20

I accidentally overwrote my /dev/sda partition table with GParted (full story on AskUbuntu). Since I haven't rebooted yet and my filesystem is still perfectly usable, I was told I might be able to recover the partition table from in-kernel memory. Is that possible? If so, how do I recover it and restore it?

enter image description here

3 Answers 3

31

Yes, you can do this with the /sys filesystem.

/sys is a fake filesystem dynamically generated by the kernel & kernel drivers.
In this specific case you can go to /sys/block/sda and you will see a directory for each partition on the drive. There are 2 specific files in those folders you need, start and size. start contains the offset from the beginning of the drive, and size is the size of the partition. Just delete the partitions and recreate them with the exact same starts and sizes as found in /sys.

For example this is what my drive looks like:

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *        2048      133119       65536   83  Linux
/dev/sda2   *      133120   134340607    67103744    7  HPFS/NTFS/exFAT
/dev/sda3       134340608   974675967   420167680   8e  Linux LVM
/dev/sda4       974675968   976773167     1048600   82  Linux swap / Solaris

And this is what I have in /sys/block/sda:

sda1/
 start: 2048
 size: 131072
sda2/
 start: 133120
 size: 134207488
sda3/
 start: 134340608
 size: 840335360
sda4/
 start: 974675968
 size: 2097200


I have tested this to verify information is accurate after modifying the partition table on a running system

5
  • 2
    Sometimes when I upvote a question, it means "hey this was handy". Your upvote is more like "this saved my skin". Thanks! Oct 29, 2015 at 0:59
  • I don't have a /dev/sdb/start. Has it been renamed to ext_range? Kernel: 4.8.15-1-MANJARO
    – Tom Hale
    Jan 18, 2017 at 2:10
  • @TomHale it's /sys/block/sdb/start, not /dev/sdb/start
    – phemmer
    Jan 18, 2017 at 13:24
  • Sorry, I quoted the wrong directory. I have a stat there, but no start.
    – Tom Hale
    Jan 20, 2017 at 6:54
  • When re-creating the partitions, I recommend usind fdisk as it allows to enter the number of sectors directly and you can check values before writing to disk. I successfully restored a disk by: creating first partition, accepting being, then entering "+size" (from above) for end, second partition entering start from /sys... and "+size" again and so on... Check the size of the partitions before writing the new table. Good luck!
    – JoeGo
    Aug 28, 2017 at 7:39
14

I made a script to help solve this problem, with NO WARRANTY. (but I tested on my virtual machine)

Running the following script, with damaged HD at first parameter, as in:

user@host:~$ ./repart.sh sda

Content of repart.sh:

#!/bin/bash

echo "unit: sectors" 
for i in /sys/block/$1/$1?/; do
    printf '/dev/%s : start=%d, size=%d, type=XX\n' "$(basename $i)" "$(<$i/start)" "$(<$i/size)"
done

The output is a sfdisk format. But caution, this file has to be modified to be used. At the extended partition type=5, increase the size, using all logical space plus space between start of extended and start of first logical partition.

unit: sectors
/dev/sda1 : start=63, size=2040192, type=XX
/dev/sda2 : start=2040255, size=20482875, type=XX
/dev/sda3 : start=22523130, size=19197675, type=XX
/dev/sda4 : start=41720805, size=2, type=XX
/dev/sda5 : start=41720868, size=208782, type=XX

You have to change the type, from XX to number of partition type. Put the bootable partition at first line.

unit: sectors
/dev/sda1 : start=63, size=2040192, type=83, bootable
/dev/sda2 : start=2040255, size=20482875, type=83
/dev/sda3 : start=22523130, size=19197675, type=fd
/dev/sda4 : start=41720805, size=208845, type=5
/dev/sda5 : start=41720868, size=208782, type=82

Apply this changes

cat repart.sfdisk | sfdisk -f /dev/sda

Reread partition tables

partprobe 
/sbin/blockdev --rereadpt

Reinstall grub

grub-install /dev/sda
3
  • 1
    Make sure to use the "-u B" switch for sfdisk and be careful, you might have to adjust the values in repart.sfdisk (divide them by two usually), if sfdisk counts in blocks sizes (check for "Units = blocks of 1024 bytes" in the "sudo sfdisk -u B -l /dev/sda") other than 512 bytes (usually 1024 nowadays).
    – Florian
    Jul 31, 2014 at 9:17
  • 1
    I misread at first: by Id=5 you mean partition type 5, which is sda4, not sda5. Furthermore, in my case ls -d /sys/block/sda/sda* gives me only sda1 and sda5, so it seems that the container is missing.
    – wau
    Oct 7, 2015 at 19:25
  • you shouldn't parse ls; use find instead
    – cat
    Jun 1, 2017 at 10:04
4

Have you tried testdisk? It can scan the disk and recover lost partition tables, even after you've rebooted.

It's available pre-packaged for Debian and presumably for Ubuntu too. Probably other distros.

If you're booting a gparted CD it's probably worth checking to see if it's pre-installed on that.

1
  • Yes, he did. Just check the link of the OP (askUbuntu)
    – Marco
    Jul 25, 2012 at 12:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .