Page 1 of 4 123 ... LastLast
Results 1 to 10 of 39

Thread: I Deleted My Partition Table

  1. #1
    Join Date
    May 2013
    Beans
    22

    I Deleted My Partition Table

    Hello!
    I made some dumb decisions and completely deleted and overwrote my partition table (DOS type) on my one terabyte drive

    My partitions used to be as follows:
    Partition 1: (NTFS) Windows 7 (about 880 gigabytes)
    Partiton 2: (SWAP) Linux SWAP (10 gigabytes)
    Partiton 3: (ext4) Linux Mint (about 45 gigabytes iirc)

    I have tried for many hours trying to figure this out
    My friend insists that it is an easy fix.

    Heres what i have tried so far:
    Testdisk:
    Code:
    The harddisk (1000 GB / 931 GiB) seems too small! (< 1622 GB / 1511 GiB)
    Check the harddisk size: HD jumpers settings, BIOS detection...
    
    The following partition can't be recovered:
         Partition               Start        End    Size in sectors
    >  FAT12                63093   0  1 197290  26  6 2155876449
    Gpart
    Gparted live cd (Returns
    Code:
    kernel panic-not syncing vfs unable to mount root fs on unknown-block (1,0)
    on boot)
    this (even with fdisk -c=dos)

    Some notes:
    -fdisk tells me that my logical sector size is 512, and physical sector size is 4096
    -I am getting confused with all of these darn numbers (i passed math class with a 51% last semester if that has any meaning)
    -I don't think i overwrote anything but y'know, anything is possible

    Any help is appreciated and ily have a nice day :)

  2. #2
    Join Date
    Jun 2009
    Location
    SW Forida
    Beans
    Hidden!
    Distro
    Ubuntu

    Re: I Deleted My Partition Table

    Does testdisk show all partitions?
    It often shows multiple versions as it finds all the old partitions, so if resized several times it may show all of them. You have to pick the combination that does not overlap and was your old configuration.

    https://help.ubuntu.com/community/DataRecovery
    http://www.cgsecurity.org/wiki/TestDisk
    Testdisk Instructions
    http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

    Some also like parted rescue, if you have approx. start & end in sectors for partition.
    Used parted rescue
    http://ubuntuforums.org/showthread.php?t=2315405
    backup partition table before any changes, so you can get back to current if changes not correct
    sudo sfdisk -d /dev/sda > PT.txt
    So you know sectors:
    sudo parted /dev/sda unit s print
    UEFI boot install & repair info - Regularly Updated :
    https://ubuntuforums.org/showthread.php?t=2147295
    Please use Thread Tools above first post to change to [Solved] when/if answered completely.

  3. #3
    Join Date
    Mar 2011
    Location
    Idaho
    Beans
    293

    Re: I Deleted My Partition Table

    I made some dumb decisions and completely deleted and overwrote my partition table (DOS type) on my one terabyte drive
    What program or terminal command was used ? Do you know if the hdd is GPT or MBR partitioned ?

  4. #4
    Join Date
    Oct 2006
    Beans
    57,593

    Re: I Deleted My Partition Table

    Moved to the "MINT" forum.

  5. #5
    Join Date
    May 2013
    Beans
    22

    Re: I Deleted My Partition Table

    MBR
    I used the windows installer to make the first partition, and Linux mint installer to make the other 2.

  6. #6
    Join Date
    Mar 2011
    Location
    Idaho
    Beans
    293

    Re: I Deleted My Partition Table

    Just what did you do to delete the partition table ? when you ran 'testdisk' it will make a log file at /home/username/testdisk.log , can you post it ? It might give us some lite on your problem.

  7. #7
    Join Date
    May 2013
    Beans
    22

    Re: I Deleted My Partition Table

    uhh well its quite embarrassing actually...
    i opened gparted with the intent of shrinking my windows partition, and i went "Hey, i dont need to waste 10GB on SWAP!" and deleted the swap partition. Then i noticed that the EXT4 partition was also gone! The session was still live, and i knew i couldnt really reboot... So i tried for about an hour to fix it, then made the dumbest decision ever. I pressed the "create new partition table"...
    I have since then tried to make a new partition table, and i did it wrong. So no real chance of just recovering the table from there.

