blah.... blah.... blah...

Last night, I lost my hard disk's MBR, (i.e. 0th sector of my HDD). I was so confused and tensed, that I actually forgot the sizes of my deleted partitions. Thanx to my memory I remembered the filesystems of my partitions.

My primary partitions were:

1. NTFS
2. FAT32
3. EXT3
4. EXTENDED

My extended partitions are:

1. EXT3
2. EXT3
3. SWAP (LINUX)

I've my Ubuntu Live CD so I booted from it.

And then I created a fake MBR (with the help of fdisk, shipped with Linux) where my first partition is spanning whole hard disk and system id is NTFS. I then flushed changes to the disk.

My first partition is NTFS, so I checked the hexdump (hexdump -C /dev/sda1) and then with the help of NTFS Volume Information format (as described in Upgrading and Reparing PCs by Scott Mueller), got the count of sectors reserved by NTFS partition. So I've replaced the count of sectors of NTFS partition with the size of first partition in MBR. So, my first partition is recovered.

Similarly, I created 2nd partition (FAT32) in MBR spanning rest of the disk. And with the help of FAT32 Volume Information format (as described in Upgrading and Reparing PCs by Scott Mueller), I corrected its sector count. And its entry gets restored tooo...

For 3rd EXT3 partition, there is no information in the book, so I've to use a tool named dumpe2fs (or e2fsdump), to get the count of sectors occupied by the third partition. I corrected its sector count. And its entry gets restored tooo...

For EXTENDED partition, I've to tweak a bit. First, I created an EXT3 partition (because I doubted that creating an extended partition might zero my existing extended partitions), spanning rest of the disk and flushed it. Then read the MBR in a file named "mbr" with dd (dd if=/dev/sda of=mbr bs=512 count=1). With the help of hex editor (GNU eMacs in hexl-mode), I manually changed last partition's system id (498th byte) to 0F (Extended partition's system ID). Then re-wrote the "mbr" file to disk via dd (dd of=/dev/sda if=mbr bs=512 count=1), asked the kernel to reload partitions via fdisk (echo w |fdisk /dev/sda). Now, all my partitions are restored, since only my primary partitions are erased.

And finally re-installed GRUB on my hard disk locating images on my 2nd primary partition (EXT3).

In this way, I restored my hard disk's partiton table.

Tip: Never boot FreeBSD from its BootEasy MBR (because it copies itself back to the hard disk from where it is booted) instead use GRUB (0.94, 0.95). These versions can read UFS partitions very well.

posted by Ashish SHUKLA  # 1:08 pm