please help! messed up boot sector /dev/sda

[ipfreak]

hi all:

i was trying to use dd utility copy something to usb drive but accidentally copy the file to /dev/sda (since i don’t know which device should be for usb drive under opensuse linux). now i can’t boot the machine but i need to recover something important on /home (it is on different slice/partition).

how could i recover it? boot it from dvd?

thanks

_dave

[gogalthorp]

Boot to a live DVD or if you have the full DVD boot to rescue mode. Mount the partition that is home and backup the files you need.

Unless you wiped the whole disk (you can with DD command) In which case you may have nothing left. If it was just a file and you copied it to a device not a partition then just the first partition and maybe the MBR is messed unless you have an EFI boot. You can reinstall and correct this and NOT format the home partition. But you still should back the data just in case.

As to which device a drive shows up at I find the best way is to use the fdisk -l command to list the drives it usually is pretty obvious what is what

As you can see detailed instructions is hard since we don’t know the details of what you have and how it was originally setup

[robin_listas]

On 2014-07-27 02:56, gogalthorp wrote:
>
> Boot to a live DVD or if you have the full DVD boot to rescue mode.

I would not boot at all… if the system is still running after the “mishap”, the partition table data could still be found in memory, perhaps.
Till the kernel re-reads it, at least.

> Mount the partition that is home and backup the files you need.
>
> Unless you wiped the whole disk (you can with DD command) In which case
> you may have nothing left.

I guess he erased the entire boot sector and partition table of sda, the main system disk.

> As you can see detailed instructions is hard since we don’t know the
> details of what you have and how it was originally setup

We could start with getting:

fdisk -l /dev/sda
gdisk -l /dev/sda
lsblk --output NAME,KNAME,SIZE,TYPE,MOUNTPOINT,LABEL,UUID,PARTLABEL,PARTUUID,SIZE

And very important, dave, please use code tags for pasting all that. Use the ‘#’ button in the forum editor - for command outputs and listings
See how

If what is messed up is indeed the boot sector, which includes the partition table (traditional, not GPT), then you can use “gpart” to guess the partition layout.

–
Cheers / Saludos,

Carlos E. R.

(from 13.1 x86_64 “Bottle” (Minas Tirith))

[mrmazda]

On 2014-07-26 27:08 (GMT+0200) Carlos E. R. composed:

> If what is messed up is indeed the boot sector, which includes the partition table
>(traditional, not GPT), then you can use “gpart” to guess the partition layout.

Guessing can mean loss of data. The partitioner I use (Dfsee) can find all
partition boot sectors (that haven’t been overwritten by use of dd), which
lets its user confirm whichever apply to his real partitions, then recreate
them for access on next boot. Since I’ve never needed to use gpart, and have
only ever lost the content of whole disks with dd dumbness, I don’t know
whether it offers that level of smarts. This kind of rescue involving
important data is not for the timid or naive. If in any doubt, ask again if
necessary!

The wise are known for their understanding, and pleasant
words are persuasive.

Team OS/2 ** Reg. Linux User #211409 ** a11y rocks!

Felix Miata *** http://fm.no-ip.com/

[robin_listas]

On 2014-07-27 04:57, Felix Miata wrote:
> On 2014-07-26 27:08 (GMT+0200) Carlos E. R. composed:
>
>> If what is messed up is indeed the boot sector, which includes the
>> partition table
>> (traditional, not GPT), then you can use “gpart” to guess the
>> partition layout.
>
> Guessing can mean loss of data.

gpart does a good job at guessing, I have used it. You have to read the
manual and decide the options to use. IIRC, it just prints a table on
the terminal and then you create that partition table with your tools,
if you wish. Or it does it for you, perhaps.

–
Cheers / Saludos,

Carlos E. R.

(from 13.1 x86_64 “Bottle” (Minas Tirith))

[ipfreak]

@gogalthorp

Boot to a live DVD or if you have the full DVD boot to rescue mode. Mount the partition that is home and backup the files you need.

Unless you wiped the whole disk (you can with DD command) In which case you may have nothing left. If it was just a file and you copied it to a device not a partition then just the first partition and maybe the MBR is messed unless you have an EFI boot. You can reinstall and correct this and NOT format the home partition. But you still should back the data just in case.

