Page 1 of 6 123 ... LastLast
Results 1 to 10 of 59

Thread: Partition table messed up - hundreds of "ghost" partitions

  1. #1
    Join Date
    Jul 2007
    Beans
    140

    [SOLVED] Partition table messed up - hundreds of "ghost" partitions

    This all started with an attempt to restore a Windows partition. I don't know exactly where, but something went *very* wrong. Grub was obviously destroyed, and when I tried to recreate it, I couldn't. I'm now locked out of my system, and I can't do anything because the partition table of the hard disk is messed up... It had 10 or 11 partitions, but now it shows about 260. The first few seem "legitimate" but the following 250 are just many copies of two of the "legitimate" ones. (see my other post about GRUB for details...)
    So, how can I try to recover my partitions? Is there a way to "recreate" the partition table? I tried downloading the GParted livecd, but it crashes with a Out of Memory kernel panic... maybe too many partitions?

    Any ideas? I'm really at a loss...

    Cristian
    Last edited by Quaxo76; September 27th, 2011 at 02:36 PM. Reason: added "Solved" tag

  2. #2
    Join Date
    Nov 2007
    Location
    .mx
    Beans
    305
    Distro
    Ubuntu

    Re: Partition table messed up - hundreds of "ghost" partitions

    Try running testdisk from a live cd.

    sudo apt-get install testdisk
    sudo testdisk

    Choose the analyse option.
    Shamelessly plugging my GLog! (GeekLog) in every post I can
    If your problem is solved, please do take the time to mention it and Mark the Thread as Solved!

  3. #3
    Join Date
    Oct 2009
    Beans
    2,199
    Distro
    Ubuntu 10.10 Maverick Meerkat

    Re: Partition table messed up - hundreds of "ghost" partitions

    I think I can help fix this. What has gone wrong is the daisy-chaining of the extended partitions. It is as if one extended boot record is pointing back to an earlier one, thus creating a loop.

    Code:
    ubuntu@ubuntu:~$ sudo fdisk -lu
    Warning: omitting partitions after #60.
    They will be deleted if you save this partition table.
    
    Disk /dev/sda: 500.1 GB, 500107862016 bytes
    255 heads, 63 sectors/track, 60801 cylinders, total 976773168 sectors
    Units = sectors of 1 * 512 = 512 bytes
    Sector size (logical/physical): 512 bytes / 4096 bytes
    I/O size (minimum/optimal): 4096 bytes / 4096 bytes
    Disk identifier: 0x9bca9bca
    
       Device Boot      Start         End      Blocks   Id  System
    /dev/sda1   *        2048    94928016    47462984+   7  HPFS/NTFS
    /dev/sda2        94928024   129092767    17082372   83  Linux
    /dev/sda3       129437694   976773119   423667713    5  Extended
    Partition 3 does not start on physical sector boundary.
    /dev/sda5       190996848   194900579     1951866   82  Linux swap / Solaris
    /dev/sda6       194900643   276816014    40957686   83  Linux
    Partition 6 does not start on physical sector boundary.
    /dev/sda7       276817920   308142079    15662080   83  Linux
    /dev/sda8       308144128   369606655    30731264   83  Linux
    /dev/sda9       369607518   459282284    44837383+  83  Linux
    Partition 9 does not start on physical sector boundary.
    /dev/sda10      459282348   542049164    41383408+  83  Linux
    Partition 10 does not start on physical sector boundary.
    /dev/sda11      369607518   459282284    44837383+  83  Linux
    Partition 11 does not start on physical sector boundary.
    /dev/sda12      459282348   542049164    41383408+  83  Linux
    Partition 12 does not start on physical sector boundary.
    /dev/sda13      369607518   459282284    44837383+  83  Linux
    Partition 13 does not start on physical sector boundary.
    /dev/sda14      459282348   542049164    41383408+  83  Linux
    Do you recall which partitions are supposed to be there. It appears that the sector addresses are obvious wrong starting at sda11. Did you have 10 partitions originally?

    The method I would use is manual and tedious but will work. It is to look at each EBR in the chain until the one that is erroneous if found and then to fix it. Their locations are unknown but each one tells where the next one is.

