Restore Lost Partitions to a Deleted or Corrupt Partition Table using Edgy LiveCD

This HOWTO will tell you how to recover your lost partitions if the partition data on your hard drive got wiped by some malicious program (windows in my case). If the new/incorrect partitions have been formatted, then you've probably lost data. If all that got wiped was the partition table, then this should help you recover all of your data! I searched in the Tutorials and Tips forum and couldn't find anything quite like this, so I thought I'd write it up. If someone knows of a better thread, point me to it! 

I have tested this on a Dapper install using an Edgy LiveCD.

All that is needed is an Edgy LiveCD, a cd drive you can boot from, and a working internet connection. A dapper cd would most likely work, but I have not tested it.
WARNING: This HOWTO is most likely to be used at your own risk, as I'm not sure if I'll be able to test it on future distributions (nor do I feel like destroying my partition info to do so).

1.) Enable your computer to boot from the cd drive. You may have to enter your computer's BIOS to do this.

2.) Boot from the Edgy LiveCD.

3.) Assuming the LiveCD loaded just fine, enable the universe and multiverse repositories by System -> Administration -> Software Properties and checking the appropriate boxes.

4.) Open up a terminal (Applications -> Accessories -> Terminal), and type

Code:

sudo apt-get install gpart

Yes, gpart, not gparted. gpart is a program that will scan your drive for existing partitions, and output the cylinders that they are on.

5.) In the terminal, run

Code:

sudo gpart /dev/hda

or substitute whichever drive you are looking at (hdc, sda, etc.) and note the output. Mine looks like:

Code:

sudo gpart /dev/hdc

Begin scan...
Possible partition(Linux ext2), size(149660mb), offset(0mb)
Possible extended partition at offset(149660mb)
   Possible partition(Linux swap), size(2965mb), offset(149660mb)
End scan.

Checking partitions...
Partition(Linux ext2 filesystem): primary
Partition(Linux swap or Solaris/x86): primary
Ok.

Guessed primary partition table:
Primary partition(1)
   type: 131(0x83)(Linux ext2 filesystem)
   size: 149660mb #s(306504072) s(63-306504134)
   chs:  (0/1/1)-(1023/254/63)d (0/1/1)-(19078/254/63)r

Primary partition(2)
   type: 130(0x82)(Linux swap or Solaris/x86)
   size: 2965mb #s(6072504) s(306504198-312576701)
   chs:  (1023/254/63)-(1023/254/63)d (19079/1/1)-(19456/254/60)r

Primary partition(3)
   type: 000(0x00)(unused)
   size: 0mb #s(0) s(0-0)
   chs:  (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Primary partition(4)
   type: 000(0x00)(unused)
   size: 0mb #s(0) s(0-0)
   chs:  (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

The "size" line is telling you first the number of mb of the partition, then the number of sectors (#s) and then the actual sectors that the partition is on (s). The last set of numbers (actual sectors the partition is on) is what we want. Write those down! With those in hand,

5.a) Now we have to restore the partition table. We'll use parted.

Code:

sudo parted /dev/hda

again substituting the drive you're interested in for hda.

You should be at a prompt that looks like

Code:

(parted)

5.b) At that prompt, type

Code:

unit s

to make sure that parted is using units of sectors.


5.c) Just in case we want to undo any changes, type "print", and be sure to write down the start and end sectors of all of the partitions on the disk! NOTE: The reason you don't want to use this method to get the start/end sectors of the partitions you're trying to restore is that parted just reads the partition table on the disk itself, even if it is incorrect or corrupt. If parted throws up errors about nonexisting partitions or a corrupt table, then there is no need for this step.

6.) Now we actually restore the partitions! Still at the (parted) prompt, type

Code:

rescue

, and you will be prompted for the start and end sectors of the partition you want to rescue. In my example, these numbers would be 63 for the start and 306504134 for the end of the first partition.

7.) Repeat step 6 for all partitions that need to be recued.

8.)

Code:

quit

to exit out of parted.

That's it! You should have access to all of your old partitions, and you can check this by mounting the various partitions in the live cd.

9.) If you find out you messed with the partition table on the wrong disk, and you followed step 5.c), you can use steps 6-8 to restore the partition table you just wiped, using the numbers you wrote down from the print command in parted rather than the output from gpart.

NOTE: If your partition table was wiped, it's quite possible (as it was in my case) that your MBR got killed as well, and you'll need to restore grub. You can try starting here: How to install Grub from a live Ubuntu CD, though I'll admit the first method failed for me. If the admins let this HOWTO through, I'll add on what I did to get GRUB back.