Sun Dublan
July 2006 Archives 

July 01, 2006

Lost partition table? Bah. 01:20 AM,

It's a miracle I post something here. This blog is so neglected.

I got a new PC with a legitimate copy of Windows. I played around with it for a while. This "play around" meant that I also played some World of Warcraft. That included installing it and downloading a HUGE patch from the Internet and getting it configured nicely with addons and such. Eventually, I wanted to install Gentoo. I tried copying things over from a vmware instance, as I've been able to do with other systems. I had things copied and I ran grub. Well, I must have not installed grub correctly because it did some very weird things on reboot. So, I wanted to just get rid of GRUB and simply start over, maybe building Gentoo from scratch. So, I ran a familiar command to nuke the master boot record, writing the first 512 bytes of the disk with zeros:

# dd if=/dev/zero of=/dev/sda bs=512 count=1

The outcome of that was surprising, because now my computer couldn't boot at all, and after booting with a rescue cd, I found that my partition table was ruined. Apparently, my partition table was part of the first 512 bytes! The obligatory, "that was weird, I've never had that happen to me" thought came. Then the "uh, you're going to have to reinstall from scratch, because you have no clue about what your partition table was like." thought came.

I didn't want to reinstall. Besides the amount of time getting WoW going, there were several other things that made me not want to spend another day getting this box back up to speed. So, I decided to try to figure out how to make the partitions somehow.

If you want to know how I solved this, read on.

First I tried remembering, "uh, lets see, the Windows partition was about 132GiB. I'll just make it that size and see if it works." So, I created the partition, and then tried to run "ntfsresize -i /dev/sda" to see if it can read it. Well, it couldn't, and it said that my partition table was screwed.

Then, I had the idea that I might be able to figure this out if I just look at the drive and somehow figure out where things are. The first reflex was typing "less /dev/sda" and starting to read it. Of course, that was ugly. I was using a livecd to do this, and it didn't have hexedit, so I copied the hexedit binary from another box to the livecd and ran it: "./hexedit /dev/sda". Hrm, I could see that the first 512 bytes were zeroed. I also could see that the new partition table I made was right on the edge of it. I could also see that there was still some grub code there, after the partition table! Stupid grub. I think I'll be a regular LILO user from now on.

I paged down farther to find where the first partition started. When I got to it, it dawned on me: "duh, the manufacturer of this PC puts a maintenance partition on the first partition of the disk. Question is, just how big is it, and where does the next partition start?"

Since I could clearly see where the first partition started, I could see what byte number it was on. It started on byte 7E00, which is byte 32256 in decimal. I guessed that number made sense, as it was 215 (32KiB) minus 512 bytes. I thought I might be able to get to the next partititon by searching for the string "NTFS", since that partition contains an NTFS partition. Indeed, the first few bytes included the string "NTFS" at byte number 3ec1000, or 65802240 in decimal. So, I created a new partition the size of 65802240 minus 32256, which would be the maintenance partition, which would be 62.723 MiB.

Now that I had that first partition offset, I could try to do what I set out to do before, and guess the size of my NTFS partition. I thought it was 128G, so I created a partition that was 128G. I then ran "ntfsresize -i" again, to see if I got te partition right. Well, I didn't get the size of the partition right, but I did get the first part of the partition right, because ntfsresize found an NTFS filesystem and told me its stats. It warned me, paraphrased, "Hey, man. You've got your partition size borken, because this NTFS filesystem is bigger than your partition." And it gave me the exact size of what the filesystem should be. So, I rewrote the partition with the size it gave me, and fdisk padded the size I gave it at the block boundary, was about 3M bigger than the NTFS partition.

For what it's worth, I still wasn't able to boot, because half of GRUB was still there. I had to use a tool that would remove grub to make it actually remove it. After that, I was able to boot into Losedows again.

So, this goes to show, if you lost your partition table, if you can find byte number of the start of the partition, and then guess the size a little, you can still pull out of it.

8/3/2011 Webmaster: Troy Bowman