Extended partition

English Install/Boot/Login
1

Hi,
I tried to install opensuse 11. KDE 4.0 to my leptop.

It finished the installition. And i tried to open suse. It wasnt work.
After i took the installition dvd and mixed something in options .

I couldnt work, then i installed KDE 3.5 (with delete old) .

But now my D: partition has lost. D: was my store (backup). I had family photos and documents…

I am sure i didnt delete or format D: .

C: is working. C: and D: were in same harddisk.

Also i have windows and I cant see from windows.

I installed recovery program. And i saw my D: partitions as a “Extended”.

Recovery program couldnt recovery any file.

How can i change my file system from Extended to ntfs (or redeemable mode) ?

Or how can i get my files from D: ?

2

I am afraid that the partition that you call D (I suppose because that is its name as windows is running) is overwritten. When it is now ‘extended’ it means that it holds other partitions. Those other partitions most probably are used by the installation of openSUSE.

Now before you are getting very angry think about on who you will be very angry. It is told time and again on Forums and many other places. to take backups before you are going to tinker with partitions and also before you are going to do system installations of ay kind (Windows, Linux, whatever).

For a verification of how your situation is now please post the output of

sudo fdisk -l

here (please surround it with CODE tags, or the # in the toolbar).

3

It’s possible your partition is still there, but in a different location. It may be a “logical” partition inside the “extended” primary partition. As Henk suggested, post back the fdisk and we will know what partitions are really on the disk.

Or go in Windows to Computer Management, Disk Management. You will see a partition listing and below that a graphical image of the disk. You can take screen captures of those windows and post that back here, too.

4

Sorry for Turkish. I hope you understand.
This is from Windows. I will post results after 5minute from Linux.

http://img155.imageshack.us/img155/9130/adszcq9.jpg

5

Sorry, i wrote to consol and i get “command not found”

what’s wrong?

Thank you.

6

sudo fdisk -l the l is as in (list) not a one (1), likely the problem.

7

I tried to edit, i couldnt. Sorry, my mistake.

Here

http://img149.imageshack.us/img149/4007/balksz1ta5.jpg

8

Do you or did you have os/2 on your computer ?
If answer is NO , did you install os/2 boot manager ? if no, from Suse console

dd if=/dev/hd4 of=sda4vbr bs=512 count=1

post /home/sda4vbr ,created from command above.

Do you remember the partition layout befor installing linux ?

9

Hello Hasan,

From your fdisk -l we see:

sda1. this is the Compaq diagnostics, typical for a Commpaq system. You can enter that when you interrupt the boot with a special key, I suppose you have at least seen that and maybe used it. One should leave that as it is

sda2. This is most probably the A partition from your Windows.

sda4. This comes next. This is a bit strange but it can be done (I do not recommend it) and it is done. Cannot tell you why. But lostfarmer may be righht that is done by an OS/2 installation. Can not tell you what it contains now, but it still seems the place where you boot from (see the * in the second column), so it may indeed still contain an OS/2 bootmanager. When you want more info onwhat it is, follow the advice from lostfarmer, but I think is statement must be altered a llittle bit to:

sudo dd if=/dev/sda4 of=sda4vbr bs=512 count=1

is does copy the boot record from that disk to a file in your working directory (this need not be in /home/ as he states). You could then post its contents (but I do not know what sort of listing, please **lostfarmer **can you elaborate on this, cat or od??).

sda3. This is now the Extended partition. I do not know if you know what an Extended partition is, so I will try to explain. In MS-DOS like systems (that includes windows) there may only be 4 partitions in the partition table. In order to have more, one of those partitions can be an Extended partition. This will hold the space for the information needed to create more, so called ‘logical’, partitions (numbered from 5 upwards even if 4 is not reached yet) and the space of those logical partitions. With this trick the ban on 4 partitions max is lifted.
In this case sda3 contains all space on the disk after sda4. In this space sda5, sda6 and sda7 are created.
Now you told us that originaly this sda3 contained your windows D partition. The very fact that the administration in sda3 (about sda5-7) is written in sda3 is already enough to destroy the windows filesystm that was on it. And …

sda5, sda6 and sda7. These are your openSUSE swap, / and /home. The fact that you say that your finished the openSUSE installation means that not only these file systems are created (writing administration blocks all over its space), but also that many files are written into it. So I am pretty sure that all the information originaly written to D is either overwritten or unreacheble now. Only forensics may save something, but that is very costly and only done by special companies.

This is very sad for you :frowning:

You say you did not let D to be destroyed or reformatted. I am afraid you did. May be the fact that sda4 comes before sda3 made you (or even the partitioner) make a mistake here.

Now for the future.
I still hope you have some backup somewhere. You must have catered for a malfunctioning disk (a broken disk can happen at every moment in time)!!.
What would I do in your case. I would try to get rid of the OS/2 boot partition. That may mean to see that sda2 is the real boot partition for booting windows. When windows boots normaly without the OS/2 boot manager you could delete sda3-7 and create a new sda3 for a new D with the size you need (and restore D as good as possible). Check again if you have a proper running windows with C and D.

