[Cialug] Partition table gone

[Daniel A. Ramaley]

I've started reading about GPT and agree that if only overwriting the 
first 512 bytes it *seems* the drive should still work. I've verified 
that only the first 512 bytes were zeroed. In a hex editor i can see 
that bytes 0x00 to 0x1FF are all 0, and that at 0x200 "EFI PART" 
appears, marking the beginning of the actual partition table.

I did have rEFIt installed on the OS X partition. I don't know if that 
changes things drastically, but i should have mentioned it in my first 
message.

Right now i'm making a copy of the disk onto another machine by way of 
dd and ssh. Once that's done, i'm going to start trying to recover. One 
idea i've had would be to boot an OS X DVD and repartition the drive as 
it was before, and then install OS X as i had it. Then i'd know that 
the beginning of the drive was in a consistent state. I know what block 
numbers the partition boundaries are on, so once i had things back to a 
consistent state, i could use dd to copy the actual partition data from 
the backup i'm making. I *think* that would get things back. I'm not 
worried about recovering the Ubuntu installation as i didn't have 
anything important on there and can just reinstall.

If you think taking the first 512 bytes from another disk and slapping 
it onto the front of my disk would fix the problem, that would 
certainly be faster than my idea. I'd be willing to give it a try if 
you can send me those magic 512 bytes.

On Saturday February 21 2009, Zachary Kotlarek wrote:
>On EFI machines, the first LBA, including the traditional primary  
>partition table, is not actually used -- it's just there so machines/
>software that don't know about GPT (GUID Partition Table) don't see  
>the disk as empty. So if you really only overwrote the first 512 bytes
>   I would not expect you to have and trouble with the disk, at least
> not on a machine that actually reads GPT disks.
>
>That being said, if you think having the first LBA restored would help
>   things I can send you a copy of one from an Intel Mac. Probably
> even one with a 320 GB disk.
>
>If you did blow away the partition table from the beginning of the  
>disk (maybe you overwrote the first 512 blocks instead of bytes) you  
>can restore it from the backup at the end of the disk -- it's written
>   to both ends. Note that while the partition entries are stored in
> the same order on both ends, the header is the first and last LBA on
> the disk (sans the fake MBR in LBA0), so you need to copy in two
> distinct segments.
>
>OS X provides a gpt command-line tool, which I suspect is on the  
>install disk. You could use it, or any other GPT-aware formatting tool
>   that does not try to initialize volumes, to manually restore the
> table. Assuming you know the exact size and location of each
> partition of course.
>x-man-page://8/gpt
>
>Basic GPT references:
>http://en.wikipedia.org/wiki/GUID_Partition_Table
>http://developer.apple.com/technotes/tn2006/tn2166.html

------------------------------------------------------------------------
Dan Ramaley                            Dial Center 118, Drake University
Network Programmer/Analyst             2407 Carpenter Ave
+1 515 271-4540                        Des Moines IA 50311 USA