Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I destroyed my partition table of my laptop.

Testdisk reports the below

Disk laptop.img - 250 GB / 232 GiB - CHS 30402 255 63 (RO)
 Partition               Start        End    Size in sectors
>P MS Data                   435868     456606      20739 [NO NAME]
 P MS Data                 19232600   19235479       2880 [NO NAME]
 D MS Data                 41945087   83890143   41945057
 D MS Data                 57151486  168579069  111427584
 D MS Data                 67637246  141037565   73400320
 D MS Data                151523326  193466365   41943040
 D MS Data                170617328  170618223        896
 D MS Data                170631168  170634047       2880
 D MS Data                171338232  171344405       6174 [Boot]
 D MS Data                172008235  172231918     223684 [NO NAME]
 P MS Data                193466368  214437887   20971520
 D MS Data                217321375  225321678    8000304 [root]
 D MS Data                224923646  308809725   83886080 [media]
 D MS Data                308809728  420237311  111427584
 D MS Data                418910206  481824765   62914560 [vmimages]

my partition table had 3 Primary Partitions.

 1. WinXP Home
 2. /boot
 3. LVM

inside LVM i had 9 or 10 LVM partitions One of them was my home (encrypted with luks)

testdisk cant recover my partition table or any other partition. Partitions with [P] doesnt have any useful data.

I want to use dd to extract the partitions and try to recover as many files i can. Any ideas of how i can extract eg. the [root] lvm partition from the above testdisk report ?

I am afraid that my disk was also corrupted.

share|improve this question

migrated from stackoverflow.com Nov 1 '12 at 10:48

This question came from our site for professional and enthusiast programmers.

    
You are in trouble. How much dozens of hours or thousands of euros are you willing to spend to recover some of your data? It could be simpler to use backups. –  Basile Starynkevitch Nov 1 '12 at 9:49
    
10 days before that the backup disk 1Tb was failing. The result was hardware failure. My new backup disk came two days after my laptop had crashed. Murphy Law ! –  Evaggelos Balaskas Nov 1 '12 at 9:55
    
Every filesystem has a "magic" set of bytes in the start. You can try to find them and then define the partitions around that. –  graffic Nov 1 '12 at 12:16

1 Answer 1

okei, here is what i have done till this moment. I really hope other people never have to read this on stressful moments.

So i need two things

a. partition table
b. LVM configuration.

are there any in my disk image ? Search for strings at your disk image to extract any useful info.

# strings -t d laptop.img > laptop.img.str

keep in mind that this could be a very large file. For a 250Gb disk my laptop.img.str is about 60Gb !

We need to do this cause ... its much more efficient to search in a 60Gb file and not in 250Gb disk image file.

# head -1 /etc/lvm/backup/VG_file 

will return something like this:

# Generated by LVM2 version 2.02.98(2) (2012-10-15): Mon Nov  5 09:10:16 2012

so i now that i should search for "# Generated by LVM2 version " in laptop.img.str and i did

# grep -E --color '# Generated by LVM2 version ' laptop.img.str > LVM2.extracts

i've found a lot. Sorted my date and something like:

24956608512 # Generated by LVM2 version 2.02.97(2) (2012-08-07): Sat Sep 22 16:22:39 2012

was the result.

okei so there is something useful about lvm2 configuration.

Next step.

Almost every disk has a 512 bytes sector, so calculate it:

# echo 24956608512/512|bc
48743376

hmmm lets hope to find something interesting :

# dd if=laptop.img bs=512 skip=48743376 count=1 

and in fact something very beatiful came to my screen

# Generated by LVM2 version 2.02.97(2) (2012-08-07): Sat Sep 22 16:22:39 2012

contents = "Text Format Volume Group"
version = 1

description = "Created *after* executing 'lvextend -l +100%FREE /dev/vg01/mmoviess'"

creation_host = "mylaptop"  # Linux mylaptop 3.5.3-1-ARCH #1 SMP PREEMPT Sun Aug 26 09:14:51 CEST 2012 x86_64
creation_time = 1348320159  # Sat Sep 22 16:22:39 2012

changing count from 1 to 4 and i now have my entire LVM2 conf file. Backup somewhere safe and continue with the partition table.

I now that i had three (3) primary partitions. sda1 - sda2 - sda3 So i thought to search for them at laptop.img.str.

Finally and with the above steps i found this:

Disk /dev/sda: 250.1 GB, 250059350016 bytes, 488397168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000b13ab

   Device Boot      Start         End Blocks   Id System
/dev/sda1   *          20    41945087    20972534    7  HPFS/NTFS/exFAT
/dev/sda2        41945088    42469375      262144   83  Linux
/dev/sda3        42469376   488397167   222963896   8e  Linux LVM

Testdisk report didnt help at all.

hexdump became my new best friend !

also useful: grep with -a -b parameters and losetup with offset paramater ! no extra software - no extra installs - nothing.

just basic cmds with powerful use.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.