Linux – testdisk and load backup of partition table

hard drivelinuxpartitioningtestdisk

I have a new disk, so I wanted to see how the testdisk backup works.

After partitioning and formatting the disk with gksu gparted /dev/sdc, this is what I get:

$ sudo fdisk -lu /dev/sdc

Disk /dev/sdc: 60.0 GB, 60011642880 bytes
255 heads, 63 sectors/track, 7296 cylinders, total 117210240 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000c0705

   Device Boot      Start         End      Blocks   Id  System
/dev/sdc1              63    20980889    10490413+  83  Linux
/dev/sdc2        20980890   117210239    48114675    5  Extended
/dev/sdc5        20980953    83891429    31455238+  83  Linux
/dev/sdc6        83891493   100663289     8385898+  83  Linux
/dev/sdc7       100663353   109049219     4192933+  83  Linux
/dev/sdc8       109049283   117210239     4080478+  82  Linux swap / Solaris

So, after this, I want to backup the partitions' boot record with testdisk and then restore it. So I do: 

cd /tmp
sudo testdisk

… and then

  • [ Create ] Create a new log file
  • from Select a media choose Disk /dev/sdc - 60 GB / 55 GiB, then [Proceed ]
  • from Please select the partition table type,, choose [Intel ] Intel/PC partition
  • on next screen, choose [ Analyse ] Analyse current partition structure...; I get this:
     1 P Linux                    0   1  1  1305 254 63   20980827
     2 E extended LBA          1306   0  1  7295 254 63   96229350
    No partition is bootable
     5 L Linux                 1306   1  1  5221 254 63   62910477
       X extended              5222   0  1  6265 254 63   16771860
     6 L Linux                 5222   1  1  6265 254 63   16771797
       X extended              6266   0  1  6787 254 63    8385930
     7 L Linux                 6266   1  1  6787 254 63    8385867
       X extended              6788   0  1  7295 254 63    8161020
     8 L Linux Swap            6788   1  1  7295 254 63    8160957
  • I choose [ Backup ] Save current partition list to backup.log file and proceed
  • Answer n to Should TestDisk search for partition created under Vista ?; I get:
    Disk /dev/sdc - 60 GB / 55 GiB - CHS 7296 255 63
         Partition               Start        End    Size in sectors
    * Linux                    0   1  1  1305 254 63   20980827
    L Linux                 1306   1  1  5221 254 63   62910477
    L Linux                 5222   1  1  6265 254 63   16771797
    L Linux                 6266   1  1  6787 254 63    8385867
    L Linux Swap            6788   1  1  7295 254 63    8160957
  • I press Enter: to continue; I get:
    Disk /dev/sdc - 60 GB / 55 GiB - CHS 7296 255 63

         Partition                  Start        End    Size in sectors

     1 * Linux                    0   1  1  1305 254 63   20980827
     2 E extended LBA          1306   0  1  7295 254 63   96229350
     5 L Linux                 1306   1  1  5221 254 63   62910477
     6 L Linux                 5222   1  1  6265 254 63   16771797
     7 L Linux                 6266   1  1  6787 254 63    8385867
     8 L Linux Swap            6788   1  1  7295 254 63    8160957
  • Choose [ Quit ] Return to main menu here
  • Chooose [ Quit ] from next menu
  • Chooose [ Quit ] Quit program from very first menu

Now there is a backup.log in /tmp, with these contents:

#1412861047 Disk /dev/sdc - 60 GB / 55 GiB - CHS 7296 255 63
 1 : start=       63, size= 20980827, Id=83, P
 2 : start= 20980890, size= 96229350, Id=05, E
 5 : start= 20980953, size= 62910477, Id=83, L
 6 : start= 83891493, size= 16771797, Id=83, L
 7 : start=100663353, size=  8385867, Id=83, L
 8 : start=109049283, size=  8160957, Id=82, L

Repeats of the process above will append the same contents to the backup.log.

Now, I want to test restoration; I do again sudo testdisk … and then

  • [ Append ] Append information to log file
  • from Select a media choose Disk /dev/sdc - 60 GB / 55 GiB, then [Proceed ]
  • from Please select the partition table type,, choose [Intel ] Intel/PC partition
  • now choose [ Delete ] Delete all data in the partition table on next screen
  • answer y to Clear MBR partition table by writing zero bytes to it? (Y/N)
  • answer y to Clear partition table, confirm ? (Y/N)
  • get Partition table has been cleared. You have to reboot for the change to take effect. and hit [Ok]

  • we're back to Disk /dev/sdc; now choose [ Analyse ] Analyse current partition structure... ; here get:

    Disk /dev/sdc - 60 GB / 55 GiB - CHS 57231 64 32
Current partition structure:
     Partition                  Start        End    Size in sectors

No partition is bootable
  • click on [Quick Search]
  • answer n for Should TestDisk search for partition created under Vista ? [Y/N]

  • hit Stop as soon as the search starts ; get this:

    Warning: the current number of heads per cylinder is 64
but the correct value may be 255.
You can use the Geometry menu to change this value.
It's something to try if
\- some partitions are not found by TestDisk
\- or the partition table can not be written because partitions overlaps.

