Linux下恢复丢失的分区.doc

如果不能挂接硬盘上的任何分区,也许只需要重建分区表.下面是一个很方便的能标识可能的分区表项实用程序. /dev/FOO:device not found 这样的消息不会是什么好事.然而,出现这种消息可能是由多种不同问题造成的.对于完全硬件故障用户也许无能为国,但如果运气好,那么就只是磁盘分区表受到破坏,数据暂时不能访问. 提示:如果没有重启机器的话,执行命令:cut lproc /partitions 命令,看是否仍能列出设备的分区 除非你的记忆力很好像照相机,或磁盘只有一个分区,或手边有分区表的列表,否则试图猜测问题磁盘上所有分区的大小和位置在没有帮助的情况下几乎是不可能的.Michail Brzitwa写的程序gpart(guess partitions)扫描指定的磁盘驱动器,标识看似分区签名的表项.gpart默认只显示像是分区的表项,但它也能通过把表项写入磁盘,自动创建分区表,这个操作有些让人害怕,但总比丢失所有的数据强. gpart程序的工作方式是读取整个磁盘,并对照一组文件系统标识模块比较扇区序列.gpart默认包括能识别下列类型分区的文件系统标识模块:beos(Beos)bsddl(FreeBSD/NetBSD/386BSD)ext2和ext3(linux标准文件系统)fat(msdos fat0 fat16 fat 32)hpfs(OS/2)hmlvm(linux LVM物理卷)lswap(linux swap)minix(Minix os)ntfsqnx4(QNX version4.x)rfss86dl(sun solaris) xfs(XFS日志文件系统) 查找分区看看fdisk程序生成的现有磁盘的分区列表rootWalker gparted-0.2.4# fdisk -l /dev/hdcDisk /dev/hdc: 15.3 GB,bytes255 heads, 63 sectors/track, 1868 cylindersUnits = cylinders of 16065 * 512 = 8225280 bytes Device Boot Start End Blocks Id System/dev/hdc1 * 1 637 5116671 b W95 FAT32/dev/hdc2 638 1868 9888007+ f W95 Extd (LBA)/dev/hdc5 638 705 546178+ 83 Linux/dev/hdc6 706 1101 3180838+ 83 Linux/dev/hdc7 1102 1215 915673+ 82 Linux swap / Solaris/dev/hdc8 1216 1868 5245191 83 Linux这是我自己系统的分区列表用gpart程序rootWalker soft# ./gpart.linux /dev/hdcBegin scan.Possible partition(DOS FAT), size(4996mb), offset(0mb)Possible partition(Linux ext2), size(3106mb), offset(5530mb)Possible partition(Linux swap), size(894mb), offset(8636mb)* Warning: short read near sector(30015027), 64512 bytes instead of 66048. Skipping.End scan.Checking partitions.Partition(DOS or Windows 95 with 32 bit FAT): primaryPartition(Linux ext2 filesystem): primaryPartition(Linux swap or Solaris/x86): primaryOk.Guessed primary partition table:Primary partition(1) type: 011(0x0B)(DOS or Windows 95 with 32 bit FAT) size: 4996mb #s(10233336) s(63-10233398) chs: (0/1/1)-(1023/15/63)d (0/1/1)-(10152/2/57)rPrimary partition(2) type: 131(0x83)(Linux ext2 filesystem) size: 3106mb #s(6361672) s(11325888-17687559) chs: (1023/15/63)-(1023/15/63)d (11236/0/1)-(17547/2/58)rPrimary partition(3) type: 130(0x82)(Linux swap or Solaris/x86) size: 894mb #s(1831344) s(17687628-19518971) chs: (1023/15/63)-(1023/15/63)d (17547/4/1)-(19364/0/60)rPrimary partition(4) type: 000(0x00)(unused) size: 0mb #s(0) s(0-0) chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r rootWalker soft# ./gpart.linux /dev/hdcBegin scan.Possible partition(DOS FAT), size(4996mb), offset(0mb)Possible partition(Linux ext2), size(3106mb), offset(5530mb)Possible partition(Linux swap), size(894mb), offset(8636mb)* Warning: short read near sector(30015027), 64512 bytes instead of 66048. Skipping.End scan.Checking partitions.Partition(DOS or Windows 95 with 32 bit FAT): primaryPartition(Linux ext2 filesystem): primaryPartition(Linux swap or Solaris/x86): primaryOk.Guessed primary partition table:Primary partition(1) type: 011(0x0B)(DOS or Windows 95 with 32 bit FAT) size: 4996mb #s(10233336) s(63-10233398) chs: (0/1/1)-(1023/15/63)d (0/1/1)-(10152/2/57)rPrimary partition(2) type: 131(0x83)(Linux ext2 filesystem) size: 3106mb #s(6361672) s(11325888-17687559) chs: (1023/15/63)-(1023/15/63)d (11236/0/1)-(17547/2/58)rPrimary partition(3) type: 130(0x82)(Linux swap or Solaris/x86) size: 894mb #s(1831344) s(17687628-19518971) chs: (1023/15/63)-(1023/15/63)d (17547/4/1)-(19364/0/60)rPrimary partition(4) type: 000(0x00)(unused) size: 0mb #s(0) s(0-0) chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r rootWalker soft# ./gpart.linux /dev/hdcBegin scan.Possible partition(DOS FAT), size(4996mb), offset(0mb)Possible partition(Linux ext2), size(3106mb), offset(5530mb)Possible partition(Linux swap), size(894mb), offset(8636mb)* Warning: short read near sector(30015027), 64512 bytes instead of 66048. Skipping.End scan.Checking partitions.Partition(DOS or Windows 95 with 32 bit FAT): primaryPartition(Linux ext2 filesystem): primaryPartition(Linux swap or Solaris/x86): primaryOk.Guessed primary partition table:Primary partition(1) type: 011(0x0B)(DOS or Windows 95 