completed successfully. root@lsorensen-debian:/tmp# gdisk -l /dev/loop0 GPT fdisk (gdisk) version 1.0.1 Partition table scan: MBR: protective BSD: not present APM: not present GPT: present Found valid GPT with protective MBR; using GPT. Disk /dev/loop0: 204800 sectors, 100.0 MiB Logical sector size: 512 bytes Disk identifier (GUID): 5946A311-C895-4DAE-94CF-9C96EB8E14C1 Partition table holds up to 128 entries First usable sector is 34, last usable sector is 204766 Partitions will be aligned on 2048-sector boundaries Total free space is 2014 sectors (1007.0 KiB) Number Start (sector) End (sector) Size Code Name 1 2048 204766 99.0 MiB 8300 Linux filesystem So seems simple enough to recover the partition table from the backup. -- Len Sorensen
On 25/10/16 22:06, Lennart Sorensen via talk wrote:
Luckily gpt has two copies. One at the start of the disk and one at the end.
Any gpt compatible partition tool should actually offer to copy the backup from the end of the device.
<snip>
Found valid GPT with protective MBR; using GPT. Disk /dev/loop0: 204800 sectors, 100.0 MiB Logical sector size: 512 bytes Disk identifier (GUID): 5946A311-C895-4DAE-94CF-9C96EB8E14C1 Partition table holds up to 128 entries First usable sector is 34, last usable sector is 204766 Partitions will be aligned on 2048-sector boundaries Total free space is 2014 sectors (1007.0 KiB)
Number Start (sector) End (sector) Size Code Name 1 2048 204766 99.0 MiB 8300 Linux filesystem
So seems simple enough to recover the partition table from the backup.
You've outdone yourself and all of us. I had no idea about that backup GPT location. Maybe I should learn to appreciate GPT a little more? TIL!
On Tue, Oct 25, 2016 at 11:06:02PM +0100, Jamon Camisso via talk wrote:
You've outdone yourself and all of us. I had no idea about that backup GPT location. Maybe I should learn to appreciate GPT a little more?
TIL!
It's one of the nice features they added. All partitions are the same (no stupid primary/extended crap), you can have 128 of them, they can have identifiers that are quite large (uuid) for both the type and as a unique identifier. It has a CRC check to determine if it was corrupted, and a backup copy as far away as possible to assist when the primary fails. It is great. I can't think of any reason to stick with MBR partition tables, other than if you run windows on a machine without EFI. linux works fine with grub on GPT booting from BIOS. Oh and support for disks larger than 2TB is a nice feature too. -- Len Sorensen
participants (7)
-
ac -
Alvin Starr -
Jamon Camisso -
Kevin Cozens -
lsorense＠csclub.uwaterloo.ca -
Matt Price -
Russell Reiter