  • hit [ Continue ], get: 

    Disk /dev/sdc - 60 GB / 55 GiB - CHS 57231 64 32
     Partition               Start        End    Size in sectors
L Linux                    0   1 32 10244  63 32   20981697
  • now hit l for L: load backup;
  • choose Disk /dev/sdc - ... for Choose the backup you want to restore: and then hit [ Load ]

At this point, I get this:

<pre>Disk /dev/sdc - 60 GB / 55 GiB - CHS 57231 64 32
     Partition               Start        End    Size in sectors
P Linux                    0   1 32 10244  36 26   20980827
L Linux                    0   1 32 10244  63 32   20981697
L Linux                10244  38 26 40962  39  6   62910477
L Linux                40962  41  6 49151  63 26   16771797
L Linux                49152   1 26 53246  44  4    8385867
L Linux Swap           53246  46  4 57231  35 32    8160957</pre>

… and "Structure: Bad. " in red; as shown on the image:

testdisk-screenshot

My question is – why is this "Structure: Bad"? The only thing I can notice is that the first two entries about cover the same range; but why does testdisk import them both? How do I avoid this if I want to restore the partition structure from a backup?

Best Answer

Well, a more knowledgeable answer will be appreciated - however, at least I found how to avoid this problem, while writing the OP. Btw this is TestDisk 6.11, Data Recovery Utility, April 2009 on Ubuntu 11.04. After the disk is blank, re-start the sudo testdisk and follow the trace in the OP to get to the same screen (the one you get after you:

  • hit l for L: load backup;
  • choose Disk /dev/sdc - ... for Choose the backup you want to restore: and then hit [ Load ]

)

Here, go to the second entry, and: Use Left/Right Arrow keys to CHANGE partition characteristics: until you get D=Deleted for that partition; it looks something like this:

testdisk-screenshot-2

Now, obviously, no more "bad structure" is reported, and everything is green; interestingly, only this partition reacts like this (the first one, for example, induces no change even if it is set to D).

Now I just press Enter: to continue; get this on next screen:

     Partition                  Start        End    Size in sectors

 1 P Linux                    0   1 32 10244  36 26   20980827
 2 E extended LBA         10244  38  1 57231  63 32   96230208
 5 L Linux                10244  38 26 40962  39  6   62910477
 6 L Linux                40962  41  6 49151  63 26   16771797
 7 L Linux                49152   1 26 53246  44  4    8385867
 8 L Linux Swap           53246  46  4 57231  35 32    8160957

At it, choose [ Write ] Write partition structure to disk; and

  • answer y to Write partition table, confirm ? (Y/N)
  • get You will have to reboot for the change to take effect., hit [Ok]
  • choose [ Quit ] Return to disk selection on next screen
  • choose [ Quit ] Quit program on next screen

Now I can do this:

$ sudo fdisk -lu /dev/sdc

Disk /dev/sdc: 60.0 GB, 60011642880 bytes
64 heads, 32 sectors/track, 57231 cylinders, total 117210240 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000c0705

   Device Boot      Start         End      Blocks   Id  System
/dev/sdc1              63    20980889    10490413+  83  Linux
/dev/sdc2        20980928   117211135    48115104    f  W95 Ext'd (LBA)
/dev/sdc5        20980953    83891429    31455238+  83  Linux
/dev/sdc6        83891493   100663289     8385898+  83  Linux
/dev/sdc7       100663353   109049219     4192933+  83  Linux
/dev/sdc8       109049283   117210239     4080478+  82  Linux swap / Solaris

... and nearly everything is the same as in the original partition table in the OP - except here I have "f W95 Ext'd (LBA)" while above it was "5 Extended" for the second (sdc2, "extended") partition.

If someone can point out what am I doing wrong, and what should I do exactly to reconstruct the exact same partition table even after a deletion, I'd appreciate it.

EDIT: I think I got something more; the difference is not only in "f W95 Ext'd (LBA)" vs "5 Extended"; but also, from fdisk - in first case:

255 heads, 63 sectors/track, 7296 cylinders, total 117210240 sectors
/dev/sdc2        20980890   117210239    48114675    5  Extended

... and in second case:

64 heads, 32 sectors/track, 57231 cylinders, total 117210240 sectors
/dev/sdc2        20980928   117211135    48115104    f  W95 Ext'd (LBA)

So, the CHS geometry - and the region of the extended partition - is wrong; that is probably the meaning of the Warning: the current number of heads per cylinder is 64 but the correct value may be 255. obtained in the OP. So once we get to the main menu in testdisk we can change geometry:

  • [ Geometry ] Change disk geometry
  • [ Heads ] Change head geometry
    • Enter the number of heads: 255
  • [ Sectors ] Change sector geometry
    • Enter the number of sectors per track (1-63): 63
  • [ Cylinders ] Change cylinder geometry (no change here):
    • Enter the number of cylinders: 7296
  • [ Ok ] Done with changing geometry
  • [ Analyse ] Analyse current partition structure
  • [Quick Search] Try to locate partition
  • n to Should TestDisk search for partition created under Vista ? [Y/N]
  • testdisk now finds the partitions that were deleted; hit L: load backup
  • Disk /dev/sdc - to Choose the backup you want to restore: then [ Load ]

Again Structure: Bad. and duplicated partitions; set every second one to D - bad structure clears:

testdisk-screenshot-3

Finally:

  • Enter: to continue
  • [ Write ] Write partition structure to disk
  • y to Write partition table, confirm ? (Y/N)
  • [Ok] to You will have to reboot for the change to take effect.
  • [ Quit ] Return to disk selection
  • [ Quit ] Quit program

Now fdisk will report the same geometry - and the same range for the extended partition:

255 heads, 63 sectors/track, 7296 cylinders, total 117210240 sectors
...
/dev/sdc2        20980890   117210239    48114675    f  W95 Ext'd (LBA)

/dev/sdc2        20980890   117210239    48114675    5  Extended        # first
/dev/sdc2        20980928   117211135    48115104    f  W95 Ext'd (LBA) # second

... and comparing to previous reports, now we have the same range as the first, but still not the same filesystem type (f W95 Ext'd (LBA) instead of 5 Extended); but it looks much better like this, at least.

Related Question