Gpart
Encyclopedia
Gpart is a software utility which scans a storage device
, examining the data in order to detect partitions
which may exist but are absent from the disk's partition tables. Gpart was written by Michail Brzitwa of Germany
. The release on the author's website is now older than the releases some distributions are using. It appears that Michail Brzitwa does not actively maintain the code, instead the various distributions (I.E. Fedora
or Debian
) appear to maintain their own versions.
gpart tries to guess partitions from any device that can be partitioned, even a file. If the primary partition table has been lost, overwritten or destroyed the partitions still exist on the media but the operating system cannot access them.
gpart ignores the primary partition table and scans the disk (or disk image file) sector after sector for several filesystem/partition types. It does so by "asking" filesystem recognition modules if they think a given sequence of sectors resembles the beginning of a filesystem or partition type.
Michail Brzitwa,: man page "gpart(8) - Linux man page", January 2001
A list of these modules are listed below. Also modules can be written for future filesystems and used in the detection process.
If you need to recover partitions that are damaged on the only bootable disk in a machine you can use a live CD
such as knoppix
to start the machine and use the utilities from the disk.
It is also good at finding and listing the types, locations, and sizes of inadvertently-deleted partitions, both primary and logical. It gives you the information you need to manually re-create them (using fdisk
, cfdisk
, sfdisk, etc.). The guessed partition table can also be written to a file or (if you firmly believe the guessed table is entirely correct) directly to a disk device.
With some badly damaged devices it is a good idea to use a utility such as ddrescue to make a backup
. Then when you have a copy of the device, use gpart to guess the partitions on the copy. If it is successful, you can try writing them back to the device. You may find that when using ddrescue you get read errors because the device is damaged but if you can get the partitions readable with your copy then you can try using Mount (Unix)
and retrieve the data from the copy.
$ mount -t /path/to/imagefile -o loop,offset= /mnt/loop
This will mount the partition at offset on /mnt/loop so you can recover your data from the file.
To get the partition offset you can use either fdisk
-ul /path/to/imagefile or use the output from gpart.
Look at the sample output at the size line, the last pair of round brackets has the start (16) and then end (3906559).
When specifying the offset, always specify the start.
6GB partition.
Begin scan...
Possible partition(DOS FAT), size(1907mb), offset(0mb)
Possible partition(SGI XFS filesystem), size(5730mb), offset(1907mb)
End scan.
Checking partitions...
Partition(DOS or Windows 95 with 32 bit FAT, LBA): primary
Partition(Linux ext2 filesystem): primary
Ok.
Guessed primary partition table:
Primary partition(1)
type: 012(0x0C)(DOS or Windows 95 with 32 bit FAT, LBA)
size: 1907mb #s(3906544) s(16-3906559)
chs: (0/1/1)-(1023/19/16)d (0/1/1)-(12207/19/16)r
Primary partition(2)
type: 131(0x83)(Linux ext2 filesystem)
size: 5730mb #s(11736000) s(3906560-15642559)
chs: (1023/19/16)-(1023/19/16)d (12208/0/1)-(48882/19/16)r
Primary partition(3)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r
Primary partition(4)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r
Data storage device
thumb|200px|right|A reel-to-reel tape recorder .The magnetic tape is a data storage medium. The recorder is data storage equipment using a portable medium to store the data....
, examining the data in order to detect partitions
Disk partitioning
Disk partitioning is the act of dividing a hard disk drive into multiple logical storage units referred to as partitions, to treat one physical disk drive as if it were multiple disks. Partitions are also termed "slices" for operating systems based on BSD, Solaris or GNU Hurd...
which may exist but are absent from the disk's partition tables. Gpart was written by Michail Brzitwa of Germany
Germany
Germany , officially the Federal Republic of Germany , is a federal parliamentary republic in Europe. The country consists of 16 states while the capital and largest city is Berlin. Germany covers an area of 357,021 km2 and has a largely temperate seasonal climate...
. The release on the author's website is now older than the releases some distributions are using. It appears that Michail Brzitwa does not actively maintain the code, instead the various distributions (I.E. Fedora
Fedora (operating system)
Fedora is a RPM-based, general purpose collection of software, including an operating system based on the Linux kernel, developed by the community-supported Fedora Project and sponsored by Red Hat...
or Debian
Debian
Debian is a computer operating system composed of software packages released as free and open source software primarily under the GNU General Public License along with other free software licenses. Debian GNU/Linux, which includes the GNU OS tools and Linux kernel, is a popular and influential...
) appear to maintain their own versions.
gpart tries to guess partitions from any device that can be partitioned, even a file. If the primary partition table has been lost, overwritten or destroyed the partitions still exist on the media but the operating system cannot access them.
gpart ignores the primary partition table and scans the disk (or disk image file) sector after sector for several filesystem/partition types. It does so by "asking" filesystem recognition modules if they think a given sequence of sectors resembles the beginning of a filesystem or partition type.
Michail Brzitwa,: man page "gpart(8) - Linux man page", January 2001
A list of these modules are listed below. Also modules can be written for future filesystems and used in the detection process.
If you need to recover partitions that are damaged on the only bootable disk in a machine you can use a live CD
Live CD
A live CD, live DVD, or live disc is a CD or DVD containing a bootable computer operating system. Live CDs are unique in that they have the ability to run a complete, modern operating system on a computer lacking mutable secondary storage, such as a hard disk drive...
such as knoppix
Knoppix
Knoppix, or KNOPPIX , is an operating system based on Debian designed to be run directly from a CD / DVD or a USB key , one of the first of its kind for any operating system. Knoppix was developed by Linux consultant Klaus Knopper. When starting a program, it is loaded from the removable medium...
to start the machine and use the utilities from the disk.
It is also good at finding and listing the types, locations, and sizes of inadvertently-deleted partitions, both primary and logical. It gives you the information you need to manually re-create them (using fdisk
Fdisk
On personal computer operating systems, fdisk is a commonly used name for a command-line utility that provides disk partitioning functions...
, cfdisk
Cfdisk
cfdisk is a Linux partition editor, similar to fdisk, but with a different user interface . It is part of the util-linux package of Linux utility programs.Originally written in 1992, the current version is 2.12r....
, sfdisk, etc.). The guessed partition table can also be written to a file or (if you firmly believe the guessed table is entirely correct) directly to a disk device.
With some badly damaged devices it is a good idea to use a utility such as ddrescue to make a backup
Backup
In information technology, a backup or the process of backing up is making copies of data which may be used to restore the original after a data loss event. The verb form is back up in two words, whereas the noun is backup....
. Then when you have a copy of the device, use gpart to guess the partitions on the copy. If it is successful, you can try writing them back to the device. You may find that when using ddrescue you get read errors because the device is damaged but if you can get the partitions readable with your copy then you can try using Mount (Unix)
Mount (Unix)
The Unix command line utility mount instructs the operating system that a file system is ready to use, and associates it with a particular point in the system's file system hierarchy . The counterpart umount instructs the operating system that the file system should be disassociated from its mount...
and retrieve the data from the copy.
$ mount -t
This will mount the partition at offset
To get the partition offset you can use either fdisk
Fdisk
On personal computer operating systems, fdisk is a commonly used name for a command-line utility that provides disk partitioning functions...
-ul /path/to/imagefile or use the output from gpart.
Look at the sample output at the size line, the last pair of round brackets has the start (16) and then end (3906559).
When specifying the offset, always specify the start.
Sample output
This is sample output from a scan of an 8GB flash memory stick with two partitions, one vfat 2GB partition and one xfsXFS
XFS is a high-performance journaling file system created by Silicon Graphics, Inc. It is the default file system in IRIX releases 5.3 and onwards and later ported to the Linux kernel. XFS is particularly proficient at parallel IO due to its allocation group based design...
6GB partition.
Begin scan...
Possible partition(DOS FAT), size(1907mb), offset(0mb)
Possible partition(SGI XFS filesystem), size(5730mb), offset(1907mb)
End scan.
Checking partitions...
Partition(DOS or Windows 95 with 32 bit FAT, LBA): primary
Partition(Linux ext2 filesystem): primary
Ok.
Guessed primary partition table:
Primary partition(1)
type: 012(0x0C)(DOS or Windows 95 with 32 bit FAT, LBA)
size: 1907mb #s(3906544) s(16-3906559)
chs: (0/1/1)-(1023/19/16)d (0/1/1)-(12207/19/16)r
Primary partition(2)
type: 131(0x83)(Linux ext2 filesystem)
size: 5730mb #s(11736000) s(3906560-15642559)
chs: (1023/19/16)-(1023/19/16)d (12208/0/1)-(48882/19/16)r
Primary partition(3)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r
Primary partition(4)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r
Partition types
Supported (guessable) filesystem or partition types:- BeOS filesystem type.
- FreeBSD/NetBSD/386BSD disklabel sub-partitioning scheme used on Intel platforms.
- IBM OS/2 High Performance filesystem.
- Linux ext2 (second extended filesystem).
- Linux LVM physical volumes (LVM by Heinz Mauelshagen).
- Linux swap partitions (versions 0 and 1).
- The Minix operating system filesystem type.
- MS-DOS FAT12/16/32 "filesystems".
- MS Windows NT/2000 filesystem.
- The Reiser filesystem (version 3.5.X, X > 11).
- Silicon Graphics' journaling file systemJournaling file systemA journaling file system is a file system that keeps track of the changes that will be made in a journal before committing them to the main file system...
for Linux. - Sun Solaris on Intel platforms uses a sub-partitioning scheme on PC hard disks similar to the BSD disklabels.
- Other types may be added relatively easily, as separately compiled modules.
- QNX 4.x filesystem.
See also
- TestDiskTestDiskTestDisk is a free data recovery utility. It was primarily designed to help recover lost data storage partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error .TestDisk can be used to collect detailed...
– another partition recovery tool - fdiskFdiskOn personal computer operating systems, fdisk is a commonly used name for a command-line utility that provides disk partitioning functions...
, cfdiskCfdiskcfdisk is a Linux partition editor, similar to fdisk, but with a different user interface . It is part of the util-linux package of Linux utility programs.Originally written in 1992, the current version is 2.12r....
, gpartedGPartedGParted is a GTK+ front-end to GNU Parted and the official GNOME Partition Editor application.It is used for creating, deleting, resizing, moving, checking and copying partitions, and the file systems on them...
- partition editors - KnoppixKnoppixKnoppix, or KNOPPIX , is an operating system based on Debian designed to be run directly from a CD / DVD or a USB key , one of the first of its kind for any operating system. Knoppix was developed by Linux consultant Klaus Knopper. When starting a program, it is loaded from the removable medium...
External links
- http://www.brzitwa.de/mb/gpart/
- http://linux.die.net/man/8/gpart
- http://www.linux.com/feature/57748