    Anyways, the output of testdisk after both a quick scan and deeper scan are here
    Some noticeable things (to me at least) are that: It shows the SWAP partition values perfectly, and the SWAP is in between both other partitions. I figure that if i make a partition from the first sector to the start of the swap, then from there to the end of swap, and from there to the last sector, it should be fine. Also, it says "Warning: the current number of heads per cylinder is 255 but the correct value may be 16.", which could be an issue i guess

    Thanks for the responses guys!

  8. #8
    Join Date
    Mar 2011
    Location
    Idaho
    Beans
    293

    Re: I Deleted My Partition Table

    Lets make a guess that the first partition starts at the 1m bounty (2048th sector). You can use 'dd' to look at the data and see if it is a NTFS boot record, if so it will contain at beginning offset 28 the total number of sectors in partition.

    Will show you what the boot record for win7-10 should look like. (first sector for MS Windows 7-10)
    http://www.ntfs.com/ntfs-partition-boot-sector.htm
    http://thestarman.pcministry.com/asm/mbr/W7VBR.htm

    sudo dd if=/dev/sda skip=2048 count=1 bs=512 | hexdump -C (not sure if hexdump is include with the live linux cd, if the command give a error command not found try
    sudo dd if=/dev/sda skip=2048 count=1 bs=512 | hd

    Make sure that /dev/sda is the correct hdd.
    if the first line contains 'NTFS' post the 3rd line offset 20. so the total sector count at offset 28 can be calculated. The number will be in little-endian format. where 123456 would be 563412 hex, will need to add 1 for the correct sector #. Then the last sector can be checked for the same dd output , then the last sector is verified and the data can be written to the MBR with fdisk ,sdisk.

  9. #9
    Join Date
    May 2013
    Beans
    22

    Re: I Deleted My Partition Table

    Here is the result of the first command:
    Code:
    $ sudo dd if=/dev/sda skip=2048 count=1 bs=512 | hexdump -C 
    1+0 records in
    1+0 records out
    00000000  78 02 00 4d 53 57 49 4e  34 2e 31 00 02 40 68 00  |x..MSWIN4.1..@h.|
    00000010  02 00 00 00 00 f8 00 00  3f 00 ff 00 00 08 00 00  |........?.......|
    00000020  00 40 7f 6d df 6b 03 00  00 00 00 00 02 00 00 00  |.@.m.k..........|
    512 bytes copied, 0.000270273 s, 1.9 MB/s
    00000030  01 00 06 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
    00000040  80 00 29 62 19 b3 32 4e  4f 20 4e 41 4d 45 20 20  |..)b..2NO NAME  |
    00000050  20 20 46 41 54 33 32 20  20 20 00 00 00 00 00 00  |  FAT32   ......|
    00000060  40 45 00 9c 2f 7f 00 00  78 00 00 9c 2f 7f 00 00  |@E../...x.../...|
    00000070  20 4d 00 9c 2f 7f 00 00  90 1d 00 9c 2f 7f 00 00  | M../......./...|
    00000080  c1 59 70 74 00 00 00 00  ef 13 00 00 00 00 00 00  |.Ypt............|
    00000090  af 6d 70 74 00 00 00 00  ff ff ff ff 08 00 00 00  |.mpt............|
    000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
    000000b0  c0 00 00 00 00 00 00 00  64 00 00 00 00 00 00 00  |........d.......|
    000000c0  00 00 00 00 00 00 00 00  50 45 00 9c 2f 7f 00 00  |........PE../...|
    000000d0  20 4d 00 9c 2f 7f 00 00  90 1d 00 9c 2f 7f 00 00  | M../......./...|
    000000e0  3f 00 00 00 00 00 00 00  c1 07 00 00 00 00 00 00  |?...............|
    000000f0  ff 07 00 00 00 00 00 00  ff ff ff ff 04 00 00 00  |................|
    00000100  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
    00000110  00 00 00 00 00 00 00 00  f1 00 00 00 00 00 00 00  |................|
    00000120  20 1d 00 9c 2f 7f 00 00  60 50 00 9c 2f 7f 00 00  | .../...`P../...|
    00000130  20 4d 00 9c 2f 7f 00 00  90 1d 00 9c 2f 7f 00 00  | M../......./...|
    00000140  00 08 00 00 00 00 00 00  c1 25 ff 6c 00 00 00 00  |.........%.l....|
    00000150  c0 2d ff 6c 00 00 00 00  01 00 00 00 00 00 00 00  |.-.l............|
    00000160  10 54 c9 b1 2f 7f 00 00  00 00 00 00 00 00 00 00  |.T../...........|
    00000170  b0 45 00 9c 2f 7f 00 00  91 00 00 00 00 00 00 00  |.E../...........|
    00000180  10 4d 00 9c 2f 7f 00 00  90 24 00 9c 2f 7f 00 00  |.M../....$../...|
    00000190  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
    *
    000001b0  40 00 00 00 00 00 00 00  54 00 00 00 00 00 00 00  |@.......T.......|
    000001c0  00 00 00 00 00 00 00 00  00 08 00 00 00 00 00 00  |................|
    000001d0  c1 25 ff 6c 00 00 00 00  c0 2d ff 6c 00 00 00 00  |.%.l.....-.l....|
    000001e0  00 20 21 00 0b fe ff ff  00 08 00 00 c1 25 ff 6c  |. !..........%.l|
    000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa  |..............U.|
    00000200
    Im not sure if FAT32 is what we are looking for here, but i certainly dont see NTFS anywhere.
    Thanks again for the help!!