with 32 bit FAT) size: 4996mb #s(10233336) s(63-10233398) chs: (0/1/1)-(1023/15/63)d (0/1/1)-(10152/2/57)rPrimary partition(2) type: 131(0x83)(Linux ext2 filesystem) size: 3106mb #s(6361672) s(11325888-17687559) chs: (1023/15/63)-(1023/15/63)d (11236/0/1)-(17547/2/58)rPrimary partition(3) type: 130(0x82)(Linux swap or Solaris/x86) size: 894mb #s(1831344) s(17687628-19518971) chs: (1023/15/63)-(1023/15/63)d (17547/4/1)-(19364/0/60)rPrimary partition(4) type: 000(0x00)(unused) size: 0mb #s(0) s(0-0) chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r 做算术有些枯燥,但计算分区大小和偏移量显示它们实际上是一样的.gpart发现了所有的分区,包括位于磁盘的扩展分区内的所有逻辑分区,这不容易.如果不想自己算,不定期gpart还提供了一个特殊的-c选项,用于比较它对磁盘分区表的认识与现有的分区表内列出的分区.如果两都完全相同,用带-c的gpart返回0,如果两者不同,返回异数.写分区表 使用fdisk重建分区表是很痛苦的,尤其是如果有多个大小不同的分区.gpart提供了一个自动把新的分区表写入扫描磁盘的选项.为此,需要在命令行指定要扫描的磁盘和要要写的磁盘:# gpart -w /dev/foo /dev/foo 如果不放心,可以在写前备份现有的MBR: #gpart -b filename -w /dev/foo /dev/fooIf youre trying to rescue a system with a corrupted partition table on the main (boot) disk which is unable to boot you have two options: the easiest way is to find a working system where you can add your disk. In case the other system cannot report the disks correct geometry, note down its geometry prior to moving to the working system and tell gpart about it (use the -C c,h,s option). download the gpart binary above, rename it to gpart, store it on a floppy disk, print out the manual page above, and start your system by using your prefered boot disk. After booting, look if your hard disk has been detected by your system by entering a shell and typing dmesg. Under e.g. Linux you should look out for lines like hdc: ST320430A, 19569MB w/512kB Cache, CHS=39761/16/63. If you have booted with a rescue disk mount the floppy disk with gpart on, and cd to the mount point. Now run gpart /dev/, e.g. gpart /dev/hdc. Without any options, gpart performs a standard scan, and merely looks if it can guess a consistent primary partition table. A typical positive output looks like: Begin scan. Possible partition(DOS FAT), size(3999mb), offset(0mb) Possible extended partition at offset(4000mb) Possible partition(Windows NTFS), size(3999mb), offset(4000mb) Possible partition(Linux ext2), size(3072mb), offset(8000mb) Possible partition(Linux ext2), size(3072mb), offset(11072mb) Possible partition(Linux ext2), size(3072mb), offset(14144mb) Possible partition(Linux ext2), size(2353mb), offset(17216mb) End scan. Checking partitions. Partition(DOS or Windows 95 with 32 bit FAT): primary Partition(OS/2 HPFS, NTFS, QNX or Advanced UNIX): logical Partition(Linux ext2 filesystem): logical Partition(Linux ext2 filesystem): logical Partition(Linux ext2 filesystem): primary Partition(Linux ext2 filesystem): primary Ok. Guessed primary partition table: Primary partition(1) type: 011(0x0B)(DOS or Windows 95 with 32 bit FAT) size: 3999mb #s(8191953) s(63-8192015) chs: (0/1/1)-(1023/15/63)d (0/1/1)-(8126/15/63)r Primary partition(2) type: 005(0x05)(Extended DOS) size: 10144mb #s(20775888) s(8192016-28967903) chs: (1023/15/63)-(1023/15/63)d (8127/0/1)-(28737/15/63)r Primary partition(3) type: 131(0x83)(Linux ext2 filesystem) size: 3072mb #s(6291456) s(28967904-35259359) chs: (1023/15/63)-(1023/15/63)d (28738/0/1)-(34979/8/24)r Primary partition(4) type: 131(0x83)(Linux ext2 filesystem) size: 2353mb #s(4819248) s(35259840-40079087) chs: (1023/15/63)-(1023/15/63)d (34980/0/1)-(39760/15/63)r Now if after the check-phase it says Ok, you should check the proposed partition table very carefully. After that you may write back the guessed table by calling gpart -W /dev/hdc /dev/hdc (exchange /dev/hdc with your disk device). When gpart has successfully written the new primary partition table, cross your fingers and reboot. If gpart says it found inconsistencies, you are a bit on your own. What you can do is to fiddle with gparts numerous options. For example, to scan on sector boundaries instead of head boundaries, give it the -n s option. Normally gpart skips the disk space a possible partition seems to occupy, to really scan the whole disk, add the -f option. Read the man page and improvise. In case gpart fails completely I can only point out some other similar tools which may help you. There is a tool called rescuept by Andries Brouwer which is included in the non-installed part of util-linux (you can find them on almost every Linux ftp site). Another tool is Gordon Chaffees fixdisktable. Good luck.gpart -w /dev/sda /dev/sda# 扫描sda分区表写入sda好了，这个软件叫testdisk.