gpart
Gpart is a small tool which tries to guess what partitions
are on a PC type, MBR-partitioned hard disk in case the
primary partition table was damaged.
Gpart works by scanning through the device (or file) given on
the command line on a sector basis. Each guessing module is
asked if it thinks a filesystem it knows about could start at
a given sector. Several filesystem guessing modules are built
in.
Consult the manual page for command line options and usage.
Installation
See file INSTALL.
Currently recognized partitions/filesystems types
Modname
Typ
Description
fat
0x01
Primary DOS with 12 bit FAT
0x04
Primary DOS with 16 bit FAT (<= 32MB)
0x06
Primary 'big' DOS (> 32MB)
0x0B
DOS or Windows 95 with 32 bit FAT
0x0C
DOS or Windows 95 with 32 bit FAT, LBA
ntfs
0x07
OS/2 HPFS, NTFS, QNX or Advanced UNIX
hpfs
0x07
OS/2 HPFS, NTFS, QNX or Advanced UNIX
ext2
0x83
Linux ext2 filesystem
lswap
0x82
Linux swap
bsddl
0xA5
FreeBSD/NetBSD/386BSD
s86dl
0x82
Solaris/x86 disklabel
minix
0x80
Minix V1
0x81
Minix V2
reiserfs
0x83
ReiserFS filesystem
hmlvm
0xFE
Linux LVM physical volumes
qnx4
0x4F
QNX 4.x
beos
0xEB
BeOS fs
xfs
0x83
SGI XFS filesystem
btrfs
0x83
BtrFS
LVM2
0x8E
LVM2
Guessing modules
Each guessing module must provide three functions callable from
gpart:
int xxx_init(disk_desc *d,g_module *m)
Initialisation function. Will be called before a scan.
It should return the minimum number of bytes it wants
to receive for a test. The module should set the
description of the filesystem/partition type it handles
in g_module.m_desc. If the filesystem/partition type
included a partition table like first sector (like the
*BSD disklabels do), the flag m_hasptbl should be set.
Another flag is m_notinext which means the tested type
cannot reside in a logical partition.
int xxx_term(disk_desc *d)
Termination/cleanup function, called after the scanning
of the device has been done.
int xxx_gfun(disk_desc *d,g_module *m)
The actual guessing function, called from within the
scan loop. It should test the plausibility of the
given sectors, and return its guess in m->m_guess (a
probability between 0 and 1). See existing modules
for examples.
The given file descriptor d->d_fd can be used for seeking
and reading (see e.g. gm_ext2.c which tries to read
the first spare superblock). If a module is convinced
that it has found a filesystem/partition start it should
fill in the assumed begin and size of the partition.
The test performed should not be too pedantic, for
instance it should not be relied upon that the file-
system is clean/was properly unmounted. On the other
hand too much tolerance leads to misguided guesses,
so a golden middle way must be found.
Output explanation
Here is a sample gpart -v run on my first IDE hard disk
(comments in block-quotes):
dev(/dev/hda) mss(512) chs(1232/255/63)(LBA) #s(19792080) size(9664mb)
mss is the medium sector size, chs the geometry retrieved
from the OS (or from the command line), #s is the total
sector count.
Primary partition(1)
type: 006(0x06)(Primary 'big' DOS (> 32MB)) (BOOT)
size: 502mb #s(1028097) s(63-1028159)
chs: (0/1/1)-(63/254/63)d (0/1/1)-(63/254/63)r
hex: 80 01 01 00 06 FE 3F 3F 3F 00 00 00 01 B0 0F 00
size: the size of the partition in megabytes, number of
sectors and the sector range.
chs: the partition table chs range (d) and the real one
(r). If the number of cylinders is less than 1024, both
are identical.
hex: the hexadecimal representation of the partition entry
as found in the partition table.
...
Begin scan...
