[YLUG] recovering partition table

Sun Jul 26 11:35:07 UTC 2009

If you copy the ENTIRE drive onto a completely new, physically separate disk
then, when you do something wrong or one of the tools you are using doesn't
work perfectly and you screw up the disk, you will still have a copy of the
original mistake to work from. If you don't do this then when you make a
mistake (which we all do sometimes) or the tools can't cope with the mess on
the drive you lose everything.

Recovering an individual partition from the drive is no good as if the
partition table is wrong then you aren't actually copying the partition, you
are copying whatever section of the disk the partition table claims is the
partition. You can then spend as much time fiddling with this copy as you
like and you won't get anywhere. Trying to use this as a backup for the
original damaged partition is just as bad for all the same reasons.

Of course maybe your partition table is fine, in which case your backup of
one partition will work (provided you back it up to a working drive of
course). This is great but firstly, if all the partitions are bad then you
have to back them all up anyway, and secondly, do you really want to run the
risk of losing all your data? If the answer is yes then you can probably go
reformat it all anyway (and this time around do some reading up on LVM and
see how it might help you).

Once you have your backup of the ENTIRE drive (and not before) you can start
working on recovering the drive. You can start by doing what several people
on here have been telling you and run file -L -s /dev/sdd* which will help
you work out where the problem is and give us all a much better chance at
being able to help you.

It would also be really useful to know what your partitions all are. You
seem to have a fairly complicated partition sheme. Is there one partition
for /home? One for /backup? If so then AFTER CREATING YOUR BACKUP OF THE
WHOLE DRIVE then concentrate on those partitions first. You can reinstall
the OS and it is almost certain to be quicker to do that than to recover
everything unless you have a very heavily customised setup (and even then,
recovering your home dir will get you all your personal configs back).

As a final pointer, you say you recovered your swap partition. Why? The swap
partition holds no valid data once you reboot. Just turn the swap off and
ignore the partition when you are recovering stuff.

To summarise:
1) Go buy a new drive that is at least as big as the damaged drive.
2) Use dd to create a bitwise backup of the ENTIRE damaged drive to the new
drive.
3) Go re-read step 2.
4) Go back and do step 2, you aren't allowed to skip it.
5) Work out which partitions are supposed to be /home and /backup.
6) Run file -L -s on  them and post the details on here.

Regards,
Harry Mills
http://haeg.in

If you don't have a good feel for the growth rate of powers of 2, then a
little old man will save your daughter, and you'll grant him anything you
want in your kingdom, and he'll say he just wants one grain of rice on the
first square of a chessboard, then 2 in the second, 4 on the third, and so
on. And then: you'll be all out of rice.

2009/7/25 Patrick Dupre <pd520 at york.ac.uk>

> Wiat a minute,
>
> May be their is one point that I did not get !
>
> Sure, I did not have a blank drive, but I do see what else I could have
> done by cloning the drive. Right now I am trying to save one, the other one
> is still pending, I will decide what to do according the success that I have
> with the first one.
> Till now, I have done only 2 operations which are not reversible:
> testdisk and the restoration of the first partition (swap).
> Without testdisk, their was nothing that I could do. In addition, the
> information that I got from testdisk was correct.
> Doing dd if=  of= from one partition to another partition on another
> disk cannot damage the first disk !
> Then I can do a fsck on the new partition.
> That way the recovering is just painfull because I have to guess the
> first directory of the hierarchie (in fact it really painfull for /usr/lib
> because of the number of directories).
> At the end, for the OS, I will see if my work is OK. by booting the
> machine, but I still have the option of the checking the installation.
> Their is 2 directories that I really need to recover: /home and /backup.
> But again, even if I fail I still have the original disk. But I really
> fails, I do not see the option. Nobody came with one !
>
> For the other disk I even have copy of the partition table, and I
> can check if it matches the information that I have and attribue
> properly the cylinders.
>
> Again, I do not see what is wrong in what I am doing !
>
>
>  > John and Roger have already tried to explain why this is the wrong
>
>> thing to do, but you persist.
>>
>> You MUST copy the ENTIRE disk to a physically separate one.
>>
>> MUST.
>>
>> And you must do this before you do anything else.
>>
>> If you don't have another physical disk (a USB one will do), stop, and
>> wait until you have one. PC World is probably still open now. It'll
>> certainly be open tomorrow morning.
>>
>> Anything else is assumes that you don't care about the data on the
>> disk. And if you don't, why are you bothering doing this?
>>
>> Arthur
>>
>> On Sat, Jul 25, 2009 at 3:25 PM, Patrick Dupre<pd520 at york.ac.uk> wrote:
>>
>>>
>>>>  If I am correct:
>>> dd if=/dev/sdd5 of=/dev/VG2/tmp works if /dev/VG2/tmp is an unmounted
>>> partition, but if of=/tmp/sdd5 is a file on aa mounted /tmp partition,
>>> if does not work !
>>> All the partition are ext3 (except the swap sdd1)
>>>
>>
>>
>>
> --
> ---
> ==========================================================================
>  Patrick DUPRÉ                      |   |
>  Department of Chemistry            |   |    Phone: (44)-(0)-1904-434384
>  The University of York             |   |    Fax:   (44)-(0)-1904-432516
>  Heslington                         |   |
>  York YO10 5DD  United Kingdom      |   |    email: pd520 at york.ac.uk
> ==========================================================================
>
> _______________________________________________
> York mailing list
> York at lists.lug.org.uk
> https://mailman.lug.org.uk/mailman/listinfo/york
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.lug.org.uk/pipermail/york/attachments/20090726/bd4da491/attachment-0001.htm 