很帅的。如果你是使用修复光碟,就下载一个这个软件到电脑中,如果是恢复usb的disk直接#sudo apt-get install testdisk使用的话先sudo testdisk1.选择Create来进行分析Use arrow keys to select, then press Enter key: Create Create a new log file Append Append information to log file No Log Dont record anything2.然后选择testdisk中你要修复的硬盘，回车Select a media (use Arrow keys, then press Enter):Disk /dev/sda - 160 GB / 149 GiB - ATA HITACHI HTS54251Disk /dev/sdb - 3272 MB / 3121 MiB - SM324BC USB DISK3.选择testdisk修复的平台,我们是Intel的，所以选择他Please select the partition table type, press Enter when done.Intel Intel/PC partitionEFI GPT EFI GPT partition map (Mac i386, some x86_64.)Mac Apple partition mapNone Non partitioned mediaSun Sun Solaris partitionXBox XBox partitionReturn Return to disk selection4.使用testdisk分析,现在选择Analyse进行分析 Analyse Analyse current partition structure and search for lost partitions Advanced Filesystem Utils Geometry Change disk geometry Options Modify options MBR Code Write TestDisk MBR code to first sector Delete Delete all data in the partition table Quit Return to disk selection5.见到了没，基本所有的分区都出来了,直接回车就好了,默认直接回车是快速扫描.*=Primary bootable P=Primary L=Logical E=Extended D=DeletedQuick Search Backup 然后因为没用vista,所以选择n。Should TestDisk search for partition created under Vista ? Y/N (answer Yes ifunsure)N6.进入,见到你的表区表了吧。Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63Partition Start End Size in sectors* HPFS - NTFS 0 1 1 1567 254 63 25189857L FAT32 LBA 1568 2 1 5097 254 63 56709324 NO NAMEL Linux Swap 5098 1 1 5221 254 63 1991997L Linux 5222 1 1 7298 254 63 33366942L Linux 7299 1 1 19456 254 63 195318207Structure: Ok. Use Up/Down Arrow keys to select partition.Use Left/Right Arrow keys to CHANGE partition characteristics:*=Primary bootable P=Primary L=Logical E=Extended D=DeletedKeys A: add partition, L: load backup, T: change type, P: list files,Enter: to continueNTFS, 12 GB / 12 GiB你还可以按p进入一下，看看文件是不是你想要的那些，然后下面会显示文件系统多大,什么系统.我进入到这个地方时，基本找出来了，不需要在修改什么了，如果和你的分区不一样,那可能还需要使用Deeper search的功能.我的成功修复了，所以直接按write直接进行写到分区表中修复.bzip2-dgcc-4.1.0.tar.bz2 -上面解压完之后执行下面的命令。tar -xvf gcc-4.1.0.tar 或 tar -xvf *.tar解完之后会出现多一个文件夹 gcc-4.1.0 gpart options device Options: -b -C c,h,s-c-d-E-e-f -g-h-i-K -k -L -l -n -q-s -t -V-v -W -w DESCRIPTION gpart tries to guess which partitions are on a hard disk. If the primary partition table has been lost, over- written or destroyed the partitions still exist on the disk but the operating system cannot access them. gpart ignores the primary partition table and scans the disk (or disk image, file) sector after sector for sev- eral filesystem/partition types. It does so by asking filesystem recognition modules if they think a given sequence of sectors resembles the beginning of a filesystem or partition type. Currently the following filesystem types are known to gpart (listed by module names): beos BeOS filesystem type. bsddl FreeBSD/NetBSD/386BSD disklabel sub-partitioning scheme used on Intel platforms. ext2 Linux second extended filesystem. fat MS-DOS FAT12/16/32 filesystems. hpfs IBM OS/2 High Performance filesystem. hmlvm Linux LVM physical volumes (LVM by Heinz Mauelshagen). lswap Linux swap partitions (versions 0 and 1). minix The Minix operating system filesystem type. ntfs MS Windows NT/2000 filesystem. qnx4 QNX 4.x filesystem. rfs The Reiser filesystem (version 3.5.X, X 11). s86dl Sun Solaris on Intel platforms uses a sub-partitioning scheme on PC hard disks similar to the BSD diskla- bels. xfs Silicon Graphics journalling filesystem for Linux. More filesystem guessing modules can be added at runtime (see the -t option). Please