    To see the first EBR post the output of:
    sudo dd if=/dev/sda bs=512 count=1 skip=129437694 | hexdump -C
    ASRock P67 Extreme6, Intel i5 2500K, 8GB RAM, nVidia 6600GT, 4x1TB RAID1+0

  4. #4
    Join Date
    Mar 2010
    Location
    Woonsocket, RI USA
    Beans
    3,195

    Re: Partition table messed up - hundreds of "ghost" partitions

    I think that YesWeCan's diagnosis is correct. Editing the disk manually as he suggests can certainly effect a repair, but also as he says, it will be tedious (as well as prone to human error). You might want to try another couple of things first. I make no guarantees that either will work, but one of them might, and if so it will be an easier and safer fix than doing low-level disk editing directly:


    • Try my FixParts on the disk. I've never tested it on a disk with your disk's problems, but it does include features that might make it reject all but the first instances of the duplicated partitions. OTOH, it might crash. If it reads the partitions and shows a reasonable partition list when you type "p" to view the partitions, or if it shows a list with all but one copy of each partition flagged as "omitted", it should be safe to write the partition table back out.
    • Try typing "sudo sfdisk -d /dev/sda > parts.txt" and then examine the parts.txt file. I have no idea what sfdisk will do with the disk, but there's a slim chance that it will discard the duplicate partitions. Even if it doesn't, if it stops trying to read from the infinite loop at some point (as fdisk it), it will probably be easier to edit the parts.txt file to delete the duplicates and then write it back out with "sudo sfdisk -f /dev/sda < parts.txt" than to edit the disk on a low level with a hex editor or repeated uses of dd. If sfdisk keeps running for more than a second or two, though, you should interrupt it with a Ctrl+C keypress, since it's conceivable it'll try to fill the disk with an infinitely large parts.txt file!



    Note that both of these methods are likely to lose anything beyond /dev/sda10. There's significant space after that point on your original disk. The best way to recover those partitions is probably to use TestDisk, as patryk77 suggests. It's conceivable that TestDisk would do the job right when fed your currently-broken disk, but my inclination is to at least try to fix the current partition table before trying TestDisk on the disk.
    If I've suggested a solution to a problem and you're not the original poster, do not try my solution! Problems can seem similar but be different, and a good solution to one problem can make another worse. Post a new thread with your problem details.

  5. #5
    Join Date
    Nov 2007
    Location
    .mx
    Beans
    305
    Distro
    Ubuntu

    Re: Partition table messed up - hundreds of "ghost" partitions

    Quote Originally Posted by srs5694 View Post
    [snip]...but my inclination is to at least try to fix the current partition table before trying TestDisk on the disk.
    The reason I tend to suggest testdisk as the first option to fix partition tables is that if you run the Analyse mode, it generates the partition table for you without overwriting data before you accept the changes.

    It never let me down or overwrote data, and IMO it's much safer than trying to fix anything manually (though I am not familiar with sfdisk).

    Either way, I never had such a problem before, so I can't vouch that testdisk won't be confused either by whatever messed up the table in the first place.
    Shamelessly plugging my GLog! (GeekLog) in every post I can
    If your problem is solved, please do take the time to mention it and Mark the Thread as Solved!

  6. #6
    Join Date
    Jul 2007
    Beans
    140

    Re: Partition table messed up - hundreds of "ghost" partitions

    Thank you all for your inputs. I'm going to try the "testdisk analyse" thing... I wanted to try that yesterday, but the gparted live I have downloaded doesn't boot. And with that system totally dead, it's not easy to go online and download things...
    Anyway, I'll report as soon as I can try your suggestions!

    Cristian

  7. #7
    Join Date
    Jul 2007
    Beans
    140

    Re: Partition table messed up - hundreds of "ghost" partitions

    OK, I've tried testdisk. After selecting "analyse", it said:
    Code:
    Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
    Current partition structure:
         Partition                  Start        End    Size in sectors
    
