Re: Partition recreated in different place

[Andrew Clausen]

On Wed, Apr 24, 2002 at 10:42:03AM +0100, Stephen Turner wrote:
> Andrew Clausen wrote:
> > On Tue, Apr 23, 2002 at 07:27:00PM +0100, Stephen Turner wrote:
> > > Using the parted 1.4.21 rescue disk, I moved a partition, which caused
> > > it
> > > to start at position 4330.020 MB.
> > >
> > > Later, I rm'ed the partition and attempted to recreate it with mkpart.
> >
> > Bad idea.
> >
> 
> Thanks for your help with this, Andrew.
> 
> OK, so I did the wrong thing. But can I suggest that the docs gave me the
> wrong impression here:
>   "rm... If you accidentally delete a partition with this command, use
>    mkpart to recover it."
> Maybe this should say something like "... command, you MAY be able to use
> mkpart..."

Good point.

> Also, why did program think that 4330.020 was a good place to start a
> partition when I was moving it, but later decide that it was an illegal
> place to create a partition when I used mkpart? Is there a bug here, or
> was parted right for some reason?

Perhaps it's a renumbering issue?  If it was previously numbered 5,
then it has special properties that allow it to be in place it otherwise
wouldn't be allowed to be.

> > Try using gpart, or parted 1.6.x's "rescue" command.
> 
> Unfortunately neither of these seems able to find the partition. Is there
> anything else I can do?

It sounds like Major Surgery TM :(

Step 1 is to find the exact start
(should be easy, since you have that number parted had before...
just a matter of dd, xxd and less)

Step 2 is to fix the partition table... if my theory is correct about
partition 5... then well, you can either hack around with sfdisk,
or gdb + parted and edit data structures in memory (!).

I feel comfortable doing the later, but you mightn't ;)

Another "safer" strategy is to "extract" the data out of the disk
onto another disk.  (Just buy another hard disk, or borrow one).

I recommend that, unless you're a Poor Student TM (but poor students
usually have friends who can lend them a HD, right?), or something...

Anyway, the idea is:

        # dd if=/dev/hda of=/dev/hdbX bs=512 skip=Y count=Z

The hard part is finding Y.  Y will roughly be 4330.020 * (1024 * 1024 / 512),
so try a few numbers either side of that, doing:

        # dd if=/dev/hda bs=512 skip=Y count=1 | xxd | less

Until you see something that looks like ext2.  (hint: ext2's signature
is 0xef53 (so look for 53ef, or whatever, because of endianness...)

Remember that the ext2 superblock starts 2 (512byte) blocks into
the file system, so you need to subtract 2 from the block number you
find.

Andrew