consult the gpart README file for detailed explanations on how to create guessing modules. All modules are accompanied by a guessing weight factor which denotes how educated their guesses are compared to other modules. This weight can be changed if a certain module keeps on mis-identifying a partition. Naturally only partitions which have been formatted in some way can be recognized. If the type of a partition entry in the primary partition table is changed from x to y while the filesystem is still of type x, gpart will also still guess a type x. No checks are performed whether a found filesystem is clean or even consistent/mountable, so it is quite possible that gpart may identify partitions which existed prior to the current partitioning scheme of the disk. Especially on large disks old file system headers/superblocks may be present a long time until they are finally overwritten with user data. It should be stressed that gpart does a very heuristic job, never believe its output without any plausability checks. It can be easily right in its guesswork but it can also be terribly wrong. You have been warned. After having found a list of possible partition types, the list is checked for consistency. For example, a parti- tion which overlaps with the previous one will be discarded. All remaining partitions are labelled with one of the following attributes: primary, logical, orphaned or invalid. A partition labelled orphaned is a logical partition which seems ok but is missed in the chain of logical par- titions. This may occur if a logical partition is deleted from the extended partition table without overwriting the actual disk space. An invalid partition is one that cannot be accepted because of various reasons. If a consistent primary parti- tion table was created in this process it is printed and can be written to a file or device.EXTENDED PARTITIONS If the disk/file to be examined consists of primary partitions only, gpart has quite a good chance to identify them. Extended partitions on the other hand can result in a lot of problems. Extended partitions are realized as a linked list of extended partition tables, each of which include an entry pointing to a logical partition. The size of an extended partition depends on where the last logical partition ends. This means that extended partitions may include holes, unallocated disk space which should only be assigned to logical, not primary partitions. gpart tries to do its best to check a found chain of logical partitions but there are very many possible points of failure. If good fdisk programs are used to create extended partitions, the resulting tables consist of a zeroed boot record and the four partition entries of which at least two should be marked unused. Unfortunately e.g. the fdisk program shipped with Windows NT does not seem to zero out the boot record area so gpart has to be overly tolerant in recognizing extended partition tables. This tolerance may result in quite stupid guesses.DISK TRANSFERS If you want to investigate hard disks from other systems you should note down the geometry (number of cylinders, heads per cylinder and sectors per head) used for that disk, and tell gpart about this geometry. Investigating disks from machines with a different endianness than the scanning one has not been tested at all, and is currently not recommended.LARGE DISKS gpart relies on the OS reporting the correct disk geometry. Unfortunately sometimes the OS may report a geometry smaller the the actual one (e.g. disks with more than 1024 or 16384 cylinder). gpart checks if guessed partitions extend beyond the disk size and marks those invalid, but may be mistaken in case the disk size is calculated from an incorrect geometry. For instance if a disk with the geometry 1028/255/63 should be scanned, and the OS reports 1024/255/63 gpart should be called like gpart -C 1028,255,63 PRECAUTIONS gpart may be of some help when the primary partition table was lost or destroyed but it can under no circu