Wednesday, October 12, 2011

Recovery of a deleted partition ( Part - 3 )

         As I have written in my last post ( http://meandmyubuntulinux.blogspot.com/2011/10/recovery-of-deleted-partition-part-2.html ) that the Ubuntu Live disk was able to detect all of my partitions and all my data but still I was unable to boot into the system.

        So, I tried to re-install the Ubuntu Grub Loader and see if that works . So, as per the post on ubuntu forum ( http://ubuntuforums.org/showthread.php?t=1581099 ) , I proceeded as follows :

1) Boot into the Live USB disk.
  
3) Created a directory for mounting my Ubuntu partition :
                 sudo mkdir /mnt/temp
3) Mount the Ubuntu Installation :
              sudo mount /dev/sda9 /mnt/temp

4) Mount miscellaneous filesystem for proper working of chroot command :
      for i in /dev /dev/pts /proc /sys; do sudo mount -B $i /mnt/temp$i; done

5) chroot into the Ubuntu installation :
                        sudo chroot /mnt/temp
If the above commands run successfully, the terminal prompt should include "root" ( root@ubuntu:/# ), which indicates you are in the chroot environment.

6) Confirm that I have an working internet connection in the chroot environment : 
                                apt-get update
As I was having a working internet connection , I moved forward to the next step.

7) Purging the Grub Loader : Do not proceed to following command if you don't have a working internet connection. The next command will remove grub, grub-pc (Grub 2) and grub-common. ( If you are sure you have never had Grub legacy on the current installation you may omit "grub" from the next command else keeping that in the command does no harm. ). Here is what you will do when you enter the command :

         a) Press ENTER to continue.

         b)Read the warning during the install about removing the bootloader. TAB to highlight "<Yes>" and press ENTER.

Command :

                            apt-get purge grub grub-pc grub-common

8) Re-install the grub packages : Here is what will happen:
         a) You will be given the opportunity to add extra kernel options to the kernel line. If you don't know, you probably don't need them ; TAB to highlight "<OK>" and press ENTER.

         b) Read the installation notes. TAB to "<OK>" to continue.
         
         c) When presented with the device option, use the UP/DN keys to select the correct drive ( /dev/sdX ).
    • Make sure the installation drive [*] /dev/sdX has an asterisk next to it ( example: [*] /dev/sda ). If it doesn't, highlight it and press the SPACE bar to select it.
    • Do not select a partition ( example: [ ] /dev/sda5 , etc). 
       d) TAB to "<OK>" and press ENTER. When it has finishing the installation, you should have Grub 2 installed.
Command :
                       apt-get install grub-common grub-pc
  This is the point where I got stuck again, as it refuesd to install the Grub Loader onto my Hard Disk ( /dev/sda ).

:-(

       When this problem persisted no matter what I do to resolve it, I finally figured out that the Mini iso image which I was trying to write on the Pen-drive using the dd command ( Refer to my post : http://meandmyubuntulinux.blogspot.com/2011/10/recovery-of-deleted-partition.html ) was almost 25 MB in size so it must have over written the Master Boot Record , the partition table as well as some other important Windows files ( remember that I had Windows Xp installed in my 1st Partition ) and hence corrupting the Windows installation.
          So, I decided to format that partition and do a fresh re-install of the Ubuntu Grub Loader. I back-up everything that was important for me from the Xp partition via the USB live disk and formatted the /dev/sda1 partition using GParted Partition Editor . Next I repeated the above steps from 1 to 8. This time it successfully installed the Grub Loader without a hitch. So I could proceed further.

