6. Recovering a Deleted Partition Table

1. Make a partition that is at least as big as your first partition was. You can make it larger than the original partition by any amount. If you underestimate, there will be much wailing and gnashing of teeth.

   Command (m for help): n Command action e extended p primary partition (1-4) p Partition number (1-4): 1 First cylinder (1-23361, default 1): <RETURN> Using default value 1 Last cylinder or +size or +sizeM or +sizeK (1-22800, default 22800): 13032 Command (m for help): w

2. Run dumpe2fs on the first partition and grep out the block count.

   Example:

   % dumpe2fs /dev/sda1 | grep "Block count:" Block count: 41270953

   If you are uncertain about this value, repeat Step 1 with a bigger partition size. If the block count changes, then you underestimated the size of the original partition. Repeat Step 1 until you get a stable block count.

3. Remove the partition you just created

   Command (m for help): d Partition number (1-4): 1

4. Make a new partition with the exact size you got from the block count. Since you cannot enter block size in fdisk, you need to figure out how many cylinders to request. Here is the formula:

   (number of needed cylinders) = (number of blocks) / (block size) (block size) = (unit size) / 1024 (unit size) = (number of cylinders) * (number of heads) * (number of sectors/cylinder) * (number of bytes/sector)

   In theory! In practice, it's rather more complicated. fdisk tries to end its allocation for a partition on a cylinder boundary, so it can be hard to figure out the relationship of cylinders to blocks.

   Here is an example of the problem. Below, I have formatted a drive with partitions with 1, 2, 4, and 8 cylinders.

   disk /dev/sda: 16 heads, 63 sectors, 23361 cylinders Units = cylinders of 1008 * 512 bytes Device Boot Start End Blocks Id System /dev/sda1 1 2 976+ 83 Linux /dev/sda2 3 5 1512 83 Linux /dev/sda3 6 10 2520 83 Linux /dev/sda4 11 19 4536 83 Linux

   If I divide each partition by the number of cylinders, I ought to get the block size (16 heads * 63 sectors * 512 bytes/sector divided by 1024 = 504), right? Not true!

   allocated #of block blocks cyl size 976 / 1 = 976 1512 / 2 = 756 2520 / 4 = 630 4536 / 8 = 567 8568 / 16 = 535 16632 / 32 = 519 32760 / 64 = 512 64984 / 128 = 507 129528 / 256 = 505 258552 / 512 = 504 516600 / 1024 = 504 1032664 / 2048 = 504

   Notice that as the number of cylinders grows, the closer to the real block size the calculated value for the allocated blocks becomes.

   You will have to make guestimates and converge on the true number of cylinders to use. You will ultimately get an exact match because the block count from dumpe2fs came from a well-formed partition.

5. Run e2fsck on it to verify that you can read the new partition.

6. Repeat Steps 1-5 on remaining partitions.

Remount your partitions. Amazingly, all of your data will be there.

Credit goes to:

• Mike Vevea, jedi sys admin and MGH's finest, for giving me these tips.