Recovering lost XFS Partitions

From: Guybrush (Guybrush.Treepwood_at_gmail.com)
Date: 08/16/05


Date: 16 Aug 2005 08:28:17 -0700

Hi,

I've a machine with 10 partitions (most of them XFS), and I've lost all
of the extended partitions while I was trying to create a new one,
before swithching off the machine I've check for all the information
about the partitions with different tools gpart, cfdisk, fdisk, and
checking the /proc and /sys
Now with that data I'm trying to recreate the partition table as it was
to recover all the important data I've inside, but when I try to use
the same starting points and sizes with fdisk, it's easy to create the
logic partition of the same size and the fist extended partition
(keeping the other primary partitions untouched) but when I try to set
up the starting point of the 2nd extended partition the 1st one had
used one more block so the 2nd one will start one block later and I
guess I'll not manage to recover all the data. I've thoungt that maybe
the problem could be that now I'm using fdisk and when I create them
for first time I used cfdisk, but I cannot use cfdisk because I don't
know how to set up the sizes in blocks instead of MBs so I cannot
create the partition exactly as it was.

Any kind of help will be more than wellcome because I realy need to
recover that data, at least the /home partition and other one with user
data.

Thanks in advace.
   Guybrush.

P.S.: Here are the data I got before switching off the machine with all
the info about the previous partitions.
And the kernel version is 2.6.10

gpart -vE /dev/hda

dev(/dev/hda) mss(512) chs(232581/16/63) #s(234441648) size(114473mb)
Primary partition(1)
   type: 131(0x83)(Linux ext2 filesystem) (BOOT)
   size: 1906mb #s(3903732) s(63-3903794)
   chs: (0/1/1)-(242/254/63)d (0/1/1)-(3872/12/63)r
   hex: 80 01 01 00 83 FE 3F F2 3F 00 00 00 F4 90 3B 00

Primary partition(2)
   type: 131(0x83)(Linux ext2 filesystem)
   size: 19077mb #s(39070080) s(3903795-42973874)
   chs: (243/0/1)-(1023/254/63)d (3872/13/1)-(42632/12/63)r
   hex: 00 00 01 F3 83 FE FF FF 33 91 3B 00 80 29 54 02

Primary partition(3)
   type: 130(0x82)(Linux swap or Solaris/x86)
   size: 972mb #s(1992060) s(232444485-234436544)
   chs: (1023/254/63)-(1023/254/63)d (230599/11/1)-(232575/14/63)r
   hex: 00 FE FF FF 82 FE FF FF 45 D2 DA 0D 7C 65 1E 00

Primary partition(4)
   type: 000(0x00)(unused)
   size: 0mb #s(0) s(0-0)
   chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r
   hex: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Begin scan...
Possible partition(SGI XFS filesystem), size(1896mb), offset(0mb)
   type: 131(0x83)(Linux ext2 filesystem)
   size: 1896mb #s(3883200) s(63-3883262)
   chs: (0/1/1)-(1023/15/63)d (0/1/1)-(3852/7/6)r
   hex: 00 01 01 00 83 0F FF FF 3F 00 00 00 C0 40 3B 00

Possible partition(SGI XFS filesystem), size(19067mb), offset(1906mb)
   type: 131(0x83)(Linux ext2 filesystem)
   size: 19067mb #s(39049600) s(3903795-42953394)
   chs: (1023/15/63)-(1023/15/63)d (3872/13/1)-(42612/7/58)r
   hex: 00 0F FF FF 83 0F FF FF 33 91 3B 00 80 D9 53 02

Possible partition(SGI XFS filesystem), size(19067mb), offset(20983mb)
   type: 131(0x83)(Linux ext2 filesystem)
   size: 19067mb #s(39049472) s(42973938-82023409)
   chs: (1023/15/63)-(1023/15/63)d (42632/14/1)-(81372/6/56)r
   hex: 00 0F FF FF 83 0F FF FF F2 BA 8F 02 00 D9 53 02

Possible partition(SGI XFS filesystem), size(1896mb), offset(40060mb)
   type: 131(0x83)(Linux ext2 filesystem)
   size: 1896mb #s(3883200) s(82044018-85927217)
   chs: (1023/15/63)-(1023/15/63)d (81392/14/1)-(85245/4/6)r
   hex: 00 0F FF FF 83 0F FF FF 72 E4 E3 04 C0 40 3B 00

Possible partition(SGI XFS filesystem), size(28593mb), offset(41966mb)
   type: 131(0x83)(Linux ext2 filesystem)
   size: 28593mb #s(58560328) s(85947813-144508140)
   chs: (1023/15/63)-(1023/15/63)d (85265/11/1)-(143361/4/1)r
   hex: 00 0F FF FF 83 0F FF FF A5 75 1F 05 48 8F 7D 03