As to which device a drive shows up at I find the best way is to use the fdisk -l command to list the drives it usually is pretty obvious what is what

As you can see detailed instructions is hard since we don’t know the details of what you have and how it was originally setup

thanks for help.

well, i partitioned the hard drive into four slices: /, swap, /usr, and /home on /dev/sda (hard drive). here was what i did:

dd if=software of=/dev/sda bs=64k conv=sync

i think that must have ruined the whole drive, not just boot sector?

[ipfreak]

@robin_listas

On 2014-07-27 02:56, gogalthorp wrote:
>
> Boot to a live DVD or if you have the full DVD boot to rescue mode.

I would not boot at all… if the system is still running after the “mishap”, the partition table data could still be found in memory, perhaps.
Till the kernel re-reads it, at least.

> Mount the partition that is home and backup the files you need.
>
> Unless you wiped the whole disk (you can with DD command) In which case
> you may have nothing left.

I guess he erased the entire boot sector and partition table of sda, the main system disk.

> As you can see detailed instructions is hard since we don’t know the
> details of what you have and how it was originally setup

We could start with getting:

fdisk -l /dev/sda
gdisk -l /dev/sda
lsblk --output NAME,KNAME,SIZE,TYPE,MOUNTPOINT,LABEL,UUID,PARTLABEL,PARTUUID,SIZE

And very important, dave, please use code tags for pasting all that. Use the ‘#’ button in the forum editor - for command outputs and listings
See how

If what is messed up is indeed the boot sector, which includes the partition table (traditional, not GPT), then you can use “gpart” to guess the partition layout.

–
Cheers / Saludos,

Carlos E. R.

(from 13.1 x86_64 “Bottle” (Minas Tirith))

thanks for help!

1. unfortunately, i didn’t realized that mistake until i rebooted the machine.

2. could you elaborate the statement of “Use the ‘#’ button in the forum editor” a bit more? right now, i am using another machine to access the forum. in general, i am quite comfortable with cli operations.

[ipfreak]

@robin_listas

On 2014-07-27 04:57, Felix Miata wrote:
> On 2014-07-26 27:08 (GMT+0200) Carlos E. R. composed:
>
>> If what is messed up is indeed the boot sector, which includes the
>> partition table
>> (traditional, not GPT), then you can use “gpart” to guess the
>> partition layout.
>
> Guessing can mean loss of data.

gpart does a good job at guessing, I have used it. You have to read the
manual and decide the options to use. IIRC, it just prints a table on
the terminal and then you create that partition table with your tools,
if you wish. Or it does it for you, perhaps.

–
Cheers / Saludos,

Carlos E. R.

(from 13.1 x86_64 “Bottle” (Minas Tirith))

thanks flix:

yes i know which slice i want to access “/dev/sda3” but i am not sure i am able to savage anything at this moment (not start anything yet until at least i am a bit more understanding).

[gogalthorp]

You probably wiped the partition table so the disk will not know where the partitions were located. If the file was big then it probably wiped the first partition at least.

So you will first have to find the partitions and make a partition table

This looks like a nice tutorial and explains what I’d try

http://www.dedoimedo.com/computers/linux-data-recovery.html

[robin_listas]

On 2014-07-27 18:46, ipfreak wrote:

> 2) could you elaborate the statement of “Use the ‘#’ button in the forum
> editor” a bit more?

Did you see the photo?

We simply ask that you use that button to post computer text here, such
as the response of those commands.

–
Cheers / Saludos,

Carlos E. R.

(from 13.1 x86_64 “Bottle” (Minas Tirith))

[robin_listas]

On 2014-07-27 18:26, ipfreak wrote:

> well, i partitioned the hard drive into four slices: /, swap, /usr, and
> /home on /dev/sda (hard drive). here was what i did:
>
> dd if=software of=/dev/sda bs=64k conv=sync
>
> i think that must have ruined the whole drive, not just boot sector?

It has ruined the same size as that ‘software’ file has.

*** We still need the output of those commands. ***

I’d just hazzard the guess that sda1 is lost, and the others probably
recoverable, just by using “gpart”. Read the manual first.

You will need a rescue system - use the XFCE rescue image from the
openSUSE site on a USB stick.

Thinking again… try “testdisk” first, it is more modern and automatic.
If sda1 can’t be recovered, you might get some files using photorec.
Being the root partition, you would just need to reinstall.

–
Cheers / Saludos,

Carlos E. R.

