Partition recovery

Depending upon your point of view what I'm about to describe is either prevention or keeping yourself informed, well I think it's both. Simply put, keep the exact details of the partitioning of your disk and in the event that your partitioning becomes corrupt you are in a position that you will be able to recreate the partitioning from complete scratch if needs be.

Not everyone may be aware that deleting a “partition” can leave the data completely intact. I've placed the word partition in quotes as what usually gets deleted when you choose to delete a partition with tools such as fdisk (Linux & Windows) all that gets removed is the partition record. By just recreating the record the partition will become visible again (may require a reboot). ¹

The only problem with this approach is making sure that you have recorded enough of the detail. One option is to simply save all the sectors of the partitioning of the disk which can then be placed back if the partitioning ever becomes incorrect. This is certainly the most convenient approach however it does not leave you any more informed about your partitioning. This is where the variety of different partitioning tools come into play, note differing levels of detail will be reported and some tools can even present the data in misleading ways.

In Linux sfdisk is the best standard tool I've come across to use when wanting a detailed report off your disks partitioning. The command

sfdisk -xf [LOCATION OF DEVICE]

sfdisk -xdf [LOCATION OF DEVICE]

Where Parts comes in

I'm not going to try and claim that Parts is something revolutionary, as tools such as Nortons diskedit give it to you straight and allow you to enter any data you like, their fdisk equivalent gdisk also seems quite good. Not to mention sfdisk of course however I think its downfall is in the documentation. However I do feel there is something lacking in the thorough validation of a disks partitioning. This group of tools have really only been designed to report the current partitioning, hence Partslist. Partsedit and Partsfix only exist so that you can make changes going by output from Partslist.

There being a cure all depends upon what actually was done which subsequently caused the problem and what you have done in the mean time to fix the problem. Note: even attempts to keep using the system can potentially make conditions worse.

There are many tools available for recovering partitions however the best thing always to do is stand back and look at the situation. For example when looking into the partitioning after a problem has occurred you really want to be using a tool you will not accidentally start changing the partitioning with. The worst thing to have happen after the partitioning being corrupted is to find the tool you are using to diagnose the situation with only makes things worse. This is precisely why I have developed my tools where the diagnosis tool contains no code for manipulating the partitioning, it is simply ² a reporting tool. And the editting tool allows any values to be set despite the fact the value may be definitely invalid, this way when using the edit tool you will never get a situation where the tool can not handle your request.

A common problem is finding that your primary partition table is cleared. In such a case there is really only one way of getting the data back, it involves locating the remaining data and using it to determine your partitioning setup. There is however more than one way of going about the recovery process. There are many different tools available for performing this process, however I will only be covering just two. The first is gpart which is a tool that attempts to guess your partitioning by analysising data remaining on your disk. It is able to do this by using data that is in the form of valid file system tables and secondary partition tables. As the documentation for gpart states, this approach is not perfect as it can identify false positives. Incorrect matches can arise if your disk has been partitioned up in more than one way. When the old partitioning is removed and replaced with different partitioning the old file system tables and secondary partition tables can ³ remain. So a search of the disk by gpart will find more than just your disks most recent partitioning. This is usually not a huge problem and a lot of work has gone into gpart to cope with such circumstances.

The second approach while it could be automated involves you using a number of tools at the command line. The difference with this case is that you are using tools that actually recoginise and are able to validate the the disks file systems. The detail for the step by step procedure can be found in the Linux HOWTO dated September 2000 which I have a of copy on this site. Several of the programs required to follow the HOWTO can be found be here. But to put it simply you create a single partition, ensuring that it starts at or before where the original partition started and ends at or after where the original partition ended. Of course for the first partition this is simple it will start at Cylinder 0, Head 1, Sector 1 and you might aswell set the end to be the end of your disk.⁴ Then run the file system validation programs over the partition and using the detail reported you can work out what the actual ending point is for the partition.

And yes you guessed it with the first partition correctly setup, you continue on with the process until you have recovered all your partitions or at least the ones you can be bothered with :).

Now this approach detailed in the HOWTO I personally do not like as it involves modifying the disks patitioning so as to determine what the partitioning was before the corruption occurred. However I have not managed to so far devise an alternative so I'll just have to grin and bare it. On the other hand though if you have a spare disk you could copy the whole of the corrupted disk to another, determine what needs doing by playing with the copy. Once all is understood apply the necessary changes to the original disk. Of course though, if you were such a cautious person you wouldn't be in this position any way.

Note if it is a FAT file system that you are trying to recover, the File System Label (sector, not the actual label used to name the file system) contains the detail necessary for determining where the partition ends. This sector is the first in the partition, and using a tool like Norton's diskedit you can easily locate the relevant field. In other words I can't currently point you any more precisely to getting the detail.

Handy information

If viewing a sector that you suspect to be a secondary partition table, to work out the starting sector of the Partition Chain you can use the following formula:

[sector being viewed]
+ [data partition's Starts@ Sector Nr]
+ [data partition's Length in Sectors]
- [extended partition's Starts@ Sector Nr]

sfdisk -R [LOCATION OF DEVICE]