"Jaldhar H. Vyas" wrote: > > Partition records exactly as they appear in MBR (EMBR): > > Starting Ending Starting Number of > # HD FS Cyl Head Sect Cyl Head Sect sector sectors > (0,0,1): > 1 00 00 0 0 0 0 0 0 0 0 > 2 00 00 0 0 0 0 0 0 0 0 > 3 00 00 0 0 0 0 0 0 0 0 > 4 00 83 1,023 63 63 1,023 63 63 34,186,320 1,044,225 > > Unfortunately I don't remember exactly which raw devices mapped to which > partitions when I set up this computer (and my colleague may have moved > them around anyway) but putting our heads together we think the layout was > something like this: > > fs type size (MB) location (not sure) > / ext2 512 /dev/hda7 > /usr ext2 4096 /dev/hda8 > /home ext2 2048 /dev/hda9 > /var ext2 2048 /dev/hda10 > swap swap 512 /dev/hda4 > > The first and second primary partitions were the DOS ones he created and > may have had logical drives in them, he isn't sure. > > Thanks for your help, we really appreciate it.
Well, it may be possible, but this one won't be too easy. One thing I notice right away is that /dev/hda4 is an ext2 partition (type 83), not a swap partition (type 82) as is shown in your list. That's the only partition remaining in the MBR partition table. Putting aside that and other possible complications for now....since (apparently) the bulk of Linux was inside an extended partition, the key to recovering those partitions (hda7 thru hda10) would be to find the first partition sector of the extended partition. Once that is found, the chain of logical partitions should be able to be rebuilt, as each one will point to the next one. Finding that sector may not be so easy though since the extended partition itself has been deleted from the MBR partition table. That entry in the partition table would have told us where the extended partition started. In fact, I don't even know how he deleted that partition with DOS fdisk since it normally is not capable of deleting an extended partition that still contains non-DOS logical drives - which it also can't delete. Question: Was that possibly a Linux extended partition (type 85) as opposed to a DOS extnded partition? That would explain why DOS fdisk could delete it. Question: Is there any guess as to what was on /dev/hda5 and /dev/hda6 which are not accounted for? I have used Norton's Disk Editor in the past to search for a sector when I have some knowledge of what's in that sector. For example, all partition sectors end with the signature "55 AA" as the last two bytes. However, even the newest version of the Disk Editor (from NU4) is not able to search a disk past 1023 cylinders (8 GB), and your disk is 17 GB The best I can suggest right now is if you have a copy of Norton's Disk Editor around, post back and I can give you a rundown on how to search for that sector - understanding that it may not work because of the size of the disk. Failing that, maybe someone reading this list knows a way to attack this problem using Linux tools. There's always a way, but it may come down to how much time and effort you and your colleague are willing to devote to this. Good luck, Tom