Possible partition(Linux ext2), size(94mb), offset(70574mb)
   type: 131(0x83)(Linux ext2 filesystem)
   size: 94mb #s(192716) s(144536868-144729583)
   chs: (1023/15/63)-(1023/15/63)d (143389/12/1)-(143580/14/62)r
   hex: 00 0F FF FF 83 0F FF FF 24 75 9D 08 CC F0 02 00

Possible partition(Linux ext2), size(1906mb), offset(70668mb)
   type: 131(0x83)(Linux ext2 filesystem)
   size: 1906mb #s(3903732) s(144729648-148633379)
   chs: (1023/15/63)-(1023/15/63)d (143581/0/1)-(147453/11/63)r
   hex: 00 0F FF FF 83 0F FF FF 30 66 A0 08 F4 90 3B 00

Possible partition(SGI XFS filesystem), size(9528mb), offset(103959mb)
   type: 131(0x83)(Linux ext2 filesystem)
   size: 9528mb #s(19514496) s(212909508-232424003)
   chs: (1023/15/63)-(1023/15/63)d (211219/12/1)-(230579/5/57)r
   hex: 00 0F FF FF 83 0F FF FF C4 BD B0 0C 80 C4 29 01

Possible partition(Linux swap), size(972mb), offset(113498mb)
   type: 130(0x82)(Linux swap or Solaris/x86)
   size: 972mb #s(1991976) s(232444485-234436460)
   chs: (1023/15/63)-(1023/15/63)d (230599/11/1)-(232575/13/42)r
   hex: 00 0F FF FF 82 0F FF FF 45 D2 DA 0D 28 65 1E 00

* Warning: short read near sector(234441459), 64512 bytes instead of
66048. Skipping...
End scan.

Checking partitions...

* Warning: more than 4 primary partitions: 9.
Partition(Linux ext2 filesystem): primary
Partition(Linux ext2 filesystem): primary
Partition(Linux ext2 filesystem): primary
Partition(Linux ext2 filesystem): primary
Partition(Linux ext2 filesystem): invalid primary
Partition(Linux ext2 filesystem): invalid primary
Partition(Linux ext2 filesystem): invalid primary
Partition(Linux ext2 filesystem): invalid primary
Partition(Linux swap or Solaris/x86): invalid primary
Ok.

Guessed primary partition table:
Primary partition(1)
   type: 131(0x83)(Linux ext2 filesystem)
   size: 1896mb #s(3883200) s(63-3883262)
   chs: (0/1/1)-(1023/15/63)d (0/1/1)-(3852/7/6)r
   hex: 00 01 01 00 83 0F FF FF 3F 00 00 00 C0 40 3B 00

Primary partition(2)
   type: 131(0x83)(Linux ext2 filesystem)
   size: 19067mb #s(39049600) s(3903795-42953394)
   chs: (1023/15/63)-(1023/15/63)d (3872/13/1)-(42612/7/58)r
   hex: 00 0F FF FF 83 0F FF FF 33 91 3B 00 80 D9 53 02

Primary partition(3)
   type: 131(0x83)(Linux ext2 filesystem)
   size: 19067mb #s(39049472) s(42973938-82023409)
   chs: (1023/15/63)-(1023/15/63)d (42632/14/1)-(81372/6/56)r
   hex: 00 0F FF FF 83 0F FF FF F2 BA 8F 02 00 D9 53 02

Primary partition(4)
   type: 131(0x83)(Linux ext2 filesystem)
   size: 1896mb #s(3883200) s(82044018-85927217)
   chs: (1023/15/63)-(1023/15/63)d (81392/14/1)-(85245/4/6)r
   hex: 00 0F FF FF 83 0F FF FF 72 E4 E3 04 C0 40 3B 00

#############################################

cat /proc/partitions | grep hda
   3 0 117220824 hda
   3 1 1951866 hda1
   3 2 19535040 hda2
   3 3 996030 hda3
   3 4 1 hda4
   3 5 19535008 hda5
   3 6 1951866 hda6
   3 7 29294496 hda7
   3 8 9767488 hda8
   3 9 96358 hda9
   3 10 1951866 hda10

