Skip to content

Instantly share code, notes, and snippets.

@xnumad
Last active October 25, 2020 18:40
Show Gist options
  • Save xnumad/417cf517a99453fe2920c7bb3ff89498 to your computer and use it in GitHub Desktop.
Save xnumad/417cf517a99453fe2920c7bb3ff89498 to your computer and use it in GitHub Desktop.
Restoring a deleted partition table

This is about a drive with MBR/DOS partition table and a NTFS partition on which I accidentally overwrote the partition table with fdisk /dev/sdb and then pressing g (new GPT partition table) and w (write changes to disk).

Luckily, I still had a terminal open, where I had the partition table (from fdisk -l) printed before I created a new one that overwrote it:

Disk /dev/sdb: 931,51 GiB, 1000204886016 bytes, 1953525168 sectors
Disk model: 2115            
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0x48af3b0c

Device     Boot Start        End    Sectors   Size Id Type
/dev/sdb1  *     2048 1953523711 1953521664 931,5G  7 HPFS/NTFS/exFAT

Otherwise, I'd have to use testdisk or something similar.

To restore this specific partition table, I did the following in fdisk /dev/sdb:

o //New DOS partition table
x i //Change ID
n //Create new partition (but not also a new filesystem on the partition as it'd already overwrite data that has been unchanged and was fine during the whole process)
t //Change magic byte to NTFS
a //Boot Flag

Tried looking into what was wrong with NTFS but failed.

sudo ntfslabel /dev/sdb1
NTFS signature is missing.

Ntfsfix for final file system repair. Probably only had to do that because NTFS was being used (due to the partition being mounted) at the time of overwriting partition table. sudo ntfsfix /dev/sdb1

Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
The alternate bootsector is usable
Set sector count to 1953521663 instead of 1953521656
Rewriting the bootsector
The boot sector has been rewritten

Processing $MFT and $MFTMirr...
Reading $MFT... OK
Reading $MFTMirr... OK
Comparing $MFTMirr to $MFT... OK
Processing of $MFT and $MFTMirr completed successfully.
Setting required flags on partition... OK
Going to empty the journal ($LogFile)... OK
Checking the alternate boot sector... FIXED
NTFS volume version is 3.1.
NTFS partition /dev/sdb1 was processed successfully.

After ntfsfix, fdisk -l still remained the same. Makes sense, because ntfsfix didn't change the drives partition table but a single partition's NTFS file system.

Then on Windows, chkdsk /f

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment