1GPART(8)                    System Manager's Manual                   GPART(8)
2
3
4

NAME

6       gpart - guess PC-type hard disk partitions
7

SYNOPSIS

9       gpart [options] device
10
11       Options:     [-b     <backup     MBR>][-C    c,h,s][-c][-d][-E][-e][-f]
12       [-g][-h][-i][-K  <last-sector>][-k  <#  of  sectors>]  [-L]  [-l   <log
13       file>][-n    <increment>]    [-q][-s    <sector-size>]   [-t   <module-
14       name>][-V][-v] [-W <device>][-w <module-name, weight>]
15

DESCRIPTION

17       gpart tries to guess which partitions are on a hard disk.  If the  pri‐
18       mary partition table has been lost, overwritten or destroyed the parti‐
19       tions still exist on the disk but the operating  system  cannot  access
20       them.
21
22       gpart  ignores  the primary partition table and scans the disk (or disk
23       image, file)  sector  after  sector  for  several  filesystem/partition
24       types.  It  does  so by "asking" filesystem recognition modules if they
25       think a given sequence of sectors resembles the beginning of a filesys‐
26       tem  or  partition  type.  Currently the following filesystem types are
27       known to gpart (listed by module names) :
28
29
30       beos   BeOS filesystem type.
31
32       bsddl  FreeBSD/NetBSD/386BSD disklabel sub-partitioning scheme used  on
33              Intel platforms.
34
35       ext2   Linux second extended filesystem.
36
37       fat    MS-DOS FAT12/16/32 "filesystems".
38
39       hpfs   IBM OS/2 High Performance filesystem.
40
41       hmlvm  Linux LVM physical volumes (LVM by Heinz Mauelshagen).
42
43       lswap  Linux swap partitions (versions 0 and 1).
44
45       minix  The Minix operating system filesystem type.
46
47       ntfs   MS Windows NT/2000 filesystem.
48
49       qnx4   QNX 4.x filesystem.
50
51       reiserfs
52              The Reiser filesystem (version 3.5.X, X > 11, 3.6.X).
53
54       s86dl  Sun Solaris on Intel platforms uses a sub-partitioning scheme on
55              PC hard disks similar to the BSD disklabels.
56
57       xfs    Silicon Graphic's journalling filesystem for Linux.
58
59       More filesystem guessing modules can be added at runtime  (see  the  -t
60       option). Please consult the gpart README file for detailed explanations
61       on how to create guessing modules. All modules  are  accompanied  by  a
62       guessing  weight  factor which denotes how "educated" their guesses are
63       compared to other modules. This weight can be changed if a certain mod‐
64       ule keeps on mis-identifying a partition.
65
66       Naturally  only partitions which have been formatted in some way can be
67       recognized. If the type of a partition entry in the  primary  partition
68       table  is  changed from x to y while the filesystem is still of type x,
69       gpart will also still guess a type x.
70
71       No checks are performed whether a found filesystem  is  clean  or  even
72       consistent/mountable,  so  it is quite possible that gpart may identify
73       partitions which existed prior to the current  partitioning  scheme  of
74       the disk. Especially on large disks old file system headers/superblocks
75       may be present a long time until they are finally overwritten with user
76       data.
77
78       It  should  be  stressed  that  gpart  does a very heuristic job, never
79       believe its output without any plausability checks. It  can  be  easily
80       right in its guesswork but it can also be terribly wrong. You have been
81       warned.
82
83       After having found a list of possible  partition  types,  the  list  is
84       checked  for  consistency. For example, a partition which overlaps with
85       the previous one  will  be  discarded.  All  remaining  partitions  are
86       labelled  with  one  of the following attributes: "primary", "logical",
87       "orphaned" or "invalid".
88
89       A partition labelled "orphaned" is a logical partition which  seems  ok
90       but  is  missed in the chain of logical partitions. This may occur if a
91       logical partition is deleted from the extended partition table  without
92       overwriting the actual disk space.
93
94       An  "invalid" partition is one that cannot be accepted because of vari‐
95       ous reasons. If a consistent primary partition  table  was  created  in
96       this process it is printed and can be written to a file or device.
97
98

EXTENDED PARTITIONS

100       If  the  disk/file  to be examined consists of primary partitions only,
101       gpart has quite a good chance to identify them. Extended partitions  on
102       the other hand can result in a lot of problems.
103
104       Extended partitions are realized as a linked list of extended partition
105       tables, each of which include an entry pointing to a logical partition.
106       The  size  of  an  extended partition depends on where the last logical
107       partition  ends.  This  means  that  extended  partitions  may  include
108       "holes",  unallocated disk space which should only be assigned to logi‐
109       cal, not primary partitions.
110
111       gpart tries to do its best to check a found chain of logical partitions
112       but  there  are  very  many possible points of failure. If "good" fdisk
113       programs are used to create extended partitions, the  resulting  tables
114       consist of a zeroed boot record and the four partition entries of which
115       at least two should be marked unused. Unfortunately e.g. the fdisk pro‐
116       gram  shipped with Windows NT does not seem to zero out the boot record
117       area so gpart has to be overly tolerant in recognizing extended  parti‐
118       tion tables. This tolerance may result in quite stupid guesses.
119
120