Possible partition(DOS FAT), size(502mb), offset(0mb)
type: 006(0x06)(Primary 'big' DOS (> 32MB))
size: 502mb #s(1028097) s(63-1028159)
chs: (0/1/1)-(63/254/63)d (0/1/1)-(63/254/63)r
hex: 00 01 01 00 06 FE 3F 3F 3F 00 00 00 01 B0 0F 00
Possible extended partition at offset(502mb)
Possible partition(Linux ext2), size(31mb), offset(502mb)
type: 131(0x83)(Linux ext2 filesystem)
size: 31mb #s(64196) s(1028223-1092418)
chs: (64/1/1)-(67/254/62)d (64/1/1)-(67/254/62)r
hex: 00 01 01 40 83 FE 3E 43 7F B0 0F 00 C4 FA 00 00
Possible partition(Linux swap), size(125mb), offset(533mb)
type: 130(0x82)(Linux swap or Solaris/x86)
size: 125mb #s(256976) s(1092483-1349458)
chs: (68/1/1)-(83/254/62)d (68/1/1)-(83/254/62)r
hex: 00 01 01 44 82 FE 3E 53 83 AB 10 00 D0 EB 03 00
During the scan phase all found partitions are listed by
their real type names. The Linux swap partition above is
recognized as Linux swap but will get the 0x82 partition
identifier which can be both a Solaris disklabel or a
Linux swap partition.
When examining the hex values of the first primary partition
it can be seen that they are identical to the values of the
actual partition table (good guess) except for the first
value (0x80 vs. 0x00). This entry denotes the partition
'boot' flag which cannot be guessed.
...
End scan.
Checking partitions...
Partition(Primary 'big' DOS (> 32MB)): primary
Partition(Linux ext2 filesystem): logical
Partition(Linux swap or Solaris/x86): logical
Partition(Linux LVM physical volume): logical
Partition(Linux ext2 filesystem): logical
Partition(DOS or Windows 95 with 32 bit FAT, LBA): logical
Partition(FreeBSD/NetBSD/386BSD): primary
Partition(Linux LVM physical volume): primary
Ok.
During the scan phase gpart gathers a simple list of possible
partitions, the check phase now tries to decide if found
extended partitions seem consistent, if partitions do not
overlap etc. Overlapping partitions are silently discarded,
all remaining ones are given an attribute 'primary', 'logical',
'orphaned' or 'invalid'. If gpart is called like gpart -vv ...,
it also tells why it thinks a partition guess is invalid.
If any inconsistencies are found, gpart prints the number
of remaining inconsistencies, otherwise it says 'Ok.'
Guessed primary partition table:
Primary partition(1)
type: 006(0x06)(Primary 'big' DOS (> 32MB))
size: 502mb #s(1028097) s(63-1028159)
chs: (0/1/1)-(63/254/63)d (0/1/1)-(63/254/63)r
hex: 00 01 01 00 06 FE 3F 3F 3F 00 00 00 01 B0 0F 00
Primary partition(2)
type: 005(0x05)(Extended DOS)
size: 6157mb #s(12611025) s(1028160-13639184)
chs: (64/0/1)-(848/254/63)d (64/0/1)-(848/254/63)r
hex: 00 00 01 40 05 FE FF 50 40 B0 0F 00 D1 6D C0 00
Primary partition(3)
type: 165(0xA5)(FreeBSD/NetBSD/386BSD)
size: 1396mb #s(2859570) s(13639185-16498754)
chs: (849/0/1)-(1023/254/63)d (849/0/1)-(1026/254/63)r
hex: 00 00 C1 51 A5 FE FF FF 11 1E D0 00 32 A2 2B 00
Primary partition(4)
type: 254(0xFE)(Linux LVM physical volume)
size: 1608mb #s(3293325) s(16498755-19792079)
chs: (1023/254/63)-(1023/254/63)d (1027/0/1)-(1231/254/63)r
hex: 00 FE FF FF FE FE FF FF 43 C0 FB 00 8D 40 32 00
This is a resulting primary partition table. Note that
the logical partition guesses were only used to create
the extended partition entry. Up to now gpart cannot
reconstruct a damaged logical partition chain itself.
If a guessed primary partition table should be written to
some file or device the user must specify (via the -W
option) which partition gets the active (bootable) one.
Author
gpart README, Aug 1999, Michail Brzitwa mb@ichabod.han.de