Previous Contents Previous

Recovering a Deleted Partition Table

 Take a deep breath and relax. This is not bad luck. This is God's retribution for your failure to back up your data. You are a bad person and you deserve this.

Fortunately, there is a way for you to spite the will of God and recover your data anyway, but it will require nerves of steel. Here is what you do:
  1. Make a partition that is at least as big as your first partition was. You can make it larger than the original partition by any amount. If you underestimate, there will be much wailing and gnashing of teeth.
    Command (m for help): n
Command action
   e   extended
   p   primary partition (1-4)
p
Partition number (1-4): <1>
First cylinder (1-23361, default 1): <RETURN>
Using default value 1
Last cylinder or +size or +sizeM or +sizeK (1-22800, default 22800): 13032

Command (m for help): w

  2. Run dumpe2fs on the first partition and grep out the block count
    Example:

               % dumpe2fs /dev/sda1 | grep "Block count:"
           Block count:              41270953
    If you are uncertain about this value, repeat Step 1 with a bigger partition size. If the block count changes, then you underestimated the size of the original partition. Repeat Step 1 until you get a stable block count.
  3. Remove the partition you just created
             Command (m for help): d
         Partition number (1-4): 1
  4. Make a new partition with the exact size you got from the block count. Since you cannot enter block size in fdisk, you need to figure out how many cylinders to request. Here is the formula:

    (number of needed cylinders) = (number of blocks) / (block size)

    (block size) = (unit size) / 1024

    (unit size) = (number of cylinders) * (number of heads) * (number of sectors/cylinder) * (number of bytes/sector)
    In theory! In practice, it's rather more complicated. fdisk tries to end its allocation for a partition on a cylinder boundary, so it can be hard to figure out the relationship of cylinders to blocks.

    Here is an example of the problem. Below, I have formatted a drive with partitions with 1, 2, 4, and 8 cylinders.
    disk /dev/sda: 16 heads, 63 sectors, 23361 cylinders
Units = cylinders of 1008 * 512 bytes

   Device Boot    Start       End    Blocks   Id  System
/dev/sda1             1         2       976+  83  Linux
/dev/sda2             3         5      1512   83  Linux
/dev/sda3             6        10      2520   83  Linux
/dev/sda4            11        19      4536   83  Linux
    If I divide each partition by the number of cylinders, I ought to get the block size (16 heads * 63 sectors * 512 bytes/sector divided by 1024 = 504), right? Not true! 
            allocated  #of  block
         blocks    cyl  size

           976 /    1 = 976
          1512 /    2 = 756
          2520 /    4 = 630
          4536 /    8 = 567
          8568 /   16 = 535
         16632 /   32 = 519
         32760 /   64 = 512
         64984 /  128 = 507
        129528 /  256 = 505
        258552 /  512 = 504 
        516600 / 1024 = 504
       1032664 / 2048 = 504
    Notice that as the number of cylinders grows, the closer to the real block size the calculated value for the allocated blocks becomes.

    You will have to make guestimates and converge on the true number of cylinders to use. You will ultimately get an exact match because the block count from dumpe2fs came from a well-formed partition.

  5. Run e2fsck on it to verify that you can read the new partition.

  6. Repeat Steps 1-5 on remaining partitions.

Remount your partitions. Amazingly, all of your data will be there.


Credit goes to:
Previous Contents Previous