(from 13.1 x86_64 “Bottle” (Minas Tirith))

[ipfreak]

@robin_listas

On 2014-07-27 18:26, ipfreak wrote:

> well, i partitioned the hard drive into four slices: /, swap, /usr, and
> /home on /dev/sda (hard drive). here was what i did:
>
> dd if=software of=/dev/sda bs=64k conv=sync
>
> i think that must have ruined the whole drive, not just boot sector?

It has ruined the same size as that ‘software’ file has.

*** We still need the output of those commands. ***

I’d just hazzard the guess that sda1 is lost, and the others probably
recoverable, just by using “gpart”. Read the manual first.

You will need a rescue system - use the XFCE rescue image from the
openSUSE site on a USB stick.

Thinking again… try “testdisk” first, it is more modern and automatic.
If sda1 can’t be recovered, you might get some files using photorec.
Being the root partition, you would just need to reinstall.

–
Cheers / Saludos,

Carlos E. R.

(from 13.1 x86_64 “Bottle” (Minas Tirith))

thanks, robin:

ok, i used full installation dvd and booted into rescue mode and here is what i got (can’t copy it, just literally typed every letter down):

Rescue login: root
Rescue:~# 
Rescue:~# which fdisk
/sbin/fdisk
Rescue:~# which gdisk
Rescue:~#
Rescue:~# fdisk -l /dev/sda

Disk /dev/sda: 100.0GB, 100030242816 bytes, 19537568
Unites = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical):512 bytes / 512 bytes
Disklable: dos
Disk identifier: 0x90909090

   Device       Boot      start      End       Block     Id      System
/dev/sad4          *          0    49999       25000     a5     FreeBSD
Rescue:~#
Rescue:~# lsblk --output NAME,KNAME,TYPE,MOUNTPOINT,LABEL,UUID,PARTLABEL,PARTUUID,SIZE
NAME    KNAME    TYPE   MOUNTPOINT       LABEL                                   UUID                                    PARTLABEL     PARTUUID    SIZE
sda       sda         disk                                                                                                                                                       93.G
|_sda4  sda4        part                                                                                                                                                    24.4M
sr0       sr0          rom                              openSUSE-13.1-DVD-i5860091  2013-11-06-20-12-49-00                                             4.1G
loop0    loop0       loop    /parts/mp_0000                                                                                                                            34.4M
loop1    loop1       loop    /parts/mp_0001                                                                                                                            20.1M
loop2    loop2       loop    /mounts/mp_0000                                                                                                                         47.1M
loop3    loop3       loop    /mounts/mp_0001                                                                                                                         18.9M
loop4    loop4       loop    /mounts/mp_0002                                                                                                                          4.1M

you can see it doesn’t have gdisk utility. i just downloaded “openSUSE-13.1-Rescue-CD-i686.iso”, assume that is what you called “XFCE rescue image”.

thanks.

_dave

[ipfreak]

@robin_listas

On 2014-07-27 18:26, ipfreak wrote:

> well, i partitioned the hard drive into four slices: /, swap, /usr, and
> /home on /dev/sda (hard drive). here was what i did:
>
> dd if=software of=/dev/sda bs=64k conv=sync
>
> i think that must have ruined the whole drive, not just boot sector?

It has ruined the same size as that ‘software’ file has.

*** We still need the output of those commands. ***

I’d just hazzard the guess that sda1 is lost, and the others probably
recoverable, just by using “gpart”. Read the manual first.

You will need a rescue system - use the XFCE rescue image from the
openSUSE site on a USB stick.

Thinking again… try “testdisk” first, it is more modern and automatic.
If sda1 can’t be recovered, you might get some files using photorec.
Being the root partition, you would just need to reinstall.

–
Cheers / Saludos,

Carlos E. R.

(from 13.1 x86_64 “Bottle” (Minas Tirith))

ok, finally i used knoppix and got what you need:

root@Microknoppix:/home/knoppix# gdisk -l /dev/sda
GPT fdisk (gdisk) version 0.8.5

Partition table scan:
  MBR: MBR only
  BSD: present
  APM: not present
  GPT: not present


***************************************************************
Found invalid GPT and valid MBR; converting MBR to GPT format.
***************************************************************

Warning! Main partition table overlaps the first partition by 34 blocks!
You will need to delete this partition or resize it in another utility.
Disk /dev/sda: 195371568 sectors, 93.2 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 39CD0480-9C14-4FBD-AFA6-CF5FBC92306D
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 195371534
Partitions will be aligned on 2048-sector boundaries
Total free space is 195321535 sectors (93.1 GiB)

Number  Start (sector)    End (sector)  Size       Code  Name

what next? mount the hard drive? which slice?

