[Solved] Corrupt partition table - HELP

[SwooshingRob]

The partition table on my computer has been successfully destroyed by Windows.
I've got a dual boot system, with Gentoo and Windows XP on separate logical partitions inside one extended partition. I also had some free space inside the said extended partition.
From within Windows, I created a new partition in the free space, using FAT32. As soon as the formatting started my PC took a nice dive and popped up the blue screen of death for about a second followed by rebooting.

Upon reboot, all partitions inside the extended partition are gone!

Luckily enough, I wrote down the block information a while ago, so I know where these partitions should be, but I don't really know how to recreate them?
I have booted from a knoppix cd and copied the first block of the disk (dd if=/dev/hda of=partitionTable count=1) and I have also had a look at the table using fdisk. (Fdisk tells me that all primary partitions are there, but none of the logical partitions inside the extended partition.)

Please help me recover my beloved Gentoo!! (I've got nothing important in my Windows installation, so I don't really mind losing it. Thinking about it, I would actually prefer losing it because Windows is not my friend anymore after this destructive behaviour.)

[NeddySeagoon]

SwooshingRob,

There is good news and bad news. I'll start with the bad.
The partition table at the front of the disk contains the partition entries for the primary partitions and extended partition only.
The logical partitions are described elsewhere inside the extended partition.

The good news.
If you have you logical partition information, you can use fdisk to recreate the logical partitions *exactly* as they were before.
You need to get this right for it to work. If you don't have the information, there are several disk surface scanners on the web that will attempt to discover your partitons. They have been discussed on other threads here.

The important thing is to write nothing to the extended partition until you are sure its the correct data. Be aware that the partition table in the extended partition is in the form of a linked list. The first entry at the beginning of the extended partition describes the first logical partition and points to the location of the partition table for the next partition. This means you can rewrite the first entry as often as you like, since it always goes in the same place but the content of the first entry determines where the second is written.

It may be recoverable, depending on what the format operation actually did.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[SwooshingRob]

NeddySeagoon, thanks for your help.

I decided to use parted to rescue my partitions and it could succefully rescue all but one of them.
Luckily the only partition that couldn't be rescued only contained unimportant/easily recreatable data (tarballs and CVS trees) so I'm happy again.
What irritated me the most was that when booting into WinXP again (yes, both Gentoo and XP were rescued) there was a pop-up saying that Windows had recovered from a serious error. Well done Microsoft - First you f*ck up my system and then you take the credit for restoring it!

Before I started I spent about four hours backing up my disk to an external USB disk using dd.

Lessons learned:
* Make sure you regularly back up your important data.
* Get a good rescue disk. (In your native language. I had access to a german copy of Knoppix 3.8, which is fine as long as you speak german...)
* When doing large backups, make sure there is a Live8 concert to watch while you wait. (Pink Floyd was amazing!!!)
* Did I mention backups? It was really really really stupid of me not having any backups. Hard disks are mechanical and eventually they will crash. Some times hard disks can crash even without the help of Windows.

[SwooshingRob]

I should probably also mention that the partition that couldn't be saved was located after the offending partition inside the extended partition. So even if NeddySeagoon's comment didn't directly help me with a solution it definitely clarified that it probably wasn't worth the effort to try to recover the last partition as it would most likely fail. (That is the nature of a linked list. Remove one link and the rest of the list is ususally lost.)

It's also worth noting that I have now completed the first backup of my drive and am working on a policy to automate the backups, thus proving that it is enough with one kick in the groin to realise that it hurts. I don't want to be kicked over and over again, just to find out if it stops hurting after a few kicks...

Cheers
Rob