Step 9:- Update the Grub Loader files
                         update-grub

Step 10:- Exit the chroot environment
                      exit
If you have successfully exited chroot, the terminal prompt should return to the Ubuntu Live CD prompt ( ubuntu@ubuntu:~$ )

Step 11:- Unmout whatever you previously mounted :
                           sudo umount /mnt/temp
           for i in /dev/pts /dev /proc /sys; do sudo umount /mnt/temp$i ; done

                 When I finally re-booted the system. I was able to boot into my only left Operating System i.e. my loving Ubuntu. Windows is gone ( as such also I was rarely using it and was thinking to remove it and put it into the Virtual-Box.). It was a very tiring but learning experience to do all this. I actually never imagined that I could bring back my system into this working condition and that too without loosing a single important file . But I did it !!! All thanks to the Ubuntu forum ( http://ubuntuforums.org ). One very important thing that I learned is cross-check each command twice before firing it especially when you are in root privilage else you may land into a series of problem that you never imagined and may be never able to recover from the damage that it inflict.

Have a Good Day and a happy Ubuntu experience.....

Saturday, October 8, 2011

Recovery of a deleted partition ( Part - 2 )

                Starting from where I left in my previous post 
(http://meandmyubuntulinux.blogspot.com/2011/10/recovery-of-deleted-partition.html  )  , Testdisk has done wonderful job in revealing my HD's partitions and thus correcting the partition table. But..... still something was missing out there as I was still not able to boot into the system. It simply displayed a cursor which keeps on blinking forever and no other error message. 

               So, I had to again boot with the help of the Lucid Lynx ( Ubuntu 10.04 LTS ) live usb to figure out what is happening. Interesting or say luckily, when I booted the live system, It easily discovered all my partitions and and I was also able to access all of my data !!!


             This was quite confusing situation as the Ubuntu live disk was able to detect partitions properly but still my system was not able to boot at all. So, I checked with GParted Partition editor to see if there is still any problem in the partition table. Yes there was.......... it says “A disk cannot have partitions outside the disk”.


So, I dumped my partition table to a file called PT.txt for editing :

                                 sudo sfdisk -d /dev/sda > PT.txt


The output was :


--------------------------------------------------------------------------------------------
# partition table of /dev/sda
unit: sectors
/dev/sda1 : start= 63, size= 62926542, Id= 7, bootable
/dev/sda2 : start= 62926605, size=425481525, Id= f
/dev/sda3 : start= 0, size= 0, Id= 0
/dev/sda4 : start= 0, size= 0, Id= 0
/dev/sda5 : start= 62926668, size= 31471272, Id= 7
/dev/sda6 : start= 94398003, size=136323528, Id=83
/dev/sda7 : start=230723584, size= 41947136, Id= 7
/dev/sda8 : start=272671308, size=104872257, Id= 7
/dev/sda9 : start=377544704, size=107634360, Id=83
/dev/sda10: start=485179128, size= 3215608, Id=82
---------------------------------------------------------------------------------------------

              Now let me explain the above output. The 1st column containing /dev/sd? are the partitions. If sfdisk doesn't find a partition corresponding to any number it simply put start, size and id = 0 for that partition. Its not an error. Start and size given here are in units of sectors. A particular Id corresponds to a particular partition type. For example, here, Id=7 is NTFS , Id=f is extended partition , Id=83 is EXT4 and Id=82 is Linux Swap partition.






Now time for some maths.......



As per the link in the reference post link that I gave above :

  1. There is a 63 sector gap between the start of an extended partition and the start of a logical partition.
  2. There is a 63 sector gap between the end of a logical partition and the start of the next logical partition.
  3. There is no gap at all between primary partitions.
  4. It is possible to have larger gaps between partitions, but never smaller than 63 sectors for logical partitions, (and obviously) never smaller than 0 for primary partitions.
  5. Partitions must not overlap.

         In my case, /dev/sda1 is a primary partition, /dev/sda2 is a primary extended partition and /dev/sda5 to /dev/sda10 are logical partitions.

               Now, checking the above conditions with my partition table.

