Thursday 9 February 2012

Nuked the partition table & trying to save all data.

A while ago I tried to dd an .iso on my flash drive, but of course I didn't pay attention and just copied someone else's code without even reading it, just figuring it would work :) And it did, though it worked on the wrong /dev/sdX. The result: I nuked the partition table of (first 512 bytes) of my /dev/sdb. Note that this 500GB hard drive had ALL my personal data in it, including old photos, savegames, VERY old games and backups from all my computers.


The good thing about this was that the partition with all my data was still there, but the hard drive didn't know where it started. That's when I started panicking. The only -safe- solution would be to dd an image of my hard drive to another hard drive, and try to save my partition after having a backup. The problem: I didn't have another 500GB drive. Problem officer?


The code I used to do this magical thing was:

dd if=/dev/zero of=/dev/sdX bs=512 count=1

but replacing X with b. I replaced b with X just in case someone follows my retardation and copies this as well. The above command will write 0's to the first 512 bytes of your hard drive, which is where the partition table is at (i.e. it tells the hard drive where each partition is stored).

Luckily, I only had one large NTFS partition on this hard drive, so it was easier to save.

Desperately trying to save my partition, I asked around in forums and got quite a few replies for using gpart, testdisk and more software. I decided to stick with good old parted, because I read on their page about a magical "rescue" command, which seemed like what I wanted. After a few days of agony, I figured what the hell, I'll just try parted and hope it doesn't fail me. And here's what I did:

First, fdisk -l to make sure which /dev/sdX I wanted to use (in my case /dev/sdb). After that, it was all magic. Using mklabel to make a new partition table in parted, and then using rescue with two random values that I thought were the beginning and the end of my partition. Parted then looks around those blocks to see if a partition exists. See for yourselves:


parted /dev/sdb
GNU Parted 3.0
Using /dev/sdb
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) print
Error: /dev/sdb: unrecognised disk label
(parted) mklabel
(parted) mklabel msdos
(parted) rescue
Start? 0
End? 976773168 // This was just a random guess.
Information: A ntfs primary partition was found at 32.3kB -> 500GB. Do you want to add it to the partition table?
Yes/No/Cancel? yes
(parted) quit
Information: You may need to update /etc/fstab.


And I lived happily ever after:


fdisk -l
Disk /dev/sdb: 500.1 GB, 500107862016 bytes
255 heads, 63 sectors/track, 60801 cylinders, total 976773168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000f059d

Device Boot Start End Blocks Id System
/dev/sdb1 * 63 976768063 488384000+ 7 HPFS/NTFS/exFAT


Hope this helps someone save their partition after being stupid like me :)

No comments:

Post a Comment