Linux.com

Home Learn Linux Linux Tutorials How to Fix a Mangled Partition Table on Linux

How to Fix a Mangled Partition Table on Linux

fig-1 boot failureWell there I was, rebuilding a router and having a good time when I accidentally damaged the partition table on my main Linux installation, which is a GUID partition table, or GPT. Figure 1 (above) shows the cheery message that greeted me at boot.

How did this happen? I was installing Voyage Linux on a compact flash card, and while I was messing around with GParted and other filesystem tools I accidentally ran some commands on/dev/sdb, my main hard disk, instead of /dev/sdc, the compact flash card. Like, oops. I don't know exactly which operations gummed up /dev/sdb, which would be good to know. But I don't, so let us carry on.

"Press any key to exit" landed at a blinking cursor on a black screen. Fortunately, I always foil the desires of certain distros that disable ctrl+alt+delete, or make it behave like Windows and open a services manager. I make sure that it is enabled and that it reboots the system. I booted into a different Linux installation and pondered how to make repairs. When your partition table is damaged to the point that your Linux will not boot, you have to fix it from the outside of the damaged system via bootable rescue media, or another Linux in a multi-boot installation. SystemRescueCD on a USB stick is my fave. Any *buntu live system also makes a great rescue distro, especially on a USB stick with persistent storage, because then it remembers your settings, you can install apps, and store documents.

There are no guarantees- you may be able to repair the problem, or you may have to reinstall your operating system. If the partition table is unrecoverable you may not be able to recover your data. So, as always, your first and best line of defense is good backups.

TestDisk

A good tool for repairing partition tables and recovering files is TestDisk. TestDisk operates on both the legacy MBR and the newfangled GPT (see Using the New GUID Partition Table in Linux (Goodbye Ancient MBR)) . TestDisk is in most Linux repos, and on SystemRescueCD. Start it up as root:

$ sudo testdisk
TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER 
 This e-mail address is being protected from spambots. You need JavaScript enabled to view it
 ;
http://www.cgsecurity.org
TestDisk is free data recovery software designed to help recover lost
partitions and/or make non-booting disks bootable again when these symptoms
are caused by faulty software, certain types of viruses or human error.
It can also be used to repair some filesystem errors.
Information gathered during TestDisk use can be recorded for later
review. If you choose to create the text file, testdisk.log , it
will contain TestDisk options, technical information and various
outputs; including any folder/file names TestDisk was used to find and
list onscreen.
Use arrow keys to select, then press Enter key:
>[ Create ] Create a new log file
 [ Append ] Append information to log file
 [ No Log ] Don't record anything

Select "create a new log file". In the next screen select the disk you want to repair.


Select a media (use Arrow keys, then press Enter):
 Disk /dev/sda - 2000 GB / 1863 GiB - ST2000DM001-1CH164
>Disk /dev/sdb - 640 GB / 596 GiB - WDC WD6401AALS-00J7B1
 Disk /dev/sdc - 32 GB / 29 GiB - SanDisk CF  Extreme USB2
 Disk /dev/sr0 - 366 MB / 349 MiB (RO) - ATAPI   iHAS424   B
 
>[Proceed ]  [  Quit  ]
 

This example shows two hard drives, a compact flash drive, and an audio CD. /dev/sdb is the broken one. In the next screen we select the partition type:

Disk /dev/sdb - 640 GB / 596 GiB - WDC WD6401AALS-00J7B1
Please select the partition table type, press Enter when done.
 [Intel  ] Intel/PC partition
>[EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
 [Humax  ] Humax partition table
 [Mac    ] Apple partition map
 [None   ] Non partitioned media
 [Sun    ] Sun Solaris partition
 [XBox   ] XBox partition
 [Return ] Return to disk selection
Hint: EFI GPT partition table type has been detected.

In the next screen, select Analyse:

Disk /dev/sdb - 640 GB / 596 GiB - WDC WD6401AALS-00J7B1
     CHS 77825 255 63 - sector size=512
>[ Analyse  ] Analyse current partition structure and search for lost partitions
 [ Advanced ] Filesystem Utils
 [ Geometry ] Change disk geometry
 [ Options  ] Modify options
 [ Quit     ] Return to disk selection

Hmm. This does not look good. Select Quick Search:

 TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER 
 This e-mail address is being protected from spambots. You need JavaScript enabled to view it
 ;
http://www.cgsecurity.org

Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63 Current partition structure: Partition Start End Size in sectors Bad GPT partition, invalid signature. Trying alternate GPT Bad GPT partition, invalid signature. P=Primary D=Deleted >[Quick Search] Try to locate partition

This can take a little time, so be patient. And hopefully TestDisk will find your partitions:

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER 
 This e-mail address is being protected from spambots. You need JavaScript enabled to view it
 ;
http://www.cgsecurity.org

Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63 Partition Start End Size in sectors > MS Data 63 89470974 89470912 MS Data 80078846 265625597 185546752 [xubunthome] P MS Data 265625600 1250263039 984637440 [data-xubuntu] Structure: Ok. Use Up/Down Arrow keys to select partition. Use Left/Right Arrow keys to CHANGE partition characteristics: P=Primary D=Deleted Keys A: add partition, L: load backup, T: change type, P: list files, Enter: to continue ext4 blocksize=4096 Large file Sparse superblock, 45 GB / 42 GiB

Hurrah, this is looking hopeful. If it doesn't find your swap partition, or gives you a message that it won't restore it, don't worry about it because a swap partition doesn't hold data and you can easily restore it later. At this point you have the option to select a partition and press P to see your files, and copy them to another storage medium like a different hard drive or a USB stick. Don't copy them back to the same device, because if your recovery fails your copied files go with it. It did a funny thing on my system: no matter which directory I chose to copy files into, they all went into /home/carla/carla. I couldn't find out if this is the correct behavior, but I got my files back.

