[SOLVED] Partition table messed up - hundreds of "ghost" partitions
This all started with an attempt to restore a Windows partition. I don't know exactly where, but something went *very* wrong. Grub was obviously destroyed, and when I tried to recreate it, I couldn't. I'm now locked out of my system, and I can't do anything because the partition table of the hard disk is messed up... It had 10 or 11 partitions, but now it shows about 260. The first few seem "legitimate" but the following 250 are just many copies of two of the "legitimate" ones. (see my other post about GRUB for details...)
So, how can I try to recover my partitions? Is there a way to "recreate" the partition table? I tried downloading the GParted livecd, but it crashes with a Out of Memory kernel panic... maybe too many partitions?
Any ideas? I'm really at a loss... :(
Cristian
Re: Partition table messed up - hundreds of "ghost" partitions
Try running testdisk from a live cd.
sudo apt-get install testdisk
sudo testdisk
Choose the analyse option.
Re: Partition table messed up - hundreds of "ghost" partitions
I think I can help fix this. What has gone wrong is the daisy-chaining of the extended partitions. It is as if one extended boot record is pointing back to an earlier one, thus creating a loop.
Code:
ubuntu@ubuntu:~$ sudo fdisk -lu
Warning: omitting partitions after #60.
They will be deleted if you save this partition table.
Disk /dev/sda: 500.1 GB, 500107862016 bytes
255 heads, 63 sectors/track, 60801 cylinders, total 976773168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk identifier: 0x9bca9bca
Device Boot Start End Blocks Id System
/dev/sda1 * 2048 94928016 47462984+ 7 HPFS/NTFS
/dev/sda2 94928024 129092767 17082372 83 Linux
/dev/sda3 129437694 976773119 423667713 5 Extended
Partition 3 does not start on physical sector boundary.
/dev/sda5 190996848 194900579 1951866 82 Linux swap / Solaris
/dev/sda6 194900643 276816014 40957686 83 Linux
Partition 6 does not start on physical sector boundary.
/dev/sda7 276817920 308142079 15662080 83 Linux
/dev/sda8 308144128 369606655 30731264 83 Linux
/dev/sda9 369607518 459282284 44837383+ 83 Linux
Partition 9 does not start on physical sector boundary.
/dev/sda10 459282348 542049164 41383408+ 83 Linux
Partition 10 does not start on physical sector boundary.
/dev/sda11 369607518 459282284 44837383+ 83 Linux
Partition 11 does not start on physical sector boundary.
/dev/sda12 459282348 542049164 41383408+ 83 Linux
Partition 12 does not start on physical sector boundary.
/dev/sda13 369607518 459282284 44837383+ 83 Linux
Partition 13 does not start on physical sector boundary.
/dev/sda14 459282348 542049164 41383408+ 83 Linux
Do you recall which partitions are supposed to be there. It appears that the sector addresses are obvious wrong starting at sda11. Did you have 10 partitions originally?
The method I would use is manual and tedious but will work. It is to look at each EBR in the chain until the one that is erroneous if found and then to fix it. Their locations are unknown but each one tells where the next one is.
To see the first EBR post the output of:
sudo dd if=/dev/sda bs=512 count=1 skip=129437694 | hexdump -C
Re: Partition table messed up - hundreds of "ghost" partitions
I think that YesWeCan's diagnosis is correct. Editing the disk manually as he suggests can certainly effect a repair, but also as he says, it will be tedious (as well as prone to human error). You might want to try another couple of things first. I make no guarantees that either will work, but one of them might, and if so it will be an easier and safer fix than doing low-level disk editing directly:
- Try my FixParts on the disk. I've never tested it on a disk with your disk's problems, but it does include features that might make it reject all but the first instances of the duplicated partitions. OTOH, it might crash. If it reads the partitions and shows a reasonable partition list when you type "p" to view the partitions, or if it shows a list with all but one copy of each partition flagged as "omitted", it should be safe to write the partition table back out.
- Try typing "sudo sfdisk -d /dev/sda > parts.txt" and then examine the parts.txt file. I have no idea what sfdisk will do with the disk, but there's a slim chance that it will discard the duplicate partitions. Even if it doesn't, if it stops trying to read from the infinite loop at some point (as fdisk it), it will probably be easier to edit the parts.txt file to delete the duplicates and then write it back out with "sudo sfdisk -f /dev/sda < parts.txt" than to edit the disk on a low level with a hex editor or repeated uses of dd. If sfdisk keeps running for more than a second or two, though, you should interrupt it with a Ctrl+C keypress, since it's conceivable it'll try to fill the disk with an infinitely large parts.txt file!
Note that both of these methods are likely to lose anything beyond /dev/sda10. There's significant space after that point on your original disk. The best way to recover those partitions is probably to use TestDisk, as patryk77 suggests. It's conceivable that TestDisk would do the job right when fed your currently-broken disk, but my inclination is to at least try to fix the current partition table before trying TestDisk on the disk.
Re: Partition table messed up - hundreds of "ghost" partitions
Quote:
Originally Posted by
srs5694
[snip]...but my inclination is to at least try to fix the current partition table before trying TestDisk on the disk.
The reason I tend to suggest testdisk as the first option to fix partition tables is that if you run the Analyse mode, it generates the partition table for you without overwriting data before you accept the changes.