[goro_goren]

‘pal’(thus between qm)…

’ SLICE ’ is in the BSD’world partitionin…

on Penguin is partition!

[ipfreak]

@goro_goren

‘pal’(thus between qm)…

’ SLICE ’ is in the BSD’world partitionin…

on Penguin is partition!

sorry, i meant “which partition”. as the bsd, i was using dd to make usb boot drive for junos olive and it went tragically wrong…

[gogalthorp]

Ok this seems to be a GPT partitioned drive. SO… Things are different

I’d try testdisk to see if it can recoveranything

[robin_listas]

On 2014-07-28 21:26, ipfreak wrote:

> thanks, robin:
>
> ok, i used full installation dvd and booted into rescue mode and here is
> what i got (can’t copy it, just literally typed every letter down):

No, the installation dvd, rescue option, is not the same as the 13.1
xfce rescue system.

> you can see it doesn’t have gdisk utility.

I know it does not.

> i just downloaded
> “openSUSE-13.1-Rescue-CD-i686.iso”, assume that is what you called “XFCE
> rescue image”.

Yes, that’s the one.

–
Cheers / Saludos,

Carlos E. R.

(from 13.1 x86_64 “Bottle” (Minas Tirith))

[ipfreak]

@robin_listas

On 2014-07-28 21:26, ipfreak wrote:

> thanks, robin:
>
> ok, i used full installation dvd and booted into rescue mode and here is
> what i got (can’t copy it, just literally typed every letter down):

No, the installation dvd, rescue option, is not the same as the 13.1
xfce rescue system.

> you can see it doesn’t have gdisk utility.

I know it does not.

> i just downloaded
> “openSUSE-13.1-Rescue-CD-i686.iso”, assume that is what you called “XFCE
> rescue image”.

Yes, that’s the one.

–
Cheers / Saludos,

Carlos E. R.

(from 13.1 x86_64 “Bottle” (Minas Tirith))

thanks, carlos:

here is what i have now:

root@Microknoppix:/home/knoppix# gdisk -l /dev/sda
GPT fdisk (gdisk) version 0.8.5

Partition table scan:
  MBR: MBR only
  BSD: present
  APM: not present
  GPT: not present


***************************************************************
Found invalid GPT and valid MBR; converting MBR to GPT format.
***************************************************************

Warning! Main partition table overlaps the first partition by 34 blocks!
You will need to delete this partition or resize it in another utility.
Disk /dev/sda: 195371568 sectors, 93.2 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 39CD0480-9C14-4FBD-AFA6-CF5FBC92306D
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 195371534
Partitions will be aligned on 2048-sector boundaries
Total free space is 195321535 sectors (93.1 GiB)

Number  Start (sector)    End (sector)  Size       Code  Name


TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 100 GB / 93 GiB - CHS 12161 255 63
     Partition               Start        End    Size in sectors
>D Linux                    0  32 33  3915 253 50   62908416
 D Linux                 3915 253 51  4176 242 34    4192256
 D Linux Swap            4176 242 35  4698 252 34    8386560
 D Linux                 4698 252 35  6004   6 18   20965376
 D Linux                 6004   6 19 12161  72  7   98916352







Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type,
     Enter: to continue
btrfs blocksize=4096 Backup superblock, 32 GB / 29 GiB

i had 4 partitions: /, swap, /usr and /home. i just need to access /home and copy what i need to another machine.

what would be next step?

thanks for help.

[gogalthorp]

Since the partition table is wiped as was suspected you need to use testdisk or other scan program to see if you can locate the partition boundaries. Then you maybe can recover files

[ipfreak]

@gogalthorp

Since the partition table is wiped as was suspected you need to use testdisk or other scan program to see if you can locate the partition boundaries. Then you maybe can recover files

thanks. actually the output of “testdrive” was in last post. here is the point i got but don’t know what next step should be:

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 100 GB / 93 GiB - CHS 12161 255 63
     Partition               Start        End    Size in sectors
>D Linux                    0  32 33  3915 253 50   62908416
 D Linux                 3915 253 51  4176 242 34    4192256
 D Linux Swap            4176 242 35  4698 252 34    8386560
 D Linux                 4698 252 35  6004   6 18   20965376
 D Linux                 6004   6 19 12161  72  7   98916352




Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type,
     Enter: to continue
btrfs blocksize=4096 Backup superblock, 32 GB / 29 GiB