########################
http://www.linux-sec.net/FileSystem/

groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda1/start
63
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda2/start
3903795
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda3/start
232444485
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda4/start
42973875
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda5/start
42973938
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda6/start
82044018
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda7/start
85947813
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda8/start
212909508
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda9/start
144536868
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda10/start
144729648
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda11/start
cat: /sys/block/hda/hda11/start: No such file or directory
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda10/
dev size start stat
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda10/
dev size start stat
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda10/size
3903732
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda9/size
192717
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda8/size
19534977
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda7/size
58588992
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda6/size
3903732
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda5/size
39070017
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda4/size
2
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda3/size
1992060
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda2/size
39070080
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda1/size
3903732
groo@Guybrush:~/proyectos/crypto$ cat /sys/block/hda/hda1/*
3:1
3903732
63
  61486 2007242 214228 2263088
groo@Guybrush:~/proyectos/crypto$ df
?S.ficheros Bloques de 1K Usado Dispon Uso% Montado en
/dev/hda1 1941600 427160 1514440 23% /
tmpfs 258216 0 258216 0% /dev/shm
/dev/hda9 90297 10418 75062 13% /boot
/dev/hda6 1941600 1554680 386920 81% /root
/dev/hda7 29280164 28898432 381732 99% /home
/dev/hda8 9757248 9501016 256232 98% /var
/dev/hda10 1829159 7067 1724499 1% /tmp
/dev/hda5 19524736 19240852 283884 99% /usr
/dev/hdb5 59630696 51360552 8270144 87% /mnt/hdb5
/dev/hdb3 19869852 17944480 1925372 91% /mnt/hdb3
/dev/hdb6 19869820 19513820 356000 99% /mnt/hdb6
/dev/hdf3 482249 376050 81299 83% /mnt/hdf3
/dev/hdf5 7779680 6785384 599100 92% /mnt/hdf5
/dev/hdf6 10831708 7371180 2910304 72% /mnt/hdf6
/dev/hdf7 124427 4132 113871 4% /mnt/hdf7
/dev/hdc 552496 552496 0 100% /media/cdrom0
/dev/hda2 19524800 9499516 10025284 49% /pub_rol/rol
groo@Guybrush:~/proyectos/crypto$ df -h
S.ficheros Tama?o Usado Disp Uso% Montado en
/dev/hda1 1,9G 418M 1,5G 23% /
tmpfs 253M 0 253M 0% /dev/shm
/dev/hda9 89M 11M 74M 13% /boot
/dev/hda6 1,9G 1,5G 378M 81% /root
/dev/hda7 28G 28G 373M 99% /home
/dev/hda8 9,4G 9,1G 251M 98% /var
/dev/hda10 1,8G 7,0M 1,7G 1% /tmp
/dev/hda5 19G 19G 278M 99% /usr
/dev/hdb5 57G 49G 7,9G 87% /mnt/hdb5
/dev/hdb3 19G 18G 1,9G 91% /mnt/hdb3
/dev/hdb6 19G 19G 348M 99% /mnt/hdb6
/dev/hdf3 471M 368M 80M 83% /mnt/hdf3
/dev/hdf5 7,5G 6,5G 586M 92% /mnt/hdf5
/dev/hdf6 11G 7,1G 2,8G 72% /mnt/hdf6
/dev/hdf7 122M 4,1M 112M 4% /mnt/hdf7
/dev/hdc 540M 540M 0 100% /media/cdrom0
/dev/hda2 19G 9,1G 9,6G 49% /pub_rol/rol



Relevant Pages

  • Recovering lost XFS Partitions
    ... Now with that data I'm trying to recreate the partition table as it was ... up the starting point of the 2nd extended partition the 1st one had ... type: 131(Linux ext2 filesystem) ... Possible partition(SGI XFS filesystem), size, offset ...
    (comp.os.linux.setup)
  • Recovering lost XFS Partitions
    ... Now with that data I'm trying to recreate the partition table as it was ... up the starting point of the 2nd extended partition the 1st one had ... type: 131(Linux ext2 filesystem) ... Possible partition(SGI XFS filesystem), size, offset ...
    (alt.os.linux)
  • Recovering deleted partitions...
    ... I have downloaded and used gpart as suggested ... Possible extended partition at offset ... Possible partition(DOS FAT), size, offset ... Partition(Linux ext2 filesystem): primary ...
    (Debian-User)
  • Re: Parted incompatible feature
    ... >> one of the affected partitions with Partition Magic. ... super blocks but which are parted-friendly. ... This ext2 filesystem has a rather strange layout! ...
    (Fedora)
  • Re: Hard drive is at /dev/hdd rather than hdd1.
    ... so it had a big partition - that would have been /dev/hdd1 ... You built your xfs filesystem on /dev/hdd, ... I can mount it and everything. ... Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org ...
    (alt.os.linux)