W
WH Brave
Hello,
First of all I apologize for the very long post; I tried to give all
the information I could since I am really desperate.
I used Partition Magic 8.0 to modify partitions on my HD and it
terminated with an error while shrinking an ext2 logical partition
(with important data on it). Since then I cannot access data on that
partition. The other partitions are OK (I think).
Reading this newsgroup I found the utilities by Svend Olaf Mikkelsen
and used "findpart 1" to get the following:
Findpart, version 4.43 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2004.
OS: Windows 4.10.2222 All
Disk: 1 Cylinders: 5494 Heads: 255 Sectors: 63 MB: 43096
-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 83 63 48132 23 0 1 1 2 254 63 B5 OK
Lilo sector 0 1 1
3 1 82 63 530082 258 3 1 1 35 254 63 OK
3 2 05 530207 41094208 20065 36 0 63 2593*254 63 3 OK
36 1 83 63 62781957 30655 36 1 1 3943*254 63 NB OK
36 - 83 63 41094207 20065 36 1 1 2593 254 63 B0 OK
0 - 83 63360360 8321670 4063 3944 0 1 4461 254 63 B 3 OK
Fdisk F6 sector 3944 0 1
0 - 0C 71682030 16579080 8095 4462 0 1 5493 254 63 B OK
-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
4462 0 33 16175 4 2 16175 0 0 0 030427 6174
Partitions according to partition tables on first harddisk:
-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1 83 63 48132 23 0 1 1 2 254 63 OK OK
0 2 0F 48195 41624415 20324 3 0 1 2593*254 63 OK
0 3 0C 71682030 16579080 8095 4462# 0 1 5493*254 63 OK OK
0 4*83 63360360 8321670 4063 3944# 0 1 4461*254 63 OK 3 OK
3 1 82 63 530082 258 3 1 1 35 254 63 OK
3 2 05 530207 41094208 20065 36 0 63 2593*254 63 OK
36+1 83 63 41094207 20065 36 1 1 2593*254 63 NB NB
36 1 63 2594 0 62 Actual?
I cannot fully understand this output except that the line
36 1 83 63 62781957 30655 36 1 1 3943*254 63 NB OK
seemed to me to correspond to the partition that I have lost. Is this
correct?
After this, I ran "findpart findext2 1" to get
Findext2, version FP 4.43
Copyright Svend Olaf Mikkelsen, 2004.
Searches for ext2/ext3 superblocks. False positives might be found.
The partition location can be wrong. Data MB may be used megabytes,
especially for superblock 0. Mount/Write/Check are date/time if
valid. Note that cylinders are numbered from 0. Linux fdisk
numbers from 1.
OS: Windows 4.10.2222
Disk: 1 Cylinders: 5494 Heads: 255 Sectors: 63 MB: 43096
Start cylinder: 0 End cylinder: 5493
-PCyl N ID -----LBA -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 83 63 48132 23 0 1 1 2 254 63 B5 OK
Data MB 6
Mount 2004.06.13 22:10:04 Superblock 0 Block 1
Write 2004.06.14 21:16:29 Superblock LBA 65
Check 2004.05.31 19:31:51 Superblock CHS 0/1/3
Blocks: KB: 1 First: 1 Per group: 8192
0 - 83 578403 41094207 20065 36 1 1 2593 254 63 B0 OK
Data MB 15868 Actual end sector: 56
Mount 2004.06.13 22:10:04 Superblock 0 Block 0
Write 2004.06.14 22:13:37 Superblock LBA 578405
Check 2004.05.31 19:35:10 Superblock CHS 36/1/3
Blocks: KB: 4 First: 0 Per group: 32768
0 - 83 578405 71103627 34718 36 1 3 4462 0 2 B OK
Data MB 24349 Actual end sector: -1
Mount 2003.04.21 01:20:18 Superblock 1 Block 32768
Write 2003.04.21 01:20:18 Superblock LBA 840549
Check 2003.03.11 07:16:43 Superblock CHS 52/82/4
Blocks: KB: 4 First: 0 Per group: 32768
Searched 100 0 1
Searched 200 0 1
[snipped]
This output repeats in this fashion and the computer crashes after a
while.
