[neos1]

not erased, just the flagged for deletion with a linux tool?

[saikee]

Yes.

The reason behind is quite simple.

When you delete a partition you remove only its partition table which has 16 bytes inside. The physical partition is not touched but the indexing system to find it is gone.

As long as you have a copy of the partition table or can create the partition back again and the whole of the original partition is yours again in seconds.

I have rebuilt partitions many times and lost only one or two, mostly because I stopped an installer too late when it was merrily formatting the hard disk. Mind you I keep a record of the partition tables. Those one I do not keep are identically 5Gb or 10Gb each and so even a fool can claim and rebuild 63 partitions in a hard disk.

If you create another partition, using the same or part of the area and start to write information on it then you can kiss some if not all the data good bye.

[lotuseclat79]

Hi neos,

Here are some examples of how to save a copy of your partition table and MBR:

To copy entire MBR to a file:
# dd if=/dev/sdb of=/root/sdbmbr bs=512 count=1

To restore entire MBR from a file:
# dd if=/root/sdbmbr of=/dev/sdb bs=512 count=1

To restore partition table,skipping boot loader code:
# dd if=/root/sdbmbr of=/dev/sdb bs=1 skip=446 count=66

Note: If you have a Linux Live CD, you should be able to pop it into your CD drive, bring up Linux, and execute those commands to restore the partition table provided you used the first command to save your MBR (or a variant to save only the partition table).

-- Tom

P.S. Note: /dev/sdb is a device specific name in the above examples and is most likely different on your system unless you have 2 SATA drives like I do.

[neos1]

Ok here is what I have done:

Downloaded TestDisk and analysed the hdd.

Disk /dev/sdc - 80 GB / 74 Gib - CHS 9729 255 63
Partition Start End Size in sectors
* FAT32 LBA 0 1 1 3139 254 63 50444037 [SEA_DISC]FAT found
L HPFS - NTFS 3140 1 1 5251 254 63 33929217
L FAT32 LBA 5252 1 1 9728 254 63 71922943 [V]


Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue

Saikee: I do not know what your definition is of a fool; but applying my definition I cannot not deny sometimes.

Here is a quote from TextDisk creator Christophe Grenier " TestDisk has features for both novices and experts. For those who know little or nothing about data recovery techniques, TestDisk can be used to collect detailed information about a non-booting drive which can then be sent to a tech for further analysis. Those more familiar with such procedures should find TestDisk a handy tool in performing onsite recovery."

I realized after I downloaded TestDisk that this tool is in many if not all Live CD's.
Anyway, because this disk that I deleted the partition table IS
my backup I cannot, I will not make another move until you or Tom walks me through it.

Edit: what I have copied from my Terminal window is accept for spacing it out for easier viewing is exact.
Edit:: I'm in XP

[saikee]

First thing first I would advise making a clone right now so that you can put away the original and work on the cloned copy.

Just get hold of a spare hard disk bigger than the current one and even temporarily fixed it internally or just hook up a USB hard disk. The content of the spare disk will be overwritten in the cloning process.

The procedure is here

Please, by booting up any Live CD, post here the output of the terminal command

fdisk -l

[neos1]

I'm in the process of getting a hold of another hard drive. Small town USA, and I will have to make a trip. (Refuse to pay Radio Shack prices).

I have a honeydo project that I've got to get finished. I'll try and get the info to you tonight.

[neos1]

Originally Posted by saikee

First thing first I would advise making a clone right now so that you can put away the original and work on the cloned copy.

Just get hold of a spare hard disk bigger than the current one and even temporarily fixed it internally or just hook up a USB hard disk. The content of the spare disk will be overwritten in the cloning process.

The procedure is here

Please, by booting up any Live CD, post here the output of the terminal command

fdisk -l

The image is 1. something mb, well over the limit and I do not know how to cut it down.

---------------------------------------------------------------------------------------------------------------------------------
Disk /dev/sdc: 80.0 GB, 80026361856 bytes
255 heads, 63 sectors/track, 9729 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
ubuntu@ubuntu:~$ and then a rectangle standing up-long ways up

[neos1]

Here is the Knoppix screen shot.

Let's try this again.

[neos1]

Knoppix snapshot3file:///home/knoppix/Desktop/snapshot3.png



A side note: When I open Open Office Word Doc, I get Calc.

[saikee]

neos1,

You need to tell us what partition you have deleted and what type?

You current partition table show one disk sda only. I don't see any problem there or as far as Linux is concerned the partition table isn't corrupted. Accessing the partition data is another matter but we could come to that later.

The only anomaly, if it can be classified as one, is at the end of partition sda7 there is an empty space of 8923-4449 = 4474 cylinders. The 8923 is the total No. of cylinder you have in the 80Gb disk and the 4449 is the end boundary of sda7. Thus there is about 40Gb empty space after sda7. You have no sda3 and sda4 because the extended partition sda2 tells us you have used up the remaining hard disk, apart from sda1, to make logical partitions. The sda2 end boundary matches the size of the total No of cylinders in the disk.

You have to tell us which is the partition you have deleted. Is it any of sda1, sda5, sda6 or sda7? or sda8 (or more) from the space currently blank?

You will note from your partition table each partition has an ID number; 7 for NTFS and b for fat32. Your memory of the type of partition you have deleted is important to recover it.

If you have deleted only one partition and know its partition ID that partition is yours after you supply the requested information in the next post.

[neos1]

sdc 80GB SeaDisk USB External, 3 partitions:

[saikee]

I am afraid I could not assist.

You claim to have deleted a partition and want it back. In Post #6 you showed me a partition table of sdb.

When I asked what partition and type have you deleted you show partition information of another disk sdc.

I don't know which partition on which disk you have deleted.

-------------------------------------------------------
If the information in Post #11 are the deleted partitions Testdisk discovered for you you can accept the findings. Only you know what were in them and the types.

[neos1]

saikee
I thought in image one that I had gotten the right disk on there-I didn't. It is the SeaDisk sdc
there are three partitions the first one has files and folders the third one has files and folders
the middle one or the second partition on the 80GB seadisk has no files or folders.
I thought you stated that in the first image that I posted, you could not see any problems-no deleted partitions. Obviously I screwed up in posting that image. The attatchment in post # 11
is the correct hard drive. I should not be trying to juggle so many projects at one time.
I cannot justify one block of time to those who count on me.
I apologize for wasting your time.

[saikee]

The testdisk has showed 3 partitions. Is your deleted partition among there? Can you not get an output of "fdisk -l /dev/sdc" on sdc?

[neos1]

Loaded Knoppix again here is fdisk -l dev/sdc

EDIT: I see now why I uploaded the first image: I have two Sea disk 15k 73GB internal harddrives in a Dell Precision 450; the external drive is an 80GB Sea Disk. In the first image Knoppix has the 80GB hard drive listed as sda and the 73.4GB listed as sdc.

Why would Knoppix list my external harddrive as first in line? Windows list it at third in line.

Clarification: It is the 80GB external that the partition table has been deleted

EDIT: I am sure that the partitions were formatted to FAT 32. At least the two that have anything of any importance on them. I formatted them this way so as to be able to reach into them from either Linux or Windows.