Last night, I lost my hard disk’s MBR, (i.e. 0th sector of my HDD). I was so confused and tensed, that I actually forgot the sizes of my deleted partitions. Thanx to my memory I remembered the filesystems of my partitions.
My primary partitions were:
My extended partitions are:
- SWAP (LINUX)
I’ve my Ubuntu Live CD so I booted from it.
And then I created a fake MBR (with the help of
fdisk, shipped with Linux) where my first partition is spanning whole hard disk and system id is NTFS. I then flushed changes to the disk.
My first partition is NTFS, so I checked its
hexdump -C /dev/sda1) and then with the help of NTFS Volume Information format (as described in Upgrading and Reparing PCs by Scott Mueller), got the count of sectors reserved by NTFS partition. So I’ve replaced the count of sectors of NTFS partition with the size of first partition in MBR. So, my first partition is recovered.
Similarly, I created 2nd partition (FAT32) in MBR spanning rest of the disk. And with the help of FAT32 Volume Information format (as described in Upgrading and Reparing PCs by Scott Mueller), I corrected its sector count. And its entry gets restored tooo…
For 3rd EXT3 partition, there is no information in the book, so I’ve to use a tool named
e2fsdump), to get the count of sectors occupied by the third partition. I corrected its sector count. And its entry gets restored tooo…
For EXTENDED partition, I’ve to tweak a bit. First, I created an EXT3 partition (because I doubted that creating an extended partition might zero my existing extended partitions), spanning rest of the disk and flushed it. Then read the MBR in a file named
dd if=/dev/sda of=mbr bs=512 count=1). With the help of hex editor (GNU eMacs in
hexl-mode), I manually changed last partition’s system id (498th byte) to 0F (Extended partition’s system ID). Then re-wrote the
"mbr" file to disk via
dd of=/dev/sda if=mbr bs=512 count=1), asked the kernel to reload partitions via
echo w |fdisk /dev/sda). Now, all my partitions are restored, since only my primary partitions are erased.
And finally re-installed GRUB on my hard disk locating images on my 2nd primary partition (EXT3).
In this way, I restored my hard disk’s partiton table.