[YLUG] recovering partition table

[Roger Leigh]

On Sat, Jul 25, 2009 at 01:17:08PM +0100, Jess Wardman wrote:
> On Sat, Jul 25, 2009 at 1:15 PM, Patrick Dupre<pd520 at york.ac.uk> wrote:
> > On Sat, 25 Jul 2009, john halewood wrote:
> >
> >> Boot into single user mode (add 'single' to the grub boot line), then
> >> run fsck on /dev/sdd5 and see what it tells you. May be recoverable,
> >> but if the boundaries have changed you might have a big problem.
> >
> > My understanding is: do not use fsck, it mess up every things

> <anecdote>I've never had problems with it. </anecdote>

If your partition table is incorrect, fsck will be essentially reading
random data, and its behaviour may not be predictable.  It's quite
likely it won't find the ext magic number, and will fail gracefully.
However, there's also a possibility that it sees what looks like a
valid superblock and will proceed to further ruin your data.  The ext
fsck is the most robust fsck out there (amazingly, it's the only one
that includes regression tests and is tested on random inputs), so it
/should/ be relatively safe.

ext looks for the superblock at a fixed offset, so if your partition
table boundaries are incorrect, it won't find it (or the backup
copies).

Personally, I wouldn't run *anything* on the disk without first taking
a bit-image copy with dd.  If you value the data that's on there, you
risk losing it by making any further changes.  We don't know what
Patrick has done here to cause the problem, but I have accidentally
mis-edited a partition table before, and it's quite possible to get
it working again if you recreate it exactly.  Backing it up with dd
onto a floppy helps here.  But running fsck is of limited value, since
the filesystem is undamaged, just inaccessible, if the partition table
is invalid.

This is where file(1) is useful, since it can tell you if you're
looking at a valid filesystem or unidentifiable garbage.


Regards,
Roger

-- 
  .''`.  Roger Leigh
 : :' :  Debian GNU/Linux             http://people.debian.org/~rleigh/
 `. `'   Printing on GNU/Linux?       http://gutenprint.sourceforge.net/
   `-    GPG Public Key: 0x25BFB848   Please GPG sign your mail.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url : http://mailman.lug.org.uk/pipermail/york/attachments/20090725/976c094c/attachment-0001.pgp