  1. /dev/sda1 is ok as it starts at sector 63. No problem in that.
  2. Considering /dev/sda1 end range is ok, /dev/sda2 ( being a primary partition ) should start at sector=63+62926542=62926605 and so is the case . So, the start range of /dev/sda2 is also ok. Leaving aside the end range of /dev/sda2 as that will be the end of disk.
  3. Now, for /dev/sda5 ( which is a logical partition ), the start range ( as per condition 1) should be sector=62926605+63=62926668 and therefore , /dev/sda5 is also ok.
  4. For /dev/sda6 start sector= 62926668 + 31471272 + 63 = 94398003 implies that /dev/sda6 is ok.
  5. Similarly checking start sector of all the partitions are found ok.
  6. Now, time for the last check i.e. end sector of last partition i.e. /dev/sda10 and end sector of the extended partition /dev/sda2. Both should be same.
    End sector of /dev/sda2 will be sector = 62926605 + 425481525 =488408130
    End sector of /dev/sda10 will be sector = 485179128+ 3215608 = 488394736

                 So, here is a difference. So, either of two range is wrong. So, had to go with hit and trial with both the possibilities as I couldn't find a way to determine the total sector size of my HD :-( .

At first backing up the dump of original partition table.

                                            cp PT.txt PT.txt_bkp


and transferred it to the external hard disk for backup.


                 Now, trying to go with lesser of two range. So, end of /dev/sda10 will be ok but end sector of /dev/sda2 will have to be changed.


New Size of /dev/sda2 will be=end sector of /dev/sda10–start sector of /dev/sda2
                                               = 488394736 - 62926605

                                               = 425468131


                  So, editing the PT.txt file using vi editor and using the obtained value , the new partition table looked like following :

-------------------------------------------------------------------------------------------
# partition table of /dev/sda
unit: sectors
/dev/sda1 : start= 63, size= 62926542, Id= 7, bootable
/dev/sda2 : start= 62926605, size=425468131, Id= f
/dev/sda3 : start= 0, size= 0, Id= 0
/dev/sda4 : start= 0, size= 0, Id= 0
/dev/sda5 : start= 62926668, size= 31471272, Id= 7
/dev/sda6 : start= 94398003, size=136323528, Id=83
/dev/sda7 : start=230723584, size= 41947136, Id= 7
/dev/sda8 : start=272671308, size=104872257, Id= 7
/dev/sda9 : start=377544704, size=107634360, Id=83
/dev/sda10: start=485179128, size= 3215608, Id=82
------------------------------------------------------------------------------------------


Please note the change in size of /dev/sda2.



                      Now time to write the new partition table using the new file PT.txt . It can be done by :


                     sudo sfdisk --no-reread -f /dev/sda -O PT.save < PT.txt


here, "--no-reread" means don't check if disk is unmounted

           -f force

          "-O PT.save" means save a backup of original partition table in PT.save.


( PT.save is in binary format. To restore the partition table using PT.save:


                           sudo sfdisk --force -I PT.save /dev/sda )



                           Now lets reboot and see if the problem is resolved. Still no luck as the cursor still blinks forever. Now at least , the GParted doesn't detect any error in the partition table and all the error messages are gone and I am able to easily access my all data using the Live USB disk.



                            So, will I have to re-install my operating systems all over again or still something can be done ???



To be continued............




Wednesday, October 5, 2011

Recovery of a deleted partition


                      My this post is coming after a gap of almost a week. Actually, almost for all the week I was busy in correcting my Hard-disk partions which I , by mistake, messed up.
                      It all began with me trying to boot from the mini iso of ubuntu. I was unable to find a way to make it boot from pen-drive. Even Ubuntu's Startup disk creator was also not able to help me. So, I decided to go with dd command , which makes an exact copy of almost any-thing. I was very wrong in thinking this and this is where all problem started. In stead of typing
 
                     dd if=mini.so of=/dev/sdc  ( where sdc was my pen-drive partition )
 
i did
 
                  sudo dd if=mini.iso of=/dev/sda  ( sda was my hard-disk )

                  The blunder mistake has been done. When I restarted my netbook to boot from the pen-drive, it simply refused even to recognise any bootable disk. I knew, I was screwed and I have corrupted my HD's partition table.