I thought the last entry found corresponded to the partition I lost so
I did a "readext2 1 52 52" and it starting outputting names of files
which correspond to those that were on the partition I lost. Then the
file browser came up and I have some directory names consisiting of
numbers and under the first directory
named "2" I see the following:
+--- ReadExt2 -----------------------------------------------------------------+
¦2\
¦
¦------------------------------------------------------------------------------¦
¦2001.01.16 22:22:02 <DIR> lost+found
¦
¦2003.10.05 17:14:35 1804 .bash_history
¦
¦2003.04.25 23:32:30 512 bootsect.lnx
¦
¦2001.01.16 22:22:41 <DIR> boot
¦
¦2001.01.16 22:22:41 <DIR> proc
¦
¦2003.04.17 20:10:15 <DIR> var
¦
¦1970.01.01 00:00:00 <DIR> tmp
¦
¦2004.05.27 01:16:14 <DIR> dev
¦
¦2003.04.17 20:17:41 <DIR> usr
¦
¦2004.05.27 01:16:20 <DIR> etc
¦
¦2003.04.17 20:17:42 <DIR> bin
¦
¦2002.10.31 22:02:23 <DIR> home
¦
¦2003.04.20 22:16:55 <DIR> lib
¦
¦2003.04.25 23:21:40 <DIR> mnt
¦
¦2003.04.17 20:10:22 <DIR> opt
¦
¦2004.05.09 01:36:53 <DIR> root
¦
¦2003.04.27 23:45:49 <DIR> sbin
¦
¦
¦
¦
¦
¦
¦
¦
¦
+-- F1: Help ----------- Version 1.1 - Copyright Svend Olaf Mikkelsen,
2003. --+
I checked inside the directories and read a few files using F5 and
then seem OK.
Then I ran "readext2 1 36 36" to see what the second entry is and in
the end I got the same directory structure. I read a few files and
they were OK. So the second and third entries in findext2 output seem
to be the same; why is this the case?
After all this I also tried
set findpart=edit
findpart 1 36 1 - 83 36 1 1 3943 254 63 36 5494 255 63 26
to try to write the lost partition entry but this changed nothing;
when I type "findpart 1" I get the exact same response as before. Was
this the correct thing to do? Also, why didn't anything change after
this?
This is as much as I could achieve(!) on my own, I would really
appreciate help at this point on how to recover my lost partition, or
at least some of the data on it. It would really help for instance if
there was a way to copy directory trees with readext2, is this
possible?
Thanks a lot,
William
First of all I apologize for the very long post; I tried to give all
the information I could since I am really desperate.
I used Partition Magic 8.0 to modify partitions on my HD and it
terminated with an error while shrinking an ext2 logical partition
(with important data on it). Since then I cannot access data on that
partition. The other partitions are OK (I think).
Reading this newsgroup I found the utilities by Svend Olaf Mikkelsen
and used "findpart 1" to get the following:
Findpart, version 4.43 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2004.
OS: Windows 4.10.2222 All
Disk: 1 Cylinders: 5494 Heads: 255 Sectors: 63 MB: 43096
-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 83 63 48132 23 0 1 1 2 254 63 B5 OK
Lilo sector 0 1 1
3 1 82 63 530082 258 3 1 1 35 254 63 OK
3 2 05 530207 41094208 20065 36 0 63 2593*254 63 3 OK
36 1 83 63 62781957 30655 36 1 1 3943*254 63 NB OK
36 - 83 63 41094207 20065 36 1 1 2593 254 63 B0 OK
0 - 83 63360360 8321670 4063 3944 0 1 4461 254 63 B 3 OK
Fdisk F6 sector 3944 0 1
0 - 0C 71682030 16579080 8095 4462 0 1 5493 254 63 B OK
-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
4462 0 33 16175 4 2 16175 0 0 0 030427 6174
Partitions according to partition tables on first harddisk:
-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1 83 63 48132 23 0 1 1 2 254 63 OK OK
0 2 0F 48195 41624415 20324 3 0 1 2593*254 63 OK
0 3 0C 71682030 16579080 8095 4462# 0 1 5493*254 63 OK OK
0 4*83 63360360 8321670 4063 3944# 0 1 4461*254 63 OK 3 OK
3 1 82 63 530082 258 3 1 1 35 254 63 OK
3 2 05 530207 41094208 20065 36 0 63 2593*254 63 OK
36+1 83 63 41094207 20065 36 1 1 2593*254 63 NB NB
36 1 63 2594 0 62 Actual?
I cannot fully understand this output except that the line
36 1 83 63 62781957 30655 36 1 1 3943*254 63 NB OK
seemed to me to correspond to the partition that I have lost. Is this
correct?
