Recover Partition-Table still present in running system

Question

Hy, I accidentially overwrote the first 1M of my harddisk on linux (using dd). So, the partition-table is gone. I can still access all partition (except the first one) using /dev/sda2 (and so on), so the data is still there. I only need the partition boundaries to restore the table. How can I do this? The Linux-Kernel must still know them because all mount-points still work. fdisk -l /dev/sda doesn't work because it acctualy reads the partition table.

Thanks!

Answer 1

The extents of the partitions can be read from /sys/block/sda/sda1/start, /sys/block/sda/sda1/size and so on. The values are in sectors. Write down these values before doing anything else, especially rebooting.

Once you have the values, you can recreate the partitions with fdisk. Use the u command to switch the unit to sectors, then create the partitions by entering

• n
• primary/logical/extended
• partition number (except for logical partitions: do them in order)
• initial sector
• + size in sectors

Answer 2

Almost two years have passed since the question was asked. We were in exactly the same situation yesterday: We have a Linux Software RAID Level 1 with 2 disks. One of the disks broke down and had to be replaced. We had the disk exchanged and then wanted to copy the partition table from the remaining (working) disk to the new disk. Unfortunately, we copied the empty partition table from the new disk to the old disk. Luckily, we immediately discovered this before rebooting the machine, so the correct partition table was still active in the kernel. Here is what we did to resolve the issue:

• We extracted partition data from the /sys/block/ file system as described in Gilles` answer.
• Our system uses a GUID partition table, so we couldn't use fdisk but had to use gdisk instead.
• gdisk works pretty much the same as fdisk except there is no need to specify u for sectors.
• We created partitions with the exact data as extracted from /sys/block/. There are other answers to similar questions that say to decrease the partition size by one, but that was not neccessary for us.
• With a guid partition table there is no longer a distinction between primary and extended partitions.
• The sys/block file system contains no information about file system types, so we extracted them with mount.
• With a guid partition table, there is no longer a bootable flag. If the partition table to restore is from a bootable disk, there must be a partition with type BIOS boot partition (usually the first partition).

After writing the partition table with gdisk, we were able to reboot the system and everything was running just fine.

Answer 3

Personally, I would use testdisk running from the Trinity Rescue Kit CD. It's well documented. I don't know how to recover the overwritten area of that first partition, though.

Trinity Rescue Kit CD

testdisk wiki and download

Answer 4

The other answers I feel are not comprehensive enough and leave room for error. Here is an actual working example of recovery with a minor caveat I have not seen mentioned anywhere. When taking the sector start and size from /sys/block/sda/* you have to remember to subtract 1 from the size or you will be 1 sector off.

Also remember in fdisk to hit "u" for sector mode.

Here is the example I succesfully followed: Step 1 -Find your device directory in /sys/block/sda/sda1 (change the /sda and /sda1 to match your disk device name and partition number).

You have to do a cat on the 'start' and 'size' which represents the starting sector of the partition and the 'size' represents how many sectors it is.

take the size value and subtract 1 from it or you will not get the original or correct result

fdisk /dev/sda

press u to change to sectors which is what /sys/block/sda goes by

/sys/block/sda [root@server1 sda]# cat sda1/start 2048 [root@server1 sda]# cat sda1/size 1024000

[root@server1 sda]# cat sda2/start 1026048 [root@server1 sda]# cat sda2/size 1464121344

Step 2 -Use fdisk to take the above sector information and input it (remembering to subtract 1 from the size when telling fdisk the end sector)

"Press u" to switch to sector mode once you run:

fdisk /dev/sda

Command (m for help): n Command action e extended p primary partition (1-4) p Partition number (1-4): 1 First sector (63-1465149167, default 63): 2048 Last sector, +sectors or +size{K,M,G} (2048-1465149167, default 1465149167): +1023999

Command (m for help): n Command action e extended p primary partition (1-4) p Partition number (1-4): 2 First sector (63-1465149167, default 63): 1026048 Last sector, +sectors or +size{K,M,G} (1026048-1465149167, default 1465149167): +1464121343

#

http://realtechtalk.com/Linux_How_To_Recover_Partition_Table_from_Kernel_and_Restore_CentosDebian_etc-1772-articles