How to read the in-memory (kernel) partition table of /dev/sda?

Question

I accidentally overwrote my /dev/sda partition table with GParted (full story on AskUbuntu). Since I haven't rebooted yet and my filesystem is still perfectly usable, I was told I might be able to recover the partition table from in-kernel memory. Is that possible? If so, how do I recover it and restore it?

Solution 1

Yes, you can do this with the /sys filesystem.

/sys is a fake filesystem dynamically generated by the kernel & kernel drivers.
In this specific case you can go to /sys/block/sda and you will see a directory for each partition on the drive. There are 2 specific files in those folders you need, start and size. start contains the offset from the beginning of the drive, and size is the size of the partition. Just delete the partitions and recreate them with the exact same starts and sizes as found in /sys.

For example this is what my drive looks like:

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *        2048      133119       65536   83  Linux
/dev/sda2   *      133120   134340607    67103744    7  HPFS/NTFS/exFAT
/dev/sda3       134340608   974675967   420167680   8e  Linux LVM
/dev/sda4       974675968   976773167     1048600   82  Linux swap / Solaris

And this is what I have in /sys/block/sda:

sda1/
 start: 2048
 size: 131072
sda2/
 start: 133120
 size: 134207488
sda3/
 start: 134340608
 size: 840335360
sda4/
 start: 974675968
 size: 2097200

I have tested this to verify information is accurate after modifying the partition table on a running system

Solution 2

I made a script to help solve this problem, with NO WARRANTY. (but I tested on my virtual machine)

Running the following script, with damaged HD at first parameter, as in:

user@host:~$ ./repart.sh sda

Content of repart.sh:

#!/bin/bash

echo "unit: sectors" 
for i in /sys/block/$1/$1?/; do
    printf '/dev/%s : start=%d, size=%d, type=XX\n' "$(basename $i)" "$(<$i/start)" "$(<$i/size)"
done

The output is a sfdisk format. But caution, this file has to be modified to be used. At the extended partition type=5, increase the size, using all logical space plus space between start of extended and start of first logical partition.

unit: sectors
/dev/sda1 : start=63, size=2040192, type=XX
/dev/sda2 : start=2040255, size=20482875, type=XX
/dev/sda3 : start=22523130, size=19197675, type=XX
/dev/sda4 : start=41720805, size=2, type=XX
/dev/sda5 : start=41720868, size=208782, type=XX

You have to change the type, from XX to number of partition type. Put the bootable partition at first line.

unit: sectors
/dev/sda1 : start=63, size=2040192, type=83, bootable
/dev/sda2 : start=2040255, size=20482875, type=83
/dev/sda3 : start=22523130, size=19197675, type=fd
/dev/sda4 : start=41720805, size=208845, type=5
/dev/sda5 : start=41720868, size=208782, type=82

Apply this changes

cat repart.sfdisk | sfdisk -f /dev/sda

Reread partition tables

partprobe 
/sbin/blockdev --rereadpt

Reinstall grub

grub-install /dev/sda

Solution 3

Have you tried testdisk? It can scan the disk and recover lost partition tables, even after you've rebooted.

It's available pre-packaged for Debian and presumably for Ubuntu too. Probably other distros.

If you're booting a gparted CD it's probably worth checking to see if it's pre-installed on that.

Comments

[Marco]

Yes, he did. Just check the link of the OP (askUbuntu)

[Florian]

Make sure to use the "-u B" switch for sfdisk and be careful, you might have to adjust the values in repart.sfdisk (divide them by two usually), if sfdisk counts in blocks sizes (check for "Units = blocks of 1024 bytes" in the "sudo sfdisk -u B -l /dev/sda") other than 512 bytes (usually 1024 nowadays).

[wau]

I misread at first: by Id=5 you mean partition type 5, which is sda4, not sda5. Furthermore, in my case ls -d /sys/block/sda/sda* gives me only sda1 and sda5, so it seems that the container is missing.

[Alex Hirzel]

Sometimes when I upvote a question, it means "hey this was handy". Your upvote is more like "this saved my skin". Thanks!

[Tom Hale]

I don't have a /dev/sdb/start. Has it been renamed to ext_range? Kernel: 4.8.15-1-MANJARO

[phemmer]

@TomHale it's /sys/block/sdb/start, not /dev/sdb/start

[Tom Hale]

Sorry, I quoted the wrong directory. I have a stat there, but no start.

[cat]

you shouldn't parse ls; use find instead

[JoeGo]

When re-creating the partitions, I recommend usind fdisk as it allows to enter the number of sectors directly and you can check values before writing to disk. I successfully restored a disk by: creating first partition, accepting being, then entering "+size" (from above) for end, second partition entering start from /sys... and "+size" again and so on... Check the size of the partitions before writing the new table. Good luck!