When TestDisk finds a partition that it can restore, it is marked in the left column with a P, and highlighted in green. In the above example that is only the third partition. Press the return key, and then you can try writing the partition to disk, or doing a deeper search for more recoverable partitions. The deeper search can take a long time, even several hours on a big hard disk.

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER 
 This e-mail address is being protected from spambots. You need JavaScript enabled to view it
 ;
http://www.cgsecurity.org

Disk /dev/sdb - 640 GB / 596 GiB - CHS 77825 255 63 Partition Start End Size in sectors 1 * Linux 16534 109 24 77825 70 5 984637440 [data-xubuntu] [ Quit ] >[Deeper Search] [ Write ] Try to find more partitions

Then you can select writing the recovered partitions to disk:

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER 
 This e-mail address is being protected from spambots. You need JavaScript enabled to view it
 ;
http://www.cgsecurity.org
Write partition table, confirm ? (Y/N)
TestDisk 6.14, Data Recovery Utility, July 2013 Christophe GRENIER This e-mail address is being protected from spambots. You need JavaScript enabled to view it ; http://www.cgsecurity.org You will have to reboot for the change to take effect. >[Ok]

Several things could happen: You could get a complete restoration with all of your partitions and files. You could get a partial recovery that you can mount from another system and retrieve your files. Or it could all go to that great bitbucket in the sky. Most likely you will get at least some of your files back even if you can't restore your partition table, because stuff that is written to disk is amazingly persistent.

Please visit CGsecurity.org to learn more about TestDisk, and also PhotoRec, an excellent data recovery tool.

 

Comments

Subscribe to Comments Feed
  • slu Said:

    Was reading this great article and trying to fix a messed up micro SD card and lo and behold, did just what Carla was talking about...mangled my hard drive. Cold sweat on an 88 degree day in Hawaii! I got out my trusty System Rescue CD, booted it and ran testdisk...got my partitions back just like new and here I am. Whew! Great article Carla...like so many before it. You rock!

  • David Watson Said:

    or you could use Black Lab Linux 5.1, boot from the liveCD pop in the USB key with your system restore image and lo and behold you have all your files back and a completely restored partition table. Easy.

  • Dree Said:

    I actually stumbled upon Testdisk and Photorec by a friend who had a damaged partition table on her external drive after connecting it to a TV. After checking it showed 7 linux partitions, while it should've had 1 NTFS partition.. First I ran through the Photorec utility to backup all files because I was not sure Testdisk would leave the files undamaged. Once done I ran Testdisk and it found the complete partition table including the files, (some may be corrupt due to overwrites) but most was still intact. It really saved her life :)

  • Ed Said:

    Hey Carla, Thanks for the great and timely source of information. One of my test Linux boxes is experiencing something similar. Your info. provides some excellent tips and resources. As usual you rock!!! Thanks!

  • Wal W Said:

    Great article, Carla, and some very powerful capability in those tools. Unfortunately, it also points to why Linux still has miles to go if it really aspires to winning the hearts and minds of consumer users. Simple fact: Beyond some (very low) number of lines of code, errors are going to occur. Distros turn out flaky; or users do; training or study or documentation or The Interface turns out to be defective. Too many things can Go Wrong whose solution is "simply" to bring up a command entry line and key in this or that shorter or longer arcane sequence of (usually position-CRITICAL) apparent gibberish. Nowhere is this more potentially destructive, of course, than in the area we're addressing here. Assuming that it's possible, in the BEST case, veterans just say, "oh, bother! Silly old me -- keyed in 'x' instead of 'y' and blew it away again!", and re-install from scratch. I've lost count of the number of systems I've personally written off for just such reasons. Consumer users -- your hypothetical maiden aunt, for instance -- know there are options available to them where this won't happen -- or, if it does, where they'll be prevented from making matters seriously worse. Their expectations of what a system can do are generally well below yours, but even so, they'll pay to avoid what they quickly find will be an inconvenience at the very least, whose evident perpetrators they'll only forgive very begrudgingly. By all means, keep developing and enhancing these great -- indispensable? -- tools for the use of those who know what they're doing, who'll go out to dinner on horror stories such as yours. A real winning strategy, however, would be to invest at least as much talent and effort into making the problem AND ITS SOLUTION intelligible to the great unwashed, at least to the level that they want to understand it. If that means it needs simple language, appealing graphics and user testing to achieve that end, well, there's more than enough evidence of such skills going into far more trivial work than this, elsewhere, that should be able to be temporarily re-deployed for the purpose. Saying that such functions should always be the exclusive domain of the priesthood is a cop-out; the simple truth is that reliably broadening their availability would be very difficult. As usual, "Hard is easy; it's easy that's hard".

Upcoming Linux Foundation Courses

  1. LFS230 Linux Network Management
    06 Oct » 09 Oct - Virtual
    Details
  2. LFS416 Linux Security
    06 Oct » 09 Oct - Washington
    Details
  3. LFD331 Developing Linux Device Drivers
    13 Oct » 17 Oct - Virtual
    Details

View All Upcoming Courses

Become an Individual Member
Check out the Friday Funnies

Sign Up For the Linux.com Newsletter


Who we are ?

The Linux Foundation is a non-profit consortium dedicated to the growth of Linux.

More About the foundation...

Frequent Questions

Join / Linux Training / Board