partition table recovery.PLZhelp

[jimmy2975]

Hi,

This is what happened. I wake up to find my FC8 box has restarted itself. 1st time I ignore it but happens again after a few days and the third time it would not boot at all. I get crc error. So I checked all the harddrives(PATA and SATA), bought a new drive, used a PCI IDE/SATA controller,Live CD's and I was still getting crc error. It turned out one of my 1Gb mem stick was bad. So I removed it (now using 1Gb instead of 2G) and now I dont see any of the partitions on either of my HDD. I can use a live CD just fine. ALL my partitions are GONE!!!!

I used Gparted Live CD to see if it will recover the partitions. But no juice. It says unallocated.
Can someone please walk me through atleast to see if the partitions are there.

PLEASE HELP ME OUT. I dont know what else to do.
THanks
Regards
Jimmy

[Zotter]

There's some information missing here. Removing a stick of RAM won't delete, hide or otherwise obscure partitions.

However, messing with a mobo can cause the system BIOS to get 'scrambled'. Have you re-run the BIOS setup? Make sure you can see all the drives correctly from setup.

After that boot a live CD of some flavor or another and as 'root', run the command: fdisk -l <enter>

See anything useful?

[jimmy2975]

I realise that removing the RAM should not affect the HDD. THis is really bizzare. All HDD are recognized in the BIOS. From a rescue CD I did fdisk -ls and no partitions were there. AM I SCREWED FOR SURE?

Jimmy

[stevea]

Wow - that's really bad news.

The dram cannot directly change the hdd contents, but it is *possible* that the dram error caused the system to scribble over the MBR and ruin the disk partition table (and possibly more). It does seem unlikely that it scribbled over both disks in the same way - but not impossible.

So I assume that your "fdisk -ls" did correctly show both disks sort of like this:

Disk /dev/sda: 100.0 GB, 100030242816 bytes
255 heads, 63 sectors/track, 12161 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00049d65

but no partitions. Is that correct ?

If so what does
dd if=/dev/sda bs=1 count=512 | od -Ax -xc
produce ?

dd if=/dev/sda bs=1 count=512 | od -Ax -xc

[jimmy2975]

Yeah, this really sucks. Luckily I have back up of most of my data.

yes fdisk -ls shows the PATA and SATA drive correcty but with not partitions

and the dd command dd if=/dev/sdb bs=1 count=512 | od -ax -xc gives a bunch of 000,nul,0000 arranged in 2x8 (rowxcolumns)

512+0 records in
512+0 records out
512 bytes copied .....

The results are the same for both the drives.

Thanks
Jimmy

Don't know if paying for this will help:

http://www.dfsee.com/

Wayne

[terry_g]

Testdisk is a utility that is available through the Fedora repos.
I have read good reviews about it.
This is their home page:
http://www.cgsecurity.org/wiki/TestDisk

I used the Photorec program that comes with it to recover deleted pictures on a hard drive and on a camera card.
It found the files when two other programs 'not free" couldn't find them.

Good Luck!
Terry

[jimmy2975]

Thanks for the info everybody. Please keep posting if you think of anything else. I did read about testdisk. SInce I dont have a floopy disk I have not tried it. I am not sure if one can make a testdis liveCD. But I am on my way to work and will get some floppy disks and try testdisk first

Thanks
Regards
Jimmy

[stevea]

The zeros in the dd | od mean that your partition table is all zeros !

You can probably recover the first partition of each drive as follows.
Use fdisk and create a primary 1st partition starting at the default "track 1" and the full size of the disk. You can probably mount that file system if you can guess the fs type.

This only writes over the zeros in the partition table so it's not hazardous. Mount the fs as read-only like:
mkdir /tmp/mp
mount -t ext3 -o ro /dev/sda1 /tmp/mp
*assuming* it's an ext3. It doesn't hurt to try.

==
Try this:
dd if=/dev/sda bs=512 skip=65 count=1 | od -Ax -c

If your output is all zeroes then the first partition file system is probably ruined too.
If it looks like:
000000 ` 214 023 \0 306 " N \0 # 350 003 \0 6 J 0 \0
000010 " 201 016 \0 \0 \0 \0 \0 002 \0 \0 \0 002 \0 \0 \0
000020 \0 200 \0 \0 \0 200 \0 \0 340 037 \0 \0 Q ? 300 G
000030 Q ? 300 G % \0 377 377 S 357 001 \0 001 \0 \0 \0
000040 @ 362 253 G \0 \0 \0 \0 \0 \0 \0 \0 001 \0 \0 \0
000050 \0 \0 \0 \0 \v \0 \0 \0 \0 001 \0 \0 < \0 \0 \0
000060 006 \0 \0 \0 003 \0 \0 \0 K 243 374 5 z 0 L 333
000070 252 317 254 244 230 N 343 373 / \0 \0 \0 \0 \0 \0 \0
000080 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0
...
then it's ext3 and the string around byte 0x78 ("/" in this case) is the volume label.

[jimmy2975]

FINALLY, the partition table is restored.
Used knoppixx Live CD and used Testdisk to recover the table. Was really straight forward. This got my 2 important data partitions on the 2 HDD. However, I could not boot FC8. So I am reinstalling FC8.
I strongly recommend anyone with similar problems to use testdisk application. I have made a copy of fdisk -l o/p and grub.conf backup for each of my 2 FC8 boxes and ubuntu laptop.

The funny thing is I really didnt need the data partitions to be recovered( i had Unsion do a cron job backup to an external drive a day or two before the crash). Well it was an experience and I now know how to recover partition table. I still need to know how to reisntall just the grub w/o having to reisntall FC8. Maybe next time!!!!

THanks to everyone for their input/suggestions

Regards
Jimmy