[clug] Accidental commit to fdisk - rebuild (partitions stillmounted) [SEC=PERSONAL]

[Roppola, Antti - BRS]

Can you borrow an external hard drive and copy the content off?

Worse case: Provided that's all that was written, a forensic imaging
tool like PyFLAG ought to have minimal problems recovering content from
those partitions (I'll leave advice on that to people who've used it).

I would also expect from previous that re-defining the partitions in
fdisk would have a reasonable chance of any filesystems being readable.
Might the values still be in /proc somewhere? How about
/var/log/boot.msg, that should give partition sizes (see cut & patse
below).

Way back when, I helped someone who'd re-partitioned but not
re-formatted an Amiga's hard drive, the filesystem was "mostly" readable
except they'd used an fdisk equivalent to change the partion layout so
the filesystem did get confused at times as their new partition was
twice as large as the filesystem was formatted for.

Cheers,

Antti 

Suse 9 /var/log/boot.msg:

<6> sda: sda1 sda2 sda3
<5>Attached scsi disk sda at scsi0, channel 0, id 0, lun 0
<5>  Vendor: ATA       Model: SAMSUNG HD160JJ   Rev: ZM10
<5>  Type:   Direct-Access                      ANSI SCSI revision: 05
<5>SCSI device sdb: 312581808 512-byte hdwr sectors (160042 MB)
<5>SCSI device sdb: drive cache: write back
<5>SCSI device sdb: 312581808 512-byte hdwr sectors (160042 MB)
<5>SCSI device sdb: drive cache: write back
<6> sdb: sdb1 sdb2 sdb3
<5>Attached scsi disk sdb at scsi0, channel 0, id 1, lun 0
<5>  Vendor: ATA       Model: WDC WD2500JS-55N  Rev: 10.0
<5>  Type:   Direct-Access                      ANSI SCSI revision: 05
<5>SCSI device sdc: 488397168 512-byte hdwr sectors (250059 MB)
<5>SCSI device sdc: drive cache: write back
<5>SCSI device sdc: 488397168 512-byte hdwr sectors (250059 MB)
<5>SCSI device sdc: drive cache: write back
<6> sdc: sdc1
<5>Attached scsi disk sdc at scsi1, channel 0, id 0, lun 0
<5>  Vendor: ATA       Model: WDC WD2500JS-00N  Rev: 10.0
<5>  Type:   Direct-Access                      ANSI SCSI revision: 05
<5>SCSI device sdd: 488397168 512-byte hdwr sectors (250059 MB)
<5>SCSI device sdd: drive cache: write back
<5>SCSI device sdd: 488397168 512-byte hdwr sectors (250059 MB)
<5>SCSI device sdd: drive cache: write back
<6> sdd: sdd1
<5>Attached scsi disk sdd at scsi1, channel 0, id 1, lun 0
<6>md: raid1 personality registered as nr 3

-----Original Message-----
From: linux-bounces at lists.samba.org
[mailto:linux-bounces at lists.samba.org] On Behalf Of Neil Symons
Sent: Monday, 20 July 2009 9:37 AM
To: linux at lists.samba.org
Subject: [clug] Accidental commit to fdisk - rebuild (partitions
stillmounted)

Hi all,

I hope there is a simple answer to this.

I am helping out someone who accidentally removed an extended partition
using fdisk on Suse linux 9 (86/64 sp3) and lost more partitions than
expected.
The system is up with all partitions still mounted. The risk is, if he
reboots or unmounts any partition the data may be lost forever.

I do not know how to obtain the current partition information on the
drive to rebuild using fdisk.
Help would be extremely appreciated here.


Regards,

Neil
--
linux mailing list
linux at lists.samba.org
https://lists.samba.org/mailman/listinfo/linux


------
IMPORTANT - This message has been issued by The Department of Agriculture, Fisheries and Forestry (DAFF). The information transmitted is for the use of the intended recipient only and may contain sensitive and/or legally privileged material. It is your responsibility to check any attachments for viruses and defects before opening or sending them on. 

Any reproduction, publication, communication, re-transmission, disclosure, dissemination or other use of the information contained in this e-mail by persons or entities other than the intended recipient is prohibited. The taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you have received this e-mail in error please notify the sender and delete all copies of this transmission together with any attachments. If you have received this e-mail as part of a valid mailing list and no longer want to receive a message such as this one advise the sender by return e-mail accordingly. Only e-mail correspondence which includes this footer, has been authorised by DAFF 

------