Well there I was, rebuilding a router and having a good time when I accidentally damaged the partition table on my main Linux installation, which is a GUID partition table, or GPT. Figure 1 (above) shows the cheery message that greeted me at boot.
How did this happen? I was installing Voyage Linux on a compact flash card, and while I was messing around with GParted and other filesystem tools I accidentally ran some commands on
/dev/sdb, my main hard disk, instead of /dev/sdc, the compact flash card. Like, oops. I don't know exactly which operations gummed up /dev/sdb, which would be good to know. But I don't, so let us carry on.
"Press any key to exit" landed at a blinking cursor on a black screen. Fortunately, I always foil the desires of certain distros that disable
ctrl+alt+delete, or make it behave like Windows and open a services manager. I make sure that it is enabled and that it reboots the system. I booted into a different Linux installation and pondered how to make repairs. When your partition table is damaged to the point that your Linux will not boot, you have to fix it from the outside of the damaged system via bootable rescue media, or another Linux in a multi-boot installation. SystemRescueCD on a USB stick is my fave. Any *buntu live system also makes a great rescue distro, especially on a USB stick with persistent storage, because then it remembers your settings, you can install apps, and store documents.
There are no guarantees- you may be able to repair the problem, or you may have to reinstall your operating system. If the partition table is unrecoverable you may not be able to recover your data. So, as always, your first and best line of defense is good backups.
TestDisk
A good tool for repairing partition tables and recovering files is TestDisk. TestDisk operates on both the legacy MBR and the newfangled GPT (see Using the New GUID Partition Table in Linux (Goodbye Ancient MBR)) . TestDisk is in most Linux repos, and on SystemRescueCD. Start it up as root:
$ sudo testdisk TestDisk 6.14, Data Recovery Utility, July 2013 Christophe GRENIER This e-mail address is being protected from spambots. You need JavaScript enabled to view it ; http://www.cgsecurity.org TestDisk is free data recovery software designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error. It can also be used to repair some filesystem errors. Information gathered during TestDisk use can be recorded for later review. If you choose to create the text file, testdisk.log , it will contain TestDisk options, technical information and various outputs; including any folder/file names TestDisk was used to find and list onscreen. Use arrow keys to select, then press Enter key: >[ Create ] Create a new log file [ Append ] Append information to log file [ No Log ] Don't record anything
Select "create a new log file". In the next screen select the disk you want to repair.
Select a media (use Arrow keys, then press Enter): Disk /dev/sda - 2000 GB / 1863 GiB - ST2000DM001-1CH164 >Disk /dev/sdb - 640 GB / 596 GiB - WDC WD6401AALS-00J7B1 Disk /dev/sdc - 32 GB / 29 GiB - SanDisk CF Extreme USB2 Disk /dev/sr0 - 366 MB / 349 MiB (RO) - ATAPI iHAS424 B >[Proceed ] [ Quit ]
This example shows two hard drives, a compact flash drive, and an audio CD.
/dev/sdb is the broken one. In the next screen we select the partition type:Disk /dev/sdb - 640 GB / 596 GiB - WDC WD6401AALS-00J7B1 Please select the partition table type, press Enter when done. [Intel ] Intel/PC partition >[EFI GPT] EFI GPT partition map (Mac i386, some x86_64...) [Humax ] Humax partition table [Mac ] Apple partition map [None ] Non partitioned media [Sun ] Sun Solaris partition [XBox ] XBox partition [Return ] Return to disk selection Hint: EFI GPT partition table type has been detected.
In the next screen, select Analyse:
Disk /dev/sdb - 640 GB / 596 GiB - WDC WD6401AALS-00J7B1
CHS 77825 255 63 - sector size=512
>[ Analyse ] Analyse current partition structure and search for lost partitions
[ Advanced ] Filesystem Utils
[ Geometry ] Change disk geometry
[ Options ] Modify options
[ Quit ] Return to disk selection
Hmm. This does not look good. Select Quick Search:
TestDisk 6.14, Data Recovery Utility, July 2013 Christophe GRENIER This e-mail address is being protected from spambots. You need JavaScript enabled to view it ; http://www.cgsecurity.org Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63 Current partition structure: Partition Start End Size in sectors Bad GPT partition, invalid signature. Trying alternate GPT Bad GPT partition, invalid signature. P=Primary D=Deleted >[Quick Search] Try to locate partition
This can take a little time, so be patient. And hopefully TestDisk will find your partitions:
TestDisk 6.14, Data Recovery Utility, July 2013 Christophe GRENIER This e-mail address is being protected from spambots. You need JavaScript enabled to view it ; http://www.cgsecurity.org Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63 Partition Start End Size in sectors > MS Data 63 89470974 89470912 MS Data 80078846 265625597 185546752 [xubunthome] P MS Data 265625600 1250263039 984637440 [data-xubuntu] Structure: Ok. Use Up/Down Arrow keys to select partition. Use Left/Right Arrow keys to CHANGE partition characteristics: P=Primary D=Deleted Keys A: add partition, L: load backup, T: change type, P: list files, Enter: to continue ext4 blocksize=4096 Large file Sparse superblock, 45 GB / 42 GiB
Hurrah, this is looking hopeful. If it doesn't find your swap partition, or gives you a message that it won't restore it, don't worry about it because a swap partition doesn't hold data and you can easily restore it later. At this point you have the option to select a partition and press P to see your files, and copy them to another storage medium like a different hard drive or a USB stick. Don't copy them back to the same device, because if your recovery fails your copied files go with it. It did a funny thing on my system: no matter which directory I chose to copy files into, they all went into
/home/carla/carla. I couldn't find out if this is the correct behavior, but I got my files back.
When TestDisk finds a partition that it can restore, it is marked in the left column with a P, and highlighted in green. In the above example that is only the third partition. Press the return key, and then you can try writing the partition to disk, or doing a deeper search for more recoverable partitions. The deeper search can take a long time, even several hours on a big hard disk.
TestDisk 6.14, Data Recovery Utility, July 2013 Christophe GRENIER This e-mail address is being protected from spambots. You need JavaScript enabled to view it ; http://www.cgsecurity.org Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63 Partition Start End Size in sectors 1 * Linux 16534 109 24 77825 70 5 984637440 [data-xubuntu] [ Quit ] >[Deeper Search] [ Write ] Try to find more partitions
Then you can select writing the recovered partitions to disk:
TestDisk 6.14, Data Recovery Utility, July 2013 Christophe GRENIER This e-mail address is being protected from spambots. You need JavaScript enabled to view it ; http://www.cgsecurity.org Write partition table, confirm ? (Y/N) TestDisk 6.14, Data Recovery Utility, July 2013 Christophe GRENIER This e-mail address is being protected from spambots. You need JavaScript enabled to view it ; http://www.cgsecurity.org You will have to reboot for the change to take effect. >[Ok]
Several things could happen: You could get a complete restoration with all of your partitions and files. You could get a partial recovery that you can mount from another system and retrieve your files. Or it could all go to that great bitbucket in the sky. Most likely you will get at least some of your files back even if you can't restore your partition table, because stuff that is written to disk is amazingly persistent.
Please visit CGsecurity.org to learn more about TestDisk, and also PhotoRec, an excellent data recovery tool.