It never let me down or overwrote data, and IMO it's much safer than trying to fix anything manually (though I am not familiar with sfdisk).
Either way, I never had such a problem before, so I can't vouch that testdisk won't be confused either by whatever messed up the table in the first place.
Re: Partition table messed up - hundreds of "ghost" partitions
Thank you all for your inputs. I'm going to try the "testdisk analyse" thing... I wanted to try that yesterday, but the gparted live I have downloaded doesn't boot. And with that system totally dead, it's not easy to go online and download things...
Anyway, I'll report as soon as I can try your suggestions!
Cristian
Re: Partition table messed up - hundreds of "ghost" partitions
OK, I've tried testdisk. After selecting "analyse", it said:
Code:
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Current partition structure:
Partition Start End Size in sectors
> 1 * HPFS - NTFS 0 32 33 5908 253 58 94925969
2 P Linux 5908 254 3 8035 166 35 34164744
3 E extended 8057 31 37 60801 80 15 847335426
5 L Linux Swap 11889 1 1 12131 254 63 3903732
X extended 12132 0 1 17230 254 63 81915435
6 L Linux 12132 1 1 17230 254 63 81915372
X extended 17231 0 1 19180 244 8 31326065
7 L Linux 17231 30 16 19180 244 8 31324160
X extended 19181 0 1 23006 242 20 61463891
8 L Linux 19181 21 41 23006 242 20 61462528
X extended 23007 0 1 28588 254 63 89674830
9 L Linux 23007 1 1 28588 254 63 89674767 [VirtualBoxVDI]
X extended 28589 0 1 33740 254 63 82766880
Next
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
>[Quick Search] [ Backup ]
Try to locate partition
After starting "try to locate partitions" it quickly found these:
Code:
HPFS - NTFS 0 32 33 5690 31 22 91409777
Linux 5908 254 3 8035 166 35 34164744
Linux 8057 31 39 11888 250 10 61558784
Linux Swap 11889 1 1 12131 254 43 3903712
Linux 12132 1 1 17230 254 59 81915368
Linux 17231 1 1 19180 254 56 31326680 [VecchioRoot]
Linux 19181 1 1 23006 254 60 61464624 [Home]
Linux 23007 1 1 28588 254 56 89674760 [VirtualBoxVDI]
Linux 28589 1 1 33740 254 62 82766816 [Musica]
HPFS - NTFS 33740 254 63 62583 253 62 463362732
Linux 33741 0 1 46621 254 62 206933264 [Appoggio]
Does that make sense? It's still searching, but I don't really remember having a second NTFS partition... I really think that shouldn't be there.
And I seem to recall there was another fairly large partition after the one named "appoggio", but maybe it still has to find it...
What do you think? I don't know how to read these results...
Cristian
Re: Partition table messed up - hundreds of "ghost" partitions
Quote:
Originally Posted by
Quaxo76
What do you think? I don't know how to read these results...
I think if this data is important to you then don't take chances with "no guarantees" short-cut advice; Why take the risk? I wouldn't.
Re: Partition table messed up - hundreds of "ghost" partitions
One problem with TestDisk is that, because it uses CHS values where everybody else has abandoned them in favor of LBA values, it's hard to see how the filesystems it finds map onto existing or old partitions. There's a forumula on the Wikipedia page for CHS to translate from CHS to LBA, so you can use that to see how the TestDisk results map onto those that your "fdisk -lu" output produced. If it's recovered all the correct partitions, and especially if it's also recovered anything that's been lost from beyond /dev/sda10, then having it finalize the changes makes sense. If TestDisk has not recovered some of your partitions (those shown by "fdisk -lu" or those that it's lost), you should be more cautious. You might want to save the start and end points for all the partitions (revealed by both "fdisk -lu" and TestDisk), use whatever method you like to create a legal partition table, and then patch up the rest with fdisk or sfdisk.
YesWeCan is certainly correct in suggesting that there are risks in such data recovery. This is true of any of the solutions suggested in this thread. At the very least, you should back up your current partition table with "sudo sfdisk -d /dev/sda > parts.txt" (assuming it completes its task and doesn't try to generate an infinite parts.txt file). In a pinch, the "fdisk -lu" data you've posted can be used to regenerate your partition table. Backing up your actual files is also worth doing, assuming Linux generates device nodes you can use to mount filesystems and do the backup. This obviously won't be possible for partitions beyond your /dev/sda10, though.
Re: Partition table messed up - hundreds of "ghost" partitions
Testdisk finished the scan. The partition table it found does make sense somewhat, but sadly I can't be sure and remember exactly if everything is there. This is the output:
Code:
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60802 255 63
The harddisk (500 GB / 465 GiB) seems too small! (< 514 GB / 479 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...
The following partition can't be recovered:
Partition Start End Size in sectors
> HPFS - NTFS 33740 254 63 62583 253 62 463362732
It makes sense because I know I didn't have any NTFS partition, other than the primary one.
I have the outputs of fdisk -lu and of testdisk, now I'll make a backup of the partition table (and of the MBR) to be sure; then, maybe I'll try letting testdisk do its job... I don't think I have the skills needed to fix it by hand, or the free time to acquire them... :(
Thanks for now, I'll report when I have new info.
Cristian