  10. #10
    Join Date
    Mar 2011
    Location
    Idaho
    Beans
    293

    Re: I Deleted My Partition Table

    The dd' dump indicates that FAT32 partition took most of the hdd space, so it is not what you want. An old deleted partition.
    The next step to find the correct start sector manually (the only way I know how) . Normally testdisk works

    in terminal:" sudo hexeditor -d /dev/sda " Note:verify sda is correct hdd Note: program will not be writing to hdd

    Control + W for search (look at bottom of hexeditor for control keys)
    new box pops up select "search for Hex bytes" Note: use arrow keys and press enter
    new box type in "eb 52 90 4e 54 46" Note:do not enter the spaces and prss enter Note: if your keyboard has right side number keys its enter may not work.

    The search should only display if the first line has ".R.NTFS" at its start.

    verify that the offset (left side digits '3D100000' =Hidden Sectors X 200)
    also verify that the offset/200= a whole number (no fraction /leftover)
    if the above 2 test are not met , search for next match

    from my hdd:
    3D100000 EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00 .R.NTFS .....
    3D100010 00 00 00 00 00 F8 00 00 3F 00 FF 00 00 88 1E 00 ........?.......
    3D100020 00 00 00 00 80 00 80 00 FF BF 04 00 00 00 00 00 ................

    Number of Hidden Sectors-OFFSET (1C-1Fh)--00 88 1e 00=1e8800 hex = 2000896
    Total Sectors-OFFSET (20-2f)-- ff bf 04 00 00 00 00 00 =04bfff hex=311295
    Hidden + Total = Last sector (2000896+311295=2312191=******)
    the start sector data = last sector data, if not wrong sectors

    One partition on my hdd :2000896 start 2312191 last 152.0 MiB
    one sector is 512 bytes ==200 hex bytes

    sudo dd if=/dev/sda skip=****** count=1 bs=512 | hexdump -C Note: run to compare first and last sector.the first 5 lines are important.

    Hope you can understand my poor instructions, if not ask. Must be off to sleep.
    If you find the correct sector #'s be sure to write them down., for next step.



    to search for next pattern match - control +w--select next--enter

Page 1 of 4 123 ... LastLast

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •