Recovering Partitions

Partitioning can go wrong. Yes, we should have backups. But there are times when you or some utility screws up the partition table.

Ubuntu

I've found reconstructing the partition table straightforward enough with an essential tool: the Ubuntu Live CD.

By booting from the CD to provide good clean access to the harddisk, even when your system partition is still operational.

Once in Ubuntu, open a terminal (from accessories, or Ctrl+Alt-F1).

fdisk

For a simple check on the partition table and disk:

sudo fdisk -l

It is a straightforward way of checking the device name of the disk in question, however although fdisk is a useful partition tool, I advise using parted in this case for its rescue command.

Now before you do anything: it is important to state that everyone's problem is different and this is not a solution to your exact problem. Please make a complete backup of all intact partitions; or make a complete disk image; and at the very least make a backup of your partition table to a usb drive or something (click for details). Editing partitions is a non-trivial matter and although strictly speaking you are only editing the partition index and the actual data on the disk always remains untouched you could lose track of valuable partition data, cause hours of heartache, and by rebooting into a badly reconstructed partition table perhaps cause data damage. Backup.

parted

To run parted (on, for example, /dev/sda):

sudo parted /dev/sda

To get a list of the current partition table:

print

To change the units to a more precise cylinder count, or sector count, use:

unit cyl

or

unit s

Where there are incorrect partition entries overlapping the locations of the partition to be recovered (you are 100% sure!), use the remove command, e.g.

rm 3

Then rescue partitions, use the rescue command with the start and end cylinders (or sectors) estimated for the partition. This can be tricky and it can seem to miss where the start or end values are only slightly off; but other times it will cycle through a list of possible partitions to be recovered based on the filesystem headers that it finds (the first possible partition might not always be the one you are looking for, check the size, as old scraps of filesystems may be lying around and bits of partitions that have been moved will also exist close to the partition we are looking for).

rescue start end

It all works best if you are reconstructing a partition table, or section of, that started at the beginning and continues partition after partition without significant gaps. It is fairly straightforward then to begin a search, recover the first partition, then continue the search at the next available cylinder. Otherwise, a disk utility like Autopsy can help in viewing the disk and search for keywords such as, for example with an ntfs partition "Press Ctrl+Alt+Del to restart", to find the start of the deleted partition.

fsck

Recovered partitions can be "tested" be using the regular Ubuntu desktop to mount and explore the files, though the command fsck will provide a more thorough check.

Regular partition editing can be done a lot more easily from the main menu in System/Administration.