                  Before I proceed to tell you that how I recovered almost everything, I will present you with an idea of my Dell Netbook ( Inspiron Mini 10 ). My system is a dual-boot with Windows Xp SP3 Home Edition on the very first partition of 30GB ( a primary partition) and Ubuntu 11.04 Natty Narhwal on one logical partion of 50 GB inside the extended partition of 200 GB. My system configuration is 1GB RAM , 1.67 Ghz Intel Atom processor, 250GB HD and no internal CD/DVD drive but three USB ports.

The recovery process :

                 I plugged in my external transcend CD/DVD drive and tried to boot from an old Lucid Lynx ( Ubuntu 10.04 LTS ) CD. It worked but was unable to find any partition in my harddisk . I even tried
 
           sudo fdisk -l

                 It also said unable to find any reconizable partition table. My next step was to look for solution in ubuntu forum ( www.ubuntuforums.org ) , luckily I found a post similar to my problem and the corresponding link for a damn good program ( or software ) named testdisk.

Links



                   I also found a very good step-by-step process explaining the working of testdisk on the testdisk website 

                   So, I downloaded the latest available tarball (testdisk-6.12.linux26.tar.bz2 ) from the testdisk website ( http://www.cgsecurity.org/wiki/TestDisk ) and transferred it to my external hard-disk , so that I can re-use it when I have to reboot ( I was on a live disk ). In addition I made the bootable usb disk via the Startup disk creator as the performance of a lve disk from usb will any how be better than that of a CD. Next step was to launch the testdisk program from the external HD.

sudo testdisk_static ( sudo is neccesary to discover all the disk / partitions )

Screenshots :

1) The first screen will ask for log-file creation : Select create by using arrow keys on the key-board and press enter.


2) The second screen will show your disks /media available. Select your hard-disk and press enter.



3) The next screen will present you with a choice of selecting partion table type . Select Intel for normal ubuntu / windows installations.



4) The next screen will ask you for operations on the disk. Select analyse and press enter.



5) The next screen will show the current partition table structure. As you can see here, in my case it doesn't show up any thing. So, just press enter for quick search for the partitions.




6) The next screen will ask for a permission that it will scan for partition made under Windows Vista. Type Y and it will start scanning / analysing your system for lost partitions as per the below screen-shot. The process took around 15-20 minutes for my 250 GB hard-disk.


7) In The next screen it present a list of partions available for recovery. Even this list also doesn't contained my 1st partion ( containg Windows Xp Home Edition ). So, I went for a deep search option which took another 60-90 minutes. 

                The next list contained a lot more partitions than my system actually had. But luckily , this list contained my all partitions as well. 

                It also presented an option of listing / viewing the files. The partitions for which no files were listed , I changed the status of partition to D ( deleted) . The status of the 1st partion ( containg my Xp files ) was changed to * ( bootable primary ) , and rest partion were logical partitions, so there status was changed to L ( logical ). If I had any more primary partitions , its status would have been P ( primary ). The status can be changed using left and right arrow keys of key-board. You can find a detailed explanation on test-disk wiki page ( http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step ) . Press enter to continue.

8) In the next screen it will show you a final list of partitions. Make sure that it is your actual list of partitions and select proceed to write the partition table according to your findings.

9) the next screen will ask you about the boot sector. Here it presented me with two boot sectors – one was present boot sector which was corrupted and a back-up boot sector which was label as OK . So, i selected the option to copy the back-up boot sector to the present boot sector. Next screen was to quit the program and reboot the system ( after unplugging the external media i.e. the CD/DVD drive , pen-drive, external HD ).

               So, I thought it is all done and i should be able to boot right into my system.

But.............................