Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[solved] First sectors destroyed. How to restore?
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Installing Gentoo
View previous topic :: View next topic  
Author Message
mv
Watchman
Watchman


Joined: 20 Apr 2005
Posts: 6281

PostPosted: Tue Mar 24, 2015 7:32 pm    Post subject: [solved] First sectors destroyed. How to restore? Reply with quote

Hello,

after trying to create an USB stick with sysrescuecd and booting from it, I can no longer boot from my harddisk.

Either the script to make the USB botlable or switching with the BIOS/UEFI has apparently destroyed the first sectors of my harddisk - I have no idea how this happened and what exactly is destroyed.

Only /dev/sda is visible - no partitions - and "parted" shows after "print":
Code:
error: /dev/sda: unrecognised disk label
Model: ATA ST3000DM001-1CH1 (scsi)                                       
Disk /dev/sda: 3001GB
Sector size (logical/physical): 512B/4096B
Partition Table: unknown
Disk Flags:

However, "cfdisk /dev/sda" still shows the correct partition table, and so doese "fdisk /dev/sda" though it also reports the strange message:
Code:
Disk identifier: 0x0008882a

This doesn't look like a partition table
Probably you selected the wrong device.

[and then the partition table is shown]

Any chance to restore my data? I am afraid that "mklabel" of parted will destroy everything...


Last edited by mv on Tue Mar 24, 2015 9:57 pm; edited 1 time in total
Back to top
View user's profile Send private message
mv
Watchman
Watchman


Joined: 20 Apr 2005
Posts: 6281

PostPosted: Tue Mar 24, 2015 7:57 pm    Post subject: Reply with quote

I should add that the disk originally had "msdos" label - although it is larger than 2GB (namely 3GB), but each partition was smaller than 2GB:
Thus, cfdisk and fdisk never showed correctly the end of the last partition (which fills the last 1.3 GB). However, for linux it was not a problem.
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 43178
Location: 56N 3W

PostPosted: Tue Mar 24, 2015 8:18 pm    Post subject: Reply with quote

mv,

Ouch.

The MSDOS partition table only has 32 bit pointers and I suspect it only does 32 bit arithmetic too.
That means adding the start address of your last partition to its size' both less than 2TiB would overflow.
You might be lucky ... or it might wrap to the beginning of the disk.

If you are sure that you know the partition table, its quite safe to rewrite it as long as you do not have an extended partition.
If you are not sure, testdisk will find likely looking partition starts.

It would be interesting to see what is in block 0 now.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
mv
Watchman
Watchman


Joined: 20 Apr 2005
Posts: 6281

PostPosted: Tue Mar 24, 2015 8:26 pm    Post subject: Reply with quote

NeddySeagoon wrote:
The MSDOS partition table only has 32 bit pointers and I suspect it only does 32 bit arithmetic too.
That means adding the start address of your last partition to its size' both less than 2TiB would overflow.

Yes, that's what I was seeing with cfdisk and fdisk. But parted showed it correctly, and it always was working - I am using this disk since months without problems; and it is completely full.
Quote:
You might be lucky ... or it might wrap to the beginning of the disk.

No, it used to work properly. Only now it does not.
Quote:
If you are sure that you know the partition table, its quite safe to rewrite it as long as you do not have an extended partition.

I know the partition table exactly from fdisk. Unfortunately, with parted I can only enter "rough" data like "MB" or "GB". And I do have an extended partition.
Quote:
If you are not sure, testdisk will find likely looking partition starts.

The problem is not to find it but how to tell linux where it is: Apparently the partition table which fdisk and cfdisk see is not the one which parted and linux see and write...
Quote:
It would be interesting to see what is in block 0 now.

Still the grub boot loader: It loads but then stops since apparently it cannot find any partition.
Back to top
View user's profile Send private message
mv
Watchman
Watchman


Joined: 20 Apr 2005
Posts: 6281

PostPosted: Tue Mar 24, 2015 8:34 pm    Post subject: Reply with quote

I am still wondering what I have done false: I had selected various boot options from my BIOS/EFI like booting from UEFI USB disk. Maybe such an option can write something to the disk?
I suspect that only one or two bytes must be set correctly to tell that this is dos label...
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 43178
Location: 56N 3W

PostPosted: Tue Mar 24, 2015 8:37 pm    Post subject: Reply with quote

mv,

Its the last 66 bytes of sector 0 that are the partition table.
Well, the last two byles are a signature that needs to be valid for the partition table to be recognised.
They should be 0xaa and 0x55 but I forget the order.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
mv
Watchman
Watchman


Joined: 20 Apr 2005
Posts: 6281

PostPosted: Tue Mar 24, 2015 8:50 pm    Post subject: Reply with quote

Thanks a lot. Can I use "hexedit /dev/sda" to edit this data?
Or is there another tool to edit some bytes directly on disk?

