# How to recover a lost partition?

## DBN

Hello, I have just started to work with Gentoo at work, we're run two Gentoo servers running AMD 64 architecture.

Just my luck.. one of the server are down. When I look at the hard disk there should be three partitions.

What I see is...

first partition 250MB (a good the boot partition) ext2

second partition 60Gb (where Gentoo is installed) unallocated space

third partition 9GB the swap partition is visible.

I tried using TestDisk it could find the partition and browse the files, but can't update the partition table.

I tried the demo version of Stellar Phoenix Linux into can see the files but before I spend $150...

I rather restore the partition, so I can clone it to a new disk so I wont need to reinstall and reconfigure the whole entire server from zero.

Does anyone having have any idea or tools that could help me restore the lost partition.

Thank you

----------

## manaka

Did testdisk find any lost partition?

If so, what error displays when trying to update the partition table?

----------

## NeddySeagoon

DBN,

Welcome to gentoo.

Before I advise on how to recreate your lost partition table entry, please post the output from 

```
fdisk -l
```

 from the affected system. It may be as simple as using fdisk to create a single partition in the unallocated space, using the default parameters.

However, I won't know that until I see your fdisk output.

----------

## DBN

Hi manaka.

Testdisk after a "quick search" finds and 250MB (sdb1 boot) and the 8GB (sdb3 swap) partitions. After I run a "deeper search" it finds the main partition (the 60GB) and I can see the files in it. Then when it writes the new partition table it has no error jest says to restart and that's it…. The result is no change what so ever.

Hi NeddySeagoon.

I can't get to the shell so this is the fdisk of the drive running as an external off of me Ubuntu box:

```
Disk /dev/sdb: 74.3 GB, 74355769344 bytes

255 heads, 63 sectors/track, 9039 cylinders

Units = cylinders of 16065 * 512 = 8225280 bytes

Disk identifier: 0x04bb7cc6

   Device Boot      Start         End      Blocks   Id  System

/dev/sdb1   *           1          32      257008+  83  Linux

/dev/sdb2              33        7935    63480847+  83  Linux

/dev/sdb3            7936        9039     8867880   82  Linux swap / Solaris

```

hope this helps

thank you

----------

## NeddySeagoon

DBN,

This fdisk output shows that your sda2 partition is present and correct. This suggests that its upit filesystem contained on sda2 thats faulty, not the partition table.

The next step is too look at the filesystem. At this stage you probably want to make an image of sda2, since to attempt to fix it, we will have to change the filesystem and tools like fsck can make things worse, not better.

Anyway the next step depends on the filesystem type, e.g. rieserfs, ext3 ... please tell us that

----------

## manaka

From the fdisk -l output, seems you have the 3 partitions you refer to...  :Wink: 

Try fscking the devices to see if the filesystems are still there...

```

e2fsck -v -n -f /dev/sdb1

e2fsck -v -n -f /dev/sdb2

```

----------

## DBN

Hi

I'm pretty sheer the filesystim it ext3.

I ran the "e2fsck" like you said. this is what i got.

e2fsck -v -n -f /dev/sdb1:

```

e2fsck 1.40.8 (13-Mar-2008)

Warning!  /dev/sdb1 is mounted.

Pass 1: Checking inodes, blocks, and sizes

Pass 2: Checking directory structure

Pass 3: Checking directory connectivity

Pass 4: Checking reference counts

Pass 5: Checking group summary information

      39 inodes used (0.06%)

       0 non-contiguous inodes (0.0%)

         # of inodes with ind/dind/tind blocks: 7/1/0

   11131 blocks used (4.33%)

       0 bad blocks

       0 large files

      23 regular files

       5 directories

       0 character device files

       0 block device files

       0 fifos

       0 links

       2 symbolic links (2 fast symbolic links)

       0 sockets

--------

      30 files

```

e2fsck -v -n -f /dev/sdb2:

```

e2fsck 1.40.8 (13-Mar-2008)

e2fsck: Superblock invalid, trying backup blocks...

ext3 recovery flag is clear, but journal has data.

Recovery flag not set in backup superblock, so running journal anyway.

Clear journal? no

Pass 1: Checking inodes, blocks, and sizes

.....

```

and than allot of "

```

.....

.....

Deleted inode 442555 has zero dtime.  Fix? no

Inode 442556 is in use, but has dtime set.  Fix? no

.....

.....

Illegal block #9 (4294936408) in inode 442501.  IGNORED.

Illegal block #10 (4294936492) in inode 442501.  IGNORED.

Too many illegal blocks in inode 442501.

Clear inode? no

Suppress messages? no

Illegal block #11 (4294936688) in inode 442501.  IGNORED.

Illegal block #-1 (4294936796) in inode 442501.  IGNORED.

Illegal block #-2 (4294938154) in inode 442501.  IGNORED.

Illegal block #-3 (4294936962) in inode 442501.  IGNORED.

Error while iterating over blocks in inode 442501: Illegal triply indirect block found

e2fsck: aborted

```

NeddySeagoon

How do you suggest to backup the partition? 

Partimage doesn't see the partition .. maybe with dd?

thank

----------

## NeddySeagoon

DBN,

dd is a good place to start. 

If the disk surface is not damaged, it will read whatever data is in the raw disk blocks. If the disk is damaged, you will need ddrescue, which tries much harder (and takes lomger) to read your data. Use dd and see if it exits with an error or not.

We know now that the primary superblock is damaged but you have a usable backup.

You can mount the file system read only now if you want so you can look around. As its damaged, you must not write to it.

```
mount -t ext3 -o loop,offset=X,sb=Y /dev/sda2 /some/mountpoint 

X= bytes from the start of the drive to the start of the filesystem

Y=location in the filesystem of the superblock to use.
```

sb=131072 is a good value for you.

For X,  fdisk will show you the partition start in blocks if you ask it nicely. I think its on the X menu.

I'm not sure if it shows 512 byte or 1024 byte units, nor if it counts from 1 or from 0.

----------

## DBN

i got ddrescue to clone the drive. but i couldn't get it to mount even after fsck.

sadly i just going to reinstall it.  :Sad: 

thank for all your help

----------