DISK TRANSFERS

122       If  you  want  to  investigate hard disks from other systems you should
123       note down the geometry (number of cylinders,  heads  per  cylinder  and
124       sectors  per head) used for that disk, and tell gpart about this geome‐
125       try.
126
127       Investigating disks from machines with a different endianness than  the
128       scanning  one  has  not been tested at all, and is currently not recom‐
129       mended.
130
131

LARGE DISKS

133       gpart relies on the OS reporting the correct disk  geometry.   Unfortu‐
134       nately  sometimes  the  OS may report a geometry smaller the the actual
135       one (e.g. disks with more than 1024 or 16384 cylinder).
136
137       gpart checks if guessed partitions extend  beyond  the  disk  size  and
138       marks  those  "invalid",  but  may be mistaken in case the disk size is
139       calculated from an incorrect geometry. For instance if a disk with  the
140       geometry  1028/255/63 should be scanned, and the OS reports 1024/255/63
141       gpart should be called like
142
143              gpart -C 1028,255,63 <other options> <device>
144
145

PRECAUTIONS

147       gpart may be of some help when the primary partition table was lost  or
148       destroyed  but it can under no circumstances replace proper disk/parti‐
149       tion table backups.  To save the master boot record (MBR) including the
150       primary partition table to a file type
151
152              dd if=/dev/hda of=mbr bs=512 count=1
153
154       exchanging /dev/hda with the block device name of the disk in question.
155       This should be done for all disks in the system. To restore the primary
156       partition table without overwriting the MBR type
157
158              dd if=mbr of=/dev/hda bs=1 count=64 skip=446 seek=446
159
160       Warning:  make sure that all parameters are typed as shown and that the
161       disk device is correct. Failing to do so may result in severe  filesys‐
162       tem  corruption. The saved file should be stored in a safe place like a
163       floppy disk.
164
165

OPTIONS

167       -b backupfile
168              If the guessed primary  partition  table  seems  consistent  and
169              should  be  written  (see  the -W option) backup the current MBR
170              into the specified file.
171
172       -C c,h,s
173              Set the disk geometry (cylinders, heads, sectors) for the  scan.
174              This is useful if a disk should be scanned which was partitioned
175              using a different geometry, if the device is a disk-image or  if
176              the  disk  geometry cannot be retrieved through the PCs BIOS. No
177              spaces are allowed between the numbers,  unless  all  three  are
178              enclosed in quotes.
179
180       -c     Check/compare mode (implies the -q quiet option). After the scan
181              is done, the resulting primary partition table  is  compared  to
182              the  existing  one.  The  return code of gpart then contains the
183              number of differences (0 if they are identical  except  for  the
184              boot/active  flag  which  cannot be guessed). This option has no
185              effect if -d is given on the command line.
186
187       -d     Do not start the guessing loop. Useful if  the  partition  table
188              should  be  printed  (in combination with the -v option) without
189              actually scanning for partitions.
190
191       -E     Do not try to identify extended partition tables. If  there  are
192              extended  partitions  on  the  given device gpart will most cer‐
193              tainly complain about too many primary partitions because  there
194              can be only four primary partitions. Existing logical partitions
195              will be listed as primary ones.
196
197       -e     Do not skip disk read errors. If this option is given, and short
198              disk  reads  or  general disk read errors (EIO) are encountered,
199              gpart will exit. If not given, the program tries to continue.
200
201       -f     Full scan. When a possible partition is  found,  gpart  normally
202              skips  all  sectors this entry seems to occupy and continues the
203              scan from the end of the last possible partition. The disk  scan
204              can take quite a while if this option is given, be patient.
205
206       -g     Do  not  try to get the disk geometry from the OS. If the device
207              is no block or character device but a  plain  file  this  option
208              should  be  supplied. If the file to be scanned is an image of a
209              disk, the geometry can be given by the -C option.
210
211       -h     Show some help.
212
213       -i     Run interactively. Each time a possible partition is  identified
214              the user is asked for confirmation.
215
216       -K last sector
217              Scan  only  up  to  the  given  sector or the end of the file or
218              device whichever comes first.
219
220       -k sectors
221              Skip given number of sectors before the scan. Potentially useful
222              if a partition is looked for at the end of a large disk.
223
224       -L     List  available  filesystem/partition  type  modules  and  their
225              weights, then exit.
226
227       -l logfile
228              Log output to the given file (even if -q was supplied).
229
230       -n increment
231              Scan increment: number of  sectors  or  "s"  for  single  sector
232              increment,  "h" for an increment of sectors per head (depends on
233              geometry) or "c" for cylinder increment.
234
235              The increment also influences the condition where extended  par‐
236              tition  tables  are searched: if the scan increment is "s" (i.e.
237              1) extended partition tables are required to be on a head bound‐
238              ary, otherwise they must be on a cylinder boundary.
239
240              If  the disk geometry could not be retrieved and no geometry was
241              given on the command line, the default increment is one sector.
242
243       -q     Quiet/no output mode. However if a logfile was specified (see -l
244              option)  all  output  is written to that file. This option over‐
245              rides the -i interactive mode.
246
247       -s sector size
248              Preset medium sector size.  gpart tries to find out  the  sector
249              size  but  may  fail  in  doing so. Probed sector sizes are 2^i,
250              i=9..14 (512 to 16384 bytes). The default medium sector size  is
251              512 bytes.
252
253       -V     Show version number.
254
255       -v     Be verbose. This option can be given more than once resulting in
256              quite a lot of information.
257
258       -W device
259              Write partition table. If a consistent primary  partition  table
260              has  been  guessed  it  can  be written to the specified file or
261              device. The supplied device can be the same as the scanned one.
262
263              Additionally the guessed partition entries  can  be  edited.  No
264              checks  are  performed on the entered values, thus the resulting
265              table is allowed to be highly inconsistent. Please beware.
266
267              Warning: The guessed partition  table  should  be  checked  very
268              carefully  before  writing  it  back.  You  can always write the
269              guessed partition table into a plain file and  write  this  into
270              sector 0 using dd(1) (see section PRECAUTIONS above).
271
272
273       -w module name,weight
274              Put  the given module at the head of the module chain and assign
275              a new weight to that module. All modules are  given  an  initial
276              weight of 1.0. Again no spaces are allowed.
277
278
279
280       Default settings are "-n h".
281
282

