1

I have a MBR table that have a few partition that was deleted previously.

What are the ways to reassemble the MBR Partition entry and restore the deleted partitions without using 3rd party tools or software like testdisk.. etc.

0

Every filesystem has a signature. So if you know which filesystems were used on the partitions, then you can use a hex editor to open the block device and search for the filesystems. Filesystems tend to start at (or near) the beginning of partitions, so when you find the beginning of a filesystem there's a good chance you've also found the start sector of a partition.

Partitions tend to end right before the start of the next partition, so that's how you'd determine the end sector; Except for the last partition, of course.

Once you have your start/end sectors you can simply use a partitioning tool to create those partitions. Then, cross your fingers and try mounting the filesystems.

Of course, there are some scenarios which would make this process difficult or impossible:

  • If the filesystem is stored in an encrypted block device (ex. LUKS).
  • If there are filesystems or disk images, such as those used for virtual machines. Without more information you wouldn't be able to tell the difference between a disk image and a partition.

What I've described above is essentially what testdisk automates for you.

| improve this answer | |
1

The answer could be as simple as "Let it be" or very very complex. In my history I had two MBR accidents, both because "the hand was quicker than the head". There are more ways to "delete" a partition in MBR table. By use of cli program, GUI program, manipulating the first 512 byte of a disk. In MBR there is place for 4 records representing 4 basic partitions. But GUI programs silently use extended MBR, what can complicate the restoring investigation. In principle you can follow two goals: -restore the original MBR, -save the original partition content. You can use basic linux tools or you can look for sofisticated GUI programs. If you have enough of free disk space, it is recomended to make a bit-copy (disk image) first, not to touch the original disk. The program R-Studio has very good results, but I am not certain of the license. In case you know the type of the original partition filesystem (NTFS, ext3), you can search for the starting signature. Any information, you remember, about the original sizes and order of the lost partitions could be helpfull to reduce the space you need to be scanned. Well e.g. if you remember there were two partitions first 20GB, second 200GB, you may judge that the begining of the first can be near the begining of the disk and the start of the second could be find between sectors 39062500 44040192. Suppose you look for NTFS, you can search for the signature with the command:

$ hd disk_image.dd -s20000000000 -n2548578304

Doing such command on original disk you must take root privileges.

If you successfully find the begining of the partitions, is seems to be easier to save the discovered partitions, and then create new MBR where you reserve enough space for your partitons and than copy the saved partitions back to new places. You can alsou try to recalculate the the bytes to sectors and try to reconfigure the MBR table with some standard tool ( fdisk, sfdisk, parted ), but the result may not fullfill your expextetions. If you gives more details, we may get more chances to help you. Namely: what is the disk capacity, the original partition's sizes (even aproximately), the way the partitions were deleted, the OS you use to restore the MBR etc. If you need to find and save some files back only, you can use special tools like sleuthkit.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.