Then you could try a new openSUSE install. This install should then propose to you to make an extended sda4 and create sda5 (swap), sda6 (/) and sdf7 (/home). When not either see that you make it like this using expert mode, or post here for help.

Wishing you succes,

10

hcvv-

(but I do not know what sort of listing, please lostfarmer can you elaborate on this, cat or od??).
I can not, but please go to Unable to boot Windows XP “HAL.DLL not found” - Page 3 - openSUSE Forums post #22 by mingus725 and look at post #23. one other command was used (xxd sda2pbr) but I have no idea what it does, I only get error.

In mepis the dd command always has put the file in /home for me, but that could be where console opens up and have not use CD to any other directory.

I hope for TurkVolki is for some reason the NTFS partition was changed to os/2 in the MPT or added to the partition.

11

All is not quite lost yet. That partition is labeled as “OS/2 Boot Manager” only because of a 1 byte field in the partition table at offset 0x01C2. Windows uses this field to determine the file system on the partition. A formatted OS/2 partition will have the value 0a - which is what you see - but an installable OS/2 partition will have the value 07, which is the same value as NTFS. So if the 07 gets changed to 0a, Windows (and possibly linux - we shall know in a minute) may think the partition is different than what it really is.

@TurkVolki - I suggest that we look at the partition table in the MBR and also the partition boot sector in sda4. The data may still be there and we may be able to at least get the data off the partition, maybe if we’re lucky we can modify the table and make it readable again as it was before.

I am going to give you several commands. These need need to be done as root in a terminal window. The dd command will copy the sectors, the xxd command will do a hex dump of the copy.

I must emphasize that the dd command must be done precisely. If you make a typo mistake, you could destroy something permanently. (Also note the dash/minus sign after the su; that will put you and the files in the /root subdirectory.)


su -
dd if=/dev/sda of=sdambr bs=512 count=1
xxd sdambr

dd if=/dev/sda4 of=sda4pbr bs=512 count=1
xxd sda4pbr

Now let’s try one way to look at the contents of sda4. Remember everything is case sensitive. Be precise!

mkdir /mnt/windows-d
mount -t ntfs-3g /dev/sda4 /mnt/windows-d
ls /mnt/windows-d
12

When I understand lostfarmer he thinks that maybe sda4 still has the data of Windows D and that only the partition info is wrong. Well it is big enough. But how do we check this and how do we repair this? Do not forget it seems to be the boot partition (isn’t that called the active partition in windows?).

dd does not put a file ‘always in /home’. It is a *NIX tool like all others and it interpretes filenames as all other do. And you define files either relative or absolute. As your sda4vbr does not start with a / it is relative. Relative to the working directory. And as no other directories are mentioned here, it is just in the working directory. That is very basic. I may be harsh, but these are things you should know before you even try to run a CLI command as root.

The dd mentioned of course copies the first block (512 bytes) of the device (/dev/sda4 and NOT /dev/hd4) to a file (which could have every name but it is here called sda4vbr). Then lostfarmer said: post it. Now this is about bootinfo, so rather binary I think. How do I post a binary file in a way that lostfarmer can tell us what is wrong or right with it?
Now lostfarmer mentionesxdd. Well do man xxd and it tells you that it makes a hex dump. That makes it readable. But, lostfarmer, you asked for it, do you know how to interprete this?

EDIT: I just read Mingus725s’ post. Please TurkVolki forget what we told you and follow Mingus725s’ advise. IMHO this way you might get your data back!

13

But how do we check this and how do we repair this? Do not forget it seems to be the boot partition (isn’t that called the active partition in windows?). . . . How do I post a binary file in a way that can tell us what is wrong or right with it? . . . do you know how to interprete this?

Yes, I do. xxd will give us a hex dump; we just read that. I am almost certain we will see 0a in the sda4 system-ID field in the table. If in fact the partition is NTFS, changing the system-id in a hex editor to 07 will make it readable. Why the boot flag has been set for sda4 is anyone’s guess, but since the system-ID has already been erroneously changed, it’s entirely feasible that there was another error with it (i.e., the boot flag). It is trivial to change the boot flag; but we do need to be sure which partition is now the “system volume” (where the boot files are). It is also possible that grub stage1 is in the MBR which means that the boot flag is not used at all. Again, we’ll see from the dumps. But this does remind me . . .

@TurkVolki -

Please also do the following, as root in a terminal as above:

su -
dd if=/dev/sda2 of=sda2pbr bs=512 count=1
xxd sda2pbr
14

I wasn’t care for OS/2 on starting options. I was thinking it is as a failsafe or debug mod (i thought it come with Linux). Now i dont have an idea how it come, but i think it setted up on my D partition (sda4) .

Here the snapshots. I repeated the codes. That why mkdir /mnt/windows-d comments gave “already have” error.
This snaps shows sda4 readable ?

http://img511.imageshack.us/img511/1561/53727573td7.jpg
http://img444.imageshack.us/img444/4504/27040634ka4.jpg
http://img183.imageshack.us/img183/8392/30887720lv5.jpg

hcvv thank you for your explaining and post. And also thank you LostFarmer and mingus725.

I am looking forward your post.

15

I need to ask a few questions before making any changes . . .

What version of Windows do you have? Have you ever had Windows 2000 on this machine? Do you know why your “C” drive is FAT32 instead of NTFS?

When you boot the machine now, are you able to boot into openSUSE OK? And are you booting into Windows from the openSUSE menu?

Which version of KDE did you install, 3.5 or 4.0?

We are going to use a hex editor to change the partition table. Look at the “sdambr” figure you posted, down on the last line, 00001f0: Look at the 3rd byte, it is “0a”. We are going to change that to “07”. Then we are going to copy the sector you just changed back into the MBR. Understand? If this is OK, post back above answers and we’ll do it.

16

The MBR partition table is wrong for sda4, as we suspected. Look at the third byte on the last line of sdambr. It is 0a but if the partition is NTFS it should be 07. We can fix this one of two ways:

I can give you instructions here and you can change it yourself. Or you can email the file to me and I will do it for you, then send it back. The benefit of you doing it is the data stays on your machine; the downside is that you have never done this before. The benefit of sending it to me is that it will be done right for sure; the downside is that bits can get corrupted across the internet and if the file we exchange gets damaged, that could be very bad.

I need to emphasize something. Changing the “system-id” does not guarantee this will work; there could be another problem somewhere else (although I don’t see any now). Doing this kind of thing is dangerous under any circumstances.

Either way, I need to know if you are booting into openSUSE OK, what version of openSUSE you have, and what version of KDE you have. I also need to know your version of Windows.

I also need you to be absolutely, positively, without question sure that the “D” partition was NTFS and not FAT32. Your “C” partition is FAT32. It’s fine for one to be FAT32 and the other to be NTFS; but we can’t make a mistake about this.

So . . . what do you want to do?

17

mingus725 if you look at sda4pbr , there is no Disk Parameter Block data. It only has GRUB stage 1 boot code. Just changing the system(partition)-id in the MBR will not work. I could be wrong, so like your comment.

If the partition should be fat32, could look at sector 6 to see if the backup Volume Boot Record is good. If it should be NTFS then I do not know where its back up is.

18

Well, @TurkVolki sure owes you a tall cool one. :wink:

And I’ve got to slow myself down, juggling too many threads and being liable to missing something - like I did here :frowning:

It’s worse than you posted. Not only is the Bios Partition Block not there - which is only moderately difficult to rebuild - but neither is the Extended BPB, and that’s nearly impossible to rebuild by hand. Look at line 30 - the first 8 bytes identify the location of the MFT by its logical cluster number, and the following 21 bytes are MFT characteristics. Of course, without a valid MFT, there is no file system - period. Within these bytes there is an address for a mirrored copy of the MFT, but without the Record Clusters and Index Buffer Clusters values, the MFT can’t be read. So that leaves . . . in NTFS, the backup sector is at the end of the partition. Testdisk can restore the sector from the backup. Fixboot from the XP Recovery Console or Vista Recovery Environment AFAIK actually rebuilds the sector, not just restores it.

I’m pretty sure this is not a FAT32 partition, because at offset 0x32 (3rd byte line 30) the value is 005a and it should be 0600 - which points to the location of the backup sector.

19

@TurkVolki -

Probably the data @LostFarmer and I are discussing above sounds like gibberish to you. Rightly so. Here is the bottom line: Somehow you instructed the grub boot loader to be installed to the sda4 partition boot sector, and in the process of doing so, it wrote over data required for NTFS to work. Without a valid NTFS boot sector, you can’t recover the data (short of using a forensics recovery, which is very expensive).

So you have 2 problems, a bad sda4 boot sector and an error in the MBR partition table. The wife is calling me to dinner (and I am already late), so hold on and later this evening I’ll look into all your options. For now, go to YaST Software Management and install Testdisk and photorec packages.

20

@TurkVolki - as posted by mingus725it does not look good but it’s not all lost yet.

If it is a fat32 partition the needed bios parameter block back up should be at sector #6 so run/post

su -
dd if=/dev/sda2 of=sda2pbrb bs=512 count=1 skip 6
xxd sda2pbrb

just to let you know of=sda2pbrb is just a hand pick file name.

if it is NTFS the back up copy would be the last sector #18346230 (same as the number of sectors listed it the master partition table ,sdmabr, I hope could be 1 off)

su -
dd if=/dev/sda2 of=sda2lasts bs=512 count=1 skip 18346230
xxd sda2lasts

with the above outputs we should be able to determine if salvage is possible.

@-mingus725-- its very easy to miss things or post with typos, that’s why there are more then 1 helper.