[GTALUG] restore GPT partition table?

[Lennart Sorensen]

On Tue, Oct 25, 2016 at 07:33:30AM -0400, Matt Price via talk wrote:
> OK, so I did this
> 
> dd if=some.iso of=/dev/sdb
> 
> oops -- that's not the USB key! that's my internal m.2 drive!
> 
> The partition table is gone, but it used to contain 2 partitions, both of
> them in an LVM, one of them part of an extended logical volume that added
> space to /home on my overburdened main drive. I haven't lost much data
> (just the first 700mb were overwritten), and amazingly my laptop continues
> to run just fine -- even though lvscan reports a missing drive, apparently
> the data is still findable.
> 
> I'd like to restore the partition table but I don't know where the
> partition boundaries are, and in any case I don't know how to write a
> partition table (!). What tools should I use? Preferably without turning
> off my laptop, since I'm afraid it won't boot back up again!

Luckily gpt has two copies.  One at the start of the disk and one at the end.

Any gpt compatible partition tool should actually offer to copy the
backup from the end of the device.

For example:

root at lsorensen-debian:~# cd /tmp/
root at lsorensen-debian:/tmp# dd if=/dev/zero of=disk.img bs=1M count=100
100+0 records in
100+0 records out
104857600 bytes (105 MB, 100 MiB) copied, 0.10877 s, 964 MB/s
root at lsorensen-debian:/tmp# modprobe loop max_part=8
root at lsorensen-debian:/tmp# losetup /dev/loop0 disk.img 
root at lsorensen-debian:/tmp# gparted /dev/loop0
Created symlink /run/systemd/system/-.mount → /dev/null.
Created symlink /run/systemd/system/boot-efi.mount → /dev/null.
Created symlink /run/systemd/system/boot.mount → /dev/null.
Created symlink /run/systemd/system/media-sf_Downloads.mount → /dev/null.
Created symlink /run/systemd/system/run-user-1000.mount → /dev/null.
Created symlink /run/systemd/system/tmp.mount → /dev/null.
======================
libparted : 3.2
======================
/dev/loop0: unrecognised disk label
Removed /run/systemd/system/-.mount.
Removed /run/systemd/system/boot-efi.mount.
Removed /run/systemd/system/boot.mount.
Removed /run/systemd/system/media-sf_Downloads.mount.
Removed /run/systemd/system/run-user-1000.mount.
Removed /run/systemd/system/tmp.mount.
root at lsorensen-debian:/tmp# gdisk /dev/loop0
GPT fdisk (gdisk) version 1.0.1

Partition table scan:
  MBR: not present
  BSD: not present
  APM: not present
  GPT: not present

Creating new GPT entries.

Command (? for help): n
Partition number (1-128, default 1): 
First sector (34-204766, default = 2048) or {+-}size{KMGTP}: 
Last sector (2048-204766, default = 204766) or {+-}size{KMGTP}: 
Current type is 'Linux filesystem'
Hex code or GUID (L to show codes, Enter = 8300): 
Changed type of partition to 'Linux filesystem'

Command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!

Do you want to proceed? (Y/N): y
OK; writing new GUID partition table (GPT) to /dev/loop0.
The operation has completed successfully.
root at lsorensen-debian:/tmp# gdisk -l /dev/loop0
GPT fdisk (gdisk) version 1.0.1

Partition table scan:
  MBR: protective
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with protective MBR; using GPT.
Disk /dev/loop0: 204800 sectors, 100.0 MiB
Logical sector size: 512 bytes
Disk identifier (GUID): 5946A311-C895-4DAE-94CF-9C96EB8E14C1
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 204766
Partitions will be aligned on 2048-sector boundaries
Total free space is 2014 sectors (1007.0 KiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1            2048          204766   99.0 MiB    8300  Linux filesystem
root at lsorensen-debian:/tmp# dd if=/dev/zero bs=1M count=5 > /dev/loop0
5+0 records in
5+0 records out
5242880 bytes (5.2 MB, 5.0 MiB) copied, 0.0397727 s, 132 MB/s
root at lsorensen-debian:/tmp# gdisk /dev/loop0   
GPT fdisk (gdisk) version 1.0.1

Caution: invalid main GPT header, but valid backup; regenerating main header
from backup!

Caution! After loading partitions, the CRC doesn't check out!
Warning! Main partition table CRC mismatch! Loaded backup partition table
instead of main partition table!

Warning! One or more CRCs don't match. You should repair the disk!

Partition table scan:
  MBR: not present
  BSD: not present
  APM: not present
  GPT: damaged

Found invalid MBR and corrupt GPT. What do you want to do? (Using the
GPT MAY permit recovery of GPT data.)
 1 - Use current GPT
 2 - Create blank GPT

Your answer: 1

Command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!

Do you want to proceed? (Y/N): y
OK; writing new GUID partition table (GPT) to /dev/loop0.
The operation has completed successfully.
root at lsorensen-debian:/tmp# gdisk -l /dev/loop0
GPT fdisk (gdisk) version 1.0.1

Partition table scan:
  MBR: protective
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with protective MBR; using GPT.
Disk /dev/loop0: 204800 sectors, 100.0 MiB
Logical sector size: 512 bytes
Disk identifier (GUID): 5946A311-C895-4DAE-94CF-9C96EB8E14C1
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 204766
Partitions will be aligned on 2048-sector boundaries
Total free space is 2014 sectors (1007.0 KiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1            2048          204766   99.0 MiB    8300  Linux filesystem


So seems simple enough to recover the partition table from the backup.

-- 
Len Sorensen