Edit: Removed wrong data.


Last edited by mv on Tue Mar 24, 2015 8:56 pm; edited 1 time in total
Back to top
View user's profile Send private message
mv
Watchman
Watchman


Joined: 20 Apr 2005
Posts: 6281

PostPosted: Tue Mar 24, 2015 8:55 pm    Post subject: Reply with quote

Stupid me... too nervous to calculate: 200 is the end:
Code:
00000180   47 52 55 42  20 00 47 65  6F 6D 00 48  61 72 64 20  GRUB .Geom.Hard
00000190   44 69 73 6B  00 52 65 61  64 00 20 45  72 72 6F 72  Disk.Read. Error
000001A0   0D 0A 00 BB  01 00 B4 0E  CD 10 AC 3C  00 75 F4 C3  ...........<.u..
000001B0   00 00 00 00  00 00 00 00  2A 88 08 00  00 00 00 20  ........*......
000001C0   21 00 0E 1B  28 F3 00 08  00 00 00 90  3B 00 81 1B  !...(.......;...
000001D0   29 F3 0C 73  9A D9 00 98  3B 00 00 38  77 00 00 73  )..s....;..8w..s
000001E0   9B D9 83 FE  FF FF 00 D0  B2 00 00 80  B7 73 00 FE  .............s..
000001F0   FF FF 0F FE  FF FF 00 50  6A 74 00 50  E6 E8 55 AA  .......Pjt.P..U.

It looks correct...

Perhaps there is still some wrong setting in the BIOS/UEFI which prevents the disk to be recognized properly?
But except for switching the boot order, I am not aware that I have changed anything...
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 43178
Location: 56N 3W

PostPosted: Tue Mar 24, 2015 9:47 pm    Post subject: Reply with quote

mv,

This is the interesting bit
Code:
000001B0   xx xx xx xx  xx xx xx xx  xx xx xx xx  xx xx 00 20  ........*......
000001C0   21 00 0E 1B  28 F3 00 08  00 00 00 90  3B 00 81 1B  !...(.......;...
000001D0   29 F3 0C 73  9A D9 00 98  3B 00 00 38  77 00 00 73  )..s....;..8w..s
000001E0   9B D9 83 FE  FF FF 00 D0  B2 00 00 80  B7 73 00 FE  .............s..
000001F0   FF FF 0F FE  FF FF 00 50  6A 74 00 50  E6 E8 55 AA  .......Pjt.P..U.

The 55 AA at the end looks good. 8 byles of the 16 bytes of the rest describe the start and nuber of sectors in each partition.
There is also a flags byte. The other bytes are fake CHS partition descriptors.
So the first byte at 0x1be is the bootable flag. It should be either 0x80 or 0x00, so partition 2 is a bit odd as its 0x81.
0x1c2 is the filesystem indicator, you have 0x0e, 0x0c, 0x83 and 0x0f. Linux doesn't care but 0x83 is a linux filesystem.
0x1c6 is the starting sector 00 08 00 00, LS byte (little endian) first, so thats 0x00000800
0x1ca is the total sectors 00 90 3B 00 (little endian) 003b9000
This pattern repeats every 16 bytes.

Now that you can read tho partition table you can try mounting partition without using it.

mount -o ro, offset=<bytes> /dev/sda ... where <bytes> is 0x800 * 0x200 converted to decimal and is an offset from the start of the drive.

In BIOS mode the BIOS will read sector 0 and complain if the 55 AA is missing.
It may or may not check for the bootable flag, if the test fails, you get a "No Operating System Found" from the BIOS.
It EFI mode, the EFI code looks for a FAT32 partition containg something to boot.
I have not done a full analysis of your partition table but as you say, it looks OK.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
mv
Watchman
Watchman


Joined: 20 Apr 2005
Posts: 6281

PostPosted: Tue Mar 24, 2015 9:56 pm    Post subject: Reply with quote

Thanks a lot.

Meanwhile, I was analyzing the source code of parted, and I found that indeed the 0x81 is the reason for not recognizing the partition.
In the source code there was a comment that this is the same test which the linux kernel makes.

Thus, I patched parted to ignore the 0x81 and used the patched parted to "toggle" the boot mode of partition 2 to "on".

Now everything seems to work again :D

I am still wondering which of my actions caused the bit flip: It would be a very strange accident that it happened just after some reboots if it is a hardware failure....

Again, thank you very much!


Last edited by mv on Tue Mar 24, 2015 9:59 pm; edited 1 time in total
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 43178
Location: 56N 3W

PostPosted: Tue Mar 24, 2015 9:59 pm    Post subject: Reply with quote

mv,

Heh. hexedit would have been faster :)
I'm glad its fixed.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
mv
Watchman
Watchman


Joined: 20 Apr 2005
Posts: 6281

PostPosted: Tue Mar 24, 2015 10:02 pm    Post subject: Reply with quote

NeddySeagoon wrote:
Heh. hexedit would have been faster :)

I was not sure whether hexedit would work properly with a non-file.
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 43178
Location: 56N 3W

PostPosted: Wed Mar 25, 2015 6:07 pm    Post subject: Reply with quote

mv,

On linux, everything is a file, even /dev/sda
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
mv
Watchman
Watchman


Joined: 20 Apr 2005
Posts: 6281

PostPosted: Wed Mar 25, 2015 7:32 pm    Post subject: Reply with quote

NeddySeagoon wrote:
On linux, everything is a file, even /dev/sda

Yes and no: There are subtle differences between devices and files. An example is redirection to /dev/null which would not work if /dev/null was a file - you would get "file exists" errors.
I could easily think of "natural" implementations of a tool like hexdump which would work perfectly with a file but could break horribly with partitions (e.g. when the file is copied to do the changes).
However, meanwhile I found on the manpage that it edits "in-place" and that block devices are explicitly supported: If I had seen this earlier, I would not have been so careful.
Back to top
View user's profile Send private message
szatox
Veteran
Veteran


Joined: 27 Aug 2013
Posts: 1746

PostPosted: Wed Mar 25, 2015 8:20 pm    Post subject: Reply with quote

Quote:
. An example is redirection to /dev/null which would not work if /dev/null was a file - you would get "file exists" errors.
you wouldn't, redirect with > overwrites the file, >> appends to file.

Quote:
I am still wondering which of my actions caused the bit flip
You can only have a single boot flag on a device and if it's set, partition takes pecedence over MBR so scripts installing bootloaders tend to disable it when they see it. Any chance that you pointed grub to wrong device?

Can you see partitions now? In case of trouble, you can delete partition, then create another one and still access all the data it contained. It must start at the very same sector for this trick to work though, fdisk definitely doesn't wipe it when you do that. I've been plaing around with it using msdos primary.
Back to top
View user's profile Send private message
NeddySeagoon
Administrator
Administrator


Joined: 05 Jul 2003
Posts: 43178
Location: 56N 3W

PostPosted: Wed Mar 25, 2015 8:38 pm    Post subject: Reply with quote

szatox,

The puzzle is how the bootable flag was changed from 0x80 to 0x81.
Legal values are 0x00 (not bootable) or 0x80 (bootable).
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.
Back to top
View user's profile Send private message
mv
Watchman
Watchman


Joined: 20 Apr 2005
Posts: 6281

PostPosted: Wed Mar 25, 2015 9:04 pm    Post subject: Reply with quote

szatox wrote:
Quote:
. An example is redirection to /dev/null which would not work if /dev/null was a file - you would get "file exists" errors.
you wouldn't, redirect with > overwrites the file, >> appends to file.

You are right: I have assumed that you have set noclobber (I am using it since ages, so I forgot that this is not the default setting).
It's not necessary now to discuss this in detail; it is just one of several cases where devices and files behave differently: Opening a device for writing in general neither clobbers nor appends.
Quote:
Any chance that you pointed grub to wrong device?

I had not called grub for a long time. I had only used the script provided with rescuecd to create an usb-stick: The automatic modus did not work (actually, it now turned out that also the manual modus did not work: It seems my stick cannot be made bootable). However, I am very sure that I never entered the wrong device.
Quote:
Can you see partitions now?

Yes: In the moment when the broken boot-flag was repaired, everything was working again: All partitions were back, grub and linux booted - everything is OK now.
Quote:
In case of trouble, you can delete partition, then create another one and still access all the data it contained. It must start at the very same sector for this trick to work though, fdisk definitely doesn't wipe it

I know, but fdisk and cfdisk had problems with the 3TB disk: The last partition had a wrong size. Only parted could do it correctly. And for some reason, after partitioning with parted also fdisk and cfdisk showed the correct size. It is not clear to me what parted makes different than fdisk and cfdisk. Unfortunately, with parted one cannot specify the exact sector, and so I was trying hard to avoid such a risky operation: Since an extended partition is involved in my setting, choosing the wrong sector would have been destructive (also fdisk and cfdisk are necessarily destructive if extended partitions are involved).
Fortunately, after repairing the boot-flag, all this is not necessary now anymore, since things just work now. :)
Back to top
View user's profile Send private message
szatox
Veteran
Veteran


Joined: 27 Aug 2013
Posts: 1746

PostPosted: Thu Mar 26, 2015 9:41 pm    Post subject: Reply with quote

Thanks for explanation, both of you :)
Glad you figured out that little nasty in MBR
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Installing Gentoo All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum