testdisk and load backup of partition table?
Well, a more knowledgeable answer will be appreciated - however, at least I found how to avoid this problem, while writing the OP. Btw this is TestDisk 6.11, Data Recovery Utility, April 2009
on Ubuntu 11.04. After the disk is blank, re-start the sudo testdisk
and follow the trace in the OP to get to the same screen (the one you get after you:
- hit
l
forL: load backup
; - choose
Disk /dev/sdc - ...
forChoose the backup you want to restore:
and then hit[ Load ]
)
Here, go to the second entry, and: Use Left/Right Arrow keys to CHANGE partition characteristics:
until you get D=Deleted
for that partition; it looks something like this:
Now, obviously, no more "bad structure" is reported, and everything is green; interestingly, only this partition reacts like this (the first one, for example, induces no change even if it is set to D
).
Now I just press Enter: to continue
; get this on next screen:
Partition Start End Size in sectors
1 P Linux 0 1 32 10244 36 26 20980827
2 E extended LBA 10244 38 1 57231 63 32 96230208
5 L Linux 10244 38 26 40962 39 6 62910477
6 L Linux 40962 41 6 49151 63 26 16771797
7 L Linux 49152 1 26 53246 44 4 8385867
8 L Linux Swap 53246 46 4 57231 35 32 8160957
At it, choose [ Write ] Write partition structure to disk
; and
- answer
y
toWrite partition table, confirm ? (Y/N)
- get
You will have to reboot for the change to take effect.
, hit[Ok]
- choose
[ Quit ] Return to disk selection
on next screen - choose
[ Quit ] Quit program
on next screen
Now I can do this:
$ sudo fdisk -lu /dev/sdc
Disk /dev/sdc: 60.0 GB, 60011642880 bytes
64 heads, 32 sectors/track, 57231 cylinders, total 117210240 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000c0705
Device Boot Start End Blocks Id System
/dev/sdc1 63 20980889 10490413+ 83 Linux
/dev/sdc2 20980928 117211135 48115104 f W95 Ext'd (LBA)
/dev/sdc5 20980953 83891429 31455238+ 83 Linux
/dev/sdc6 83891493 100663289 8385898+ 83 Linux
/dev/sdc7 100663353 109049219 4192933+ 83 Linux
/dev/sdc8 109049283 117210239 4080478+ 82 Linux swap / Solaris
... and nearly everything is the same as in the original partition table in the OP - except here I have "f W95 Ext'd (LBA)
" while above it was "5 Extended
" for the second (sdc2
, "extended") partition.
If someone can point out what am I doing wrong, and what should I do exactly to reconstruct the exact same partition table even after a deletion, I'd appreciate it.
EDIT: I think I got something more; the difference is not only in "f W95 Ext'd (LBA)
" vs "5 Extended
"; but also, from fdisk
- in first case:
255 heads, 63 sectors/track, 7296 cylinders, total 117210240 sectors
/dev/sdc2 20980890 117210239 48114675 5 Extended
... and in second case:
64 heads, 32 sectors/track, 57231 cylinders, total 117210240 sectors
/dev/sdc2 20980928 117211135 48115104 f W95 Ext'd (LBA)
So, the CHS geometry - and the region of the extended partition - is wrong; that is probably the meaning of the Warning: the current number of heads per cylinder is 64 but the correct value may be 255.
obtained in the OP. So once we get to the main menu in testdisk
we can change geometry:
[ Geometry ] Change disk geometry
[ Heads ] Change head geometry
Enter the number of heads:
255
[ Sectors ] Change sector geometry
Enter the number of sectors per track (1-63):
63
[ Cylinders ] Change cylinder geometry
(no change here):Enter the number of cylinders:
7296
[ Ok ] Done with changing geometry
[ Analyse ] Analyse current partition structure
[Quick Search] Try to locate partition
n
toShould TestDisk search for partition created under Vista ? [Y/N]
testdisk
now finds the partitions that were deleted; hitL: load backup
Disk /dev/sdc -
toChoose the backup you want to restore:
then[ Load ]
Again Structure: Bad.
and duplicated partitions; set every second one to D
- bad structure clears:
Finally:
Enter: to continue
[ Write ] Write partition structure to disk
y
toWrite partition table, confirm ? (Y/N)
[Ok]
toYou will have to reboot for the change to take effect.
[ Quit ] Return to disk selection
[ Quit ] Quit program
Now fdisk
will report the same geometry - and the same range for the extended partition:
255 heads, 63 sectors/track, 7296 cylinders, total 117210240 sectors
...
/dev/sdc2 20980890 117210239 48114675 f W95 Ext'd (LBA)
/dev/sdc2 20980890 117210239 48114675 5 Extended # first
/dev/sdc2 20980928 117211135 48115104 f W95 Ext'd (LBA) # second
... and comparing to previous reports, now we have the same range as the first, but still not the same filesystem type (f W95 Ext'd (LBA)
instead of 5 Extended
); but it looks much better like this, at least.
tetram
Updated on September 18, 2022Comments
-
tetram over 1 year
I have a new disk, so I wanted to see how the
testdisk
backup works.After partitioning and formatting the disk with
gksu gparted /dev/sdc
, this is what I get:$ sudo fdisk -lu /dev/sdc Disk /dev/sdc: 60.0 GB, 60011642880 bytes 255 heads, 63 sectors/track, 7296 cylinders, total 117210240 sectors Units = sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk identifier: 0x000c0705 Device Boot Start End Blocks Id System /dev/sdc1 63 20980889 10490413+ 83 Linux /dev/sdc2 20980890 117210239 48114675 5 Extended /dev/sdc5 20980953 83891429 31455238+ 83 Linux /dev/sdc6 83891493 100663289 8385898+ 83 Linux /dev/sdc7 100663353 109049219 4192933+ 83 Linux /dev/sdc8 109049283 117210239 4080478+ 82 Linux swap / Solaris
So, after this, I want to backup the partitions' boot record with
testdisk
and then restore it. So I do:cd /tmp sudo testdisk
... and then
[ Create ] Create a new log file
- from
Select a media
chooseDisk /dev/sdc - 60 GB / 55 GiB
, then[Proceed ]
- from
Please select the partition table type,
, choose[Intel ] Intel/PC partition
- on next screen, choose
[ Analyse ] Analyse current partition structure...
; I get this:
1 P Linux 0 1 1 1305 254 63 20980827 2 E extended LBA 1306 0 1 7295 254 63 96229350 No partition is bootable 5 L Linux 1306 1 1 5221 254 63 62910477 X extended 5222 0 1 6265 254 63 16771860 6 L Linux 5222 1 1 6265 254 63 16771797 X extended 6266 0 1 6787 254 63 8385930 7 L Linux 6266 1 1 6787 254 63 8385867 X extended 6788 0 1 7295 254 63 8161020 8 L Linux Swap 6788 1 1 7295 254 63 8160957
- I choose
[ Backup ] Save current partition list to backup.log file and proceed
- Answer
n
toShould TestDisk search for partition created under Vista ?
; I get:
Disk /dev/sdc - 60 GB / 55 GiB - CHS 7296 255 63 Partition Start End Size in sectors * Linux 0 1 1 1305 254 63 20980827 L Linux 1306 1 1 5221 254 63 62910477 L Linux 5222 1 1 6265 254 63 16771797 L Linux 6266 1 1 6787 254 63 8385867 L Linux Swap 6788 1 1 7295 254 63 8160957
- I press
Enter: to continue
; I get:
Disk /dev/sdc - 60 GB / 55 GiB - CHS 7296 255 63 Partition Start End Size in sectors 1 * Linux 0 1 1 1305 254 63 20980827 2 E extended LBA 1306 0 1 7295 254 63 96229350 5 L Linux 1306 1 1 5221 254 63 62910477 6 L Linux 5222 1 1 6265 254 63 16771797 7 L Linux 6266 1 1 6787 254 63 8385867 8 L Linux Swap 6788 1 1 7295 254 63 8160957
- Choose
[ Quit ] Return to main menu
here - Chooose
[ Quit ]
from next menu - Chooose
[ Quit ] Quit program
from very first menu
Now there is a
backup.log
in/tmp
, with these contents:#1412861047 Disk /dev/sdc - 60 GB / 55 GiB - CHS 7296 255 63 1 : start= 63, size= 20980827, Id=83, P 2 : start= 20980890, size= 96229350, Id=05, E 5 : start= 20980953, size= 62910477, Id=83, L 6 : start= 83891493, size= 16771797, Id=83, L 7 : start=100663353, size= 8385867, Id=83, L 8 : start=109049283, size= 8160957, Id=82, L
Repeats of the process above will append the same contents to the
backup.log
.Now, I want to test restoration; I do again
sudo testdisk
... and then[ Append ] Append information to log file
- from
Select a media
chooseDisk /dev/sdc - 60 GB / 55 GiB
, then[Proceed ]
- from
Please select the partition table type,
, choose[Intel ] Intel/PC partition
- now choose
[ Delete ] Delete all data in the partition table
on next screen - answer
y
toClear MBR partition table by writing zero bytes to it? (Y/N)
- answer
y
toClear partition table, confirm ? (Y/N)
- get
Partition table has been cleared. You have to reboot for the change to take effect.
and hit[Ok]
we're back to
Disk /dev/sdc
; now choose[ Analyse ] Analyse current partition structure...
; here get:Disk /dev/sdc - 60 GB / 55 GiB - CHS 57231 64 32 Current partition structure: Partition Start End Size in sectors No partition is bootable
- click on
[Quick Search]
- answer
n
forShould TestDisk search for partition created under Vista ? [Y/N]
hit
Stop
as soon as the search starts ; get this:Warning: the current number of heads per cylinder is 64 but the correct value may be 255. You can use the Geometry menu to change this value. It's something to try if \- some partitions are not found by TestDisk \- or the partition table can not be written because partitions overlaps.
hit
[ Continue ]
, get:Disk /dev/sdc - 60 GB / 55 GiB - CHS 57231 64 32 Partition Start End Size in sectors L Linux 0 1 32 10244 63 32 20981697
- now hit
l
forL: load backup
; - choose
Disk /dev/sdc - ...
forChoose the backup you want to restore:
and then hit[ Load ]
At this point, I get this:
<pre>Disk /dev/sdc - 60 GB / 55 GiB - CHS 57231 64 32 Partition Start End Size in sectors P Linux 0 1 32 10244 36 26 20980827 L Linux 0 1 32 10244 63 32 20981697 L Linux 10244 38 26 40962 39 6 62910477 L Linux 40962 41 6 49151 63 26 16771797 L Linux 49152 1 26 53246 44 4 8385867 L Linux Swap 53246 46 4 57231 35 32 8160957</pre>
... and "Structure: Bad. " in red; as shown on the image:
My question is - why is this "Structure: Bad"? The only thing I can notice is that the first two entries about cover the same range; but why does
testdisk
import them both? How do I avoid this if I want to restore the partition structure from a backup?