    > 1 * HPFS - NTFS              0  32 33  5908 253 58   94925969                 
      2 P Linux                 5908 254  3  8035 166 35   34164744
      3 E extended              8057  31 37 60801  80 15  847335426
      5 L Linux Swap           11889   1  1 12131 254 63    3903732
        X extended             12132   0  1 17230 254 63   81915435
      6 L Linux                12132   1  1 17230 254 63   81915372
        X extended             17231   0  1 19180 244  8   31326065
      7 L Linux                17231  30 16 19180 244  8   31324160
        X extended             19181   0  1 23006 242 20   61463891
      8 L Linux                19181  21 41 23006 242 20   61462528
        X extended             23007   0  1 28588 254 63   89674830
      9 L Linux                23007   1  1 28588 254 63   89674767 [VirtualBoxVDI]
        X extended             28589   0  1 33740 254 63   82766880
        Next
    *=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
    >[Quick Search]  [ Backup ]
                                Try to locate partition
    After starting "try to locate partitions" it quickly found these:
    Code:
      HPFS - NTFS              0  32 33  5690  31 22   91409777
      Linux                 5908 254  3  8035 166 35   34164744
      Linux                 8057  31 39 11888 250 10   61558784
      Linux Swap           11889   1  1 12131 254 43    3903712
      Linux                12132   1  1 17230 254 59   81915368
      Linux                17231   1  1 19180 254 56   31326680 [VecchioRoot]
      Linux                19181   1  1 23006 254 60   61464624 [Home]
      Linux                23007   1  1 28588 254 56   89674760 [VirtualBoxVDI]
      Linux                28589   1  1 33740 254 62   82766816 [Musica]
      HPFS - NTFS          33740 254 63 62583 253 62  463362732
      Linux                33741   0  1 46621 254 62  206933264 [Appoggio]
    Does that make sense? It's still searching, but I don't really remember having a second NTFS partition... I really think that shouldn't be there.
    And I seem to recall there was another fairly large partition after the one named "appoggio", but maybe it still has to find it...
    What do you think? I don't know how to read these results...

    Cristian

  8. #8
    Join Date
    Oct 2009
    Beans
    2,199
    Distro
    Ubuntu 10.10 Maverick Meerkat

    Re: Partition table messed up - hundreds of "ghost" partitions

    Quote Originally Posted by Quaxo76 View Post
    What do you think? I don't know how to read these results...
    I think if this data is important to you then don't take chances with "no guarantees" short-cut advice; Why take the risk? I wouldn't.
    ASRock P67 Extreme6, Intel i5 2500K, 8GB RAM, nVidia 6600GT, 4x1TB RAID1+0

  9. #9
    Join Date
    Mar 2010
    Location
    Woonsocket, RI USA
    Beans
    3,195

    Re: Partition table messed up - hundreds of "ghost" partitions

    One problem with TestDisk is that, because it uses CHS values where everybody else has abandoned them in favor of LBA values, it's hard to see how the filesystems it finds map onto existing or old partitions. There's a forumula on the Wikipedia page for CHS to translate from CHS to LBA, so you can use that to see how the TestDisk results map onto those that your "fdisk -lu" output produced. If it's recovered all the correct partitions, and especially if it's also recovered anything that's been lost from beyond /dev/sda10, then having it finalize the changes makes sense. If TestDisk has not recovered some of your partitions (those shown by "fdisk -lu" or those that it's lost), you should be more cautious. You might want to save the start and end points for all the partitions (revealed by both "fdisk -lu" and TestDisk), use whatever method you like to create a legal partition table, and then patch up the rest with fdisk or sfdisk.

    YesWeCan is certainly correct in suggesting that there are risks in such data recovery. This is true of any of the solutions suggested in this thread. At the very least, you should back up your current partition table with "sudo sfdisk -d /dev/sda > parts.txt" (assuming it completes its task and doesn't try to generate an infinite parts.txt file). In a pinch, the "fdisk -lu" data you've posted can be used to regenerate your partition table. Backing up your actual files is also worth doing, assuming Linux generates device nodes you can use to mount filesystems and do the backup. This obviously won't be possible for partitions beyond your /dev/sda10, though.
    If I've suggested a solution to a problem and you're not the original poster, do not try my solution! Problems can seem similar but be different, and a good solution to one problem can make another worse. Post a new thread with your problem details.

  10. #10
    Join Date
    Jul 2007
    Beans
    140

    Re: Partition table messed up - hundreds of "ghost" partitions

    Testdisk finished the scan. The partition table it found does make sense somewhat, but sadly I can't be sure and remember exactly if everything is there. This is the output:

    Code:
    Disk /dev/sdb - 500 GB / 465 GiB - CHS 60802 255 63
    
    The harddisk (500 GB / 465 GiB) seems too small! (< 514 GB / 479 GiB)
    Check the harddisk size: HD jumpers settings, BIOS detection...
    
    The following partition can't be recovered:
         Partition               Start        End    Size in sectors
    >  HPFS - NTFS          33740 254 63 62583 253 62  463362732
    It makes sense because I know I didn't have any NTFS partition, other than the primary one.
    I have the outputs of fdisk -lu and of testdisk, now I'll make a backup of the partition table (and of the MBR) to be sure; then, maybe I'll try letting testdisk do its job... I don't think I have the skills needed to fix it by hand, or the free time to acquire them...

    Thanks for now, I'll report when I have new info.

    Cristian

Page 1 of 6 123 ... LastLast

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •