[GTALUG] restore GPT partition table?

[Jamon Camisso]

On 25/10/16 12:33, Matt Price via talk wrote:
> OK, so I did this
> 
> dd if=some.iso of=/dev/sdb
> 
> oops -- that's not the USB key! that's my internal m.2 drive!
> 
> The partition table is gone, but it used to contain 2 partitions, both of
> them in an LVM, one of them part of an extended logical volume that added
> space to /home on my overburdened main drive. I haven't lost much data
> (just the first 700mb were overwritten), and amazingly my laptop continues
> to run just fine -- even though lvscan reports a missing drive, apparently
> the data is still findable.
> 
> I'd like to restore the partition table but I don't know where the
> partition boundaries are, and in any case I don't know how to write a
> partition table (!). What tools should I use? Preferably without turning
> off my laptop, since I'm afraid it won't boot back up again!

Apart from the data loss, right now you're in a good position to recover
things.

First, make a copy of /proc/partitions for reference in case you need to
restore from it.

You have a few options:

1. Restore LVM since you're using that:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Logical_Volume_Manager_Administration/mdatarecover.html

Those backups have saved me on multiple occasions.

2. testdisk is a great tool for these kinds of problems. Download and
run it from /dev/shm. It may not find the deleted partitions or see in
memory stuff, but it won't hurt to try.

3. Use your /proc/partitions as a reference, since it has a list of the
partitions from before the dd operation. With it you could reconstruct a
partition table if the LVM restore steps don't work.

http://prefetch.net/blog/index.php/2009/12/20/using-the-linux-parted-utility-to-re-create-a-lost-partition-table/
for more on that approach.

Good luck!