What did I do?
Short answer: Not really sure.
I wanted to make another FAT16 partition for WINME. I had an experimental
hurd partition (2G) that I didn't need, so I know from .bash_history that
I did this:
mkdosfs /dev/hda2 # to make the partition
fdisk # not the tool I wanted
cfdisk /dev/hda # to set the partition type to FAT16
cfdisk /dev/hda # to check that all was well
I rebooted into WINME (which is /dev/hda1 - 2G)
I think WINME didn't like the new partition so I ran DOS fdisk in WINME,
rebooted and formatted the drive in WINME. Contrary to my memory on the
matter, ME did not mind that the new partition was a primary (a thought
that occurred to me afterwards). Anyway, I now had a D: and I proceeded to
move a lot of files around - the main reason I needed the drive.
What I failed to notice was that D: was only 1G - half the 2G partition. I
discovered this when it filled-up unexpectedly. I ran DOS fdisk again, and
it confirmed the 2G partition size.
I think I rebooted WINME again (if at first you don't succeed, reboot!)
and now I had a drive E:!!! I thought that this was typical M$ behaviour
and that it was a ghost of D: (my desktop at home gets multiple CD-ROM
drives listed). I don't recall formatting E:, but it seemed formatted, had
a recycle bin, and was empty. Now I was worried - was this my linux root
partition (being hda3?). I rebooted.
L <07><07><07>...........
(I stared at it a long time, but it didn't stop)
The analysis
After scanning the drive with diskedit, the beginning of hda3 was trashed
and the extended partition (hda4) did not point to a valid partition
table. hda5 and onwards seemed OK, and were chained. (sounds like I can
just look at a partition table and analyse it like a chess champion, but
it took days and a spreadsheet to assist with the calculations.
My Partition Table looked like this:
(a Rector is a relative sector, and the tabbing may not look good for you)
Rector #Sectors Desc Type Comment
0 1 MBR+PT Now a DOS MBT with fdisk
/mbr
1 62 unused
63 4192902 C: 0E OK
4192965 3991680 D: 0E I thought it was D:, but it was
only 1G
? ? E:? ? I could not find a
PT for E:
8184645 997920 P3 83 root & /boot etc. - damaged
9182565 1 Ext.Part overwritten
9182566 62 unused
9182628 1995777 P5 83 reiser .var - OK
... the rest of the partitions seemed OK and still linked.
Using diskedit again I found that:
C: MSWIN4.1 @ cyl 0, head 1, sector , 63 hidden sectors, 4192902 total
sectors (2G) - seems to make sense
D: MSWIN4.1 @ cyl 564, head 150, sector 1, 4192965 hidden sectors, 1997856
total sectors (1G) - what the...
E: mkdosfs, @ cyl 277, head 75, sector 1, 0 hidden sectors, 1997856 total
sectors (1G) - interesting
It seems that when I formatted D:, it skipped past my mkdosfs attempt,
found some space and made D: half-way through a partition!?!?!
Unfortunately, the combined size of D: and E: was greater than the
partition by 4032 sectors, so it overwrote the beginning of my linux
root/boot partition (hda3).
How did I fix it?
I moved the files back onto C:
I manually calculated the correct Rectors and re-created the overwritten
partition table in sector 9182565
I booted a debian CD - no good for a standard fsck repair.
I then used another superblock at 73729 - a long way away from possible
damage.
I did a fsck -p -y -b 73729 /dev/hda3 and let it go.
It recovered most of the files in /etc that I wanted to keep, but for good
measure I took a copy of all readable text on the drive with grep.
Phil
--
SLUG - Sydney Linux User Group Mailing List - http://slug.org.au/
More Info: http://lists.slug.org.au/listinfo/slug