After this, I ran "findpart findext2 1" to get
Findext2, version FP 4.43
Copyright Svend Olaf Mikkelsen, 2004.
Searches for ext2/ext3 superblocks. False positives might be found.
The partition location can be wrong. Data MB may be used megabytes,
especially for superblock 0. Mount/Write/Check are date/time if
valid. Note that cylinders are numbered from 0. Linux fdisk
numbers from 1.
OS: Windows 4.10.2222
Disk: 1 Cylinders: 5494 Heads: 255 Sectors: 63 MB: 43096
Start cylinder: 0 End cylinder: 5493
-PCyl N ID -----LBA -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 83 63 48132 23 0 1 1 2 254 63 B5 OK
Data MB 6
Mount 2004.06.13 22:10:04 Superblock 0 Block 1
Write 2004.06.14 21:16:29 Superblock LBA 65
Check 2004.05.31 19:31:51 Superblock CHS 0/1/3
Blocks: KB: 1 First: 1 Per group: 8192
0 - 83 578403 41094207 20065 36 1 1 2593 254 63 B0 OK
Data MB 15868 Actual end sector: 56
Mount 2004.06.13 22:10:04 Superblock 0 Block 0
Write 2004.06.14 22:13:37 Superblock LBA 578405
Check 2004.05.31 19:35:10 Superblock CHS 36/1/3
Blocks: KB: 4 First: 0 Per group: 32768
0 - 83 578405 71103627 34718 36 1 3 4462 0 2 B OK
Data MB 24349 Actual end sector: -1
Mount 2003.04.21 01:20:18 Superblock 1 Block 32768
Write 2003.04.21 01:20:18 Superblock LBA 840549
Check 2003.03.11 07:16:43 Superblock CHS 52/82/4
Blocks: KB: 4 First: 0 Per group: 32768
Searched 100 0 1
Searched 200 0 1
[snipped]
This output repeats in this fashion and the computer crashes after a
while.
I thought the last entry found corresponded to the partition I lost so
I did a "readext2 1 52 52" and it starting outputting names of files
which correspond to those that were on the partition I lost. Then the
file browser came up and I have some directory names consisiting of
numbers and under the first directory
named "2" I see the following:
+--- ReadExt2 -----------------------------------------------------------------+
¦2\
¦
¦------------------------------------------------------------------------------¦
¦2001.01.16 22:22:02 <DIR> lost+found
¦
¦2003.10.05 17:14:35 1804 .bash_history
¦
¦2003.04.25 23:32:30 512 bootsect.lnx
¦
¦2001.01.16 22:22:41 <DIR> boot
¦
¦2001.01.16 22:22:41 <DIR> proc
¦
¦2003.04.17 20:10:15 <DIR> var
¦
¦1970.01.01 00:00:00 <DIR> tmp
¦
¦2004.05.27 01:16:14 <DIR> dev
¦
¦2003.04.17 20:17:41 <DIR> usr
¦
¦2004.05.27 01:16:20 <DIR> etc
¦
¦2003.04.17 20:17:42 <DIR> bin
¦
¦2002.10.31 22:02:23 <DIR> home
¦
¦2003.04.20 22:16:55 <DIR> lib
¦
¦2003.04.25 23:21:40 <DIR> mnt
¦
¦2003.04.17 20:10:22 <DIR> opt
¦
¦2004.05.09 01:36:53 <DIR> root
¦
¦2003.04.27 23:45:49 <DIR> sbin
¦
¦
¦
¦
¦
¦
¦
¦
¦
+-- F1: Help ----------- Version 1.1 - Copyright Svend Olaf Mikkelsen,
2003. --+
I checked inside the directories and read a few files using F5 and
then seem OK.
Then I ran "readext2 1 36 36" to see what the second entry is and in
the end I got the same directory structure. I read a few files and
they were OK. So the second and third entries in findext2 output seem
to be the same; why is this the case?
After all this I also tried
set findpart=edit
findpart 1 36 1 - 83 36 1 1 3943 254 63 36 5494 255 63 26
to try to write the lost partition entry but this changed nothing;
when I type "findpart 1" I get the exact same response as before. Was
this the correct thing to do? Also, why didn't anything change after
this?
This is as much as I could achieve(!) on my own, I would really
appreciate help at this point on how to recover my lost partition, or
at least some of the data on it. It would really help for instance if
there was a way to copy directory trees with readext2, is this
possible?
Thanks a lot,
William