EXAMPLES

284       - To  scan  the  first IDE hard disk under Linux using default settings
285       type
286
287              gpart /dev/hda
288
289       - To print the primary partition table of the third IDE  drive  without
290       starting the scan loop in FreeBSD type
291
292              gpart -vvd /dev/wd2
293
294       - If  lilo(8)  was  installed in the master boot record (MBR) of a hard
295       disk it saves the contents  of  the  first  sector  in  a  file  called
296       /boot/boot.<major/minor>.  To  list  the partitions contained in such a
297       file type e.g.
298
299              gpart -vdg /boot/boot.0300
300
301       If the partition table contains an extended partition, gpart will  com‐
302       plain  about  invalid  extended  partition  tables because the extended
303       entry points to sectors not within that file.
304
305       - Usually the first primary partition starts on  the  second  head.  If
306       gpart  cannot identify the first partition properly this may not be the
307       case.  gpart can be told to start the scan directly from sector one  of
308       the disk, using the sector-wise scan mode:
309
310              gpart -k 1 -n s /dev/hdb
311
312       - Suppose  gpart identifies an NTFS partition as FAT on a certain disk.
313       In this situation the "ntfs" module should be made the first module  to
314       be probed and given a weight higher than the usual weight of 1.0:
315
316              gpart -w ntfs,1.5 /dev/hdb
317
318       To list the available modules and their weights use the -L option.
319
320       - After having checked the output of gpart at least thrice, the primary
321       partition table can be written back to the device this way:
322
323              gpart -W /dev/sdc /dev/sdc
324
325       This of course may be extremely dangerous to  your  health  and  social
326       security, so beware.
327
328       - A  hard  disk with 63 sectors per head is scanned in steps of 63 sec‐
329       tors. To perform the scan on every second head while skipping the first
330       1008 sectors type
331
332              gpart -k 1008 -n 126 /dev/sda
333
334       - If  you  want  to  see  how easily gpart can be mislead, and how many
335       probable partition starts are on a disk, search the whole  disk  really
336       sector by sector, writing all output to a logfile:
337
338              gpart -vvfn s -ql /tmp/gpart.log /dev/sd2 &
339
340       Usually gpart will not be able to produce an educated guess of the pri‐
341       mary partition table in this mode.  The  logfile  however  may  contain
342       enough hints to manually reconstruct the partition table.
343
344

FILES

346       /dev/*
347              Hard  disk  block  devices. The naming scheme of hard disk block
348              devices is OS dependent, consult your system  manuals  for  more
349              information.
350
351

DIAGNOSTICS

353       There are many error message types, all of them should be self-explana‐
354       tory. Complain if they are not.
355
356

BUGS

358       gpart is beta software, so expect buggy behaviour.
359
360       -  gpart only accepts extended partition links with one logical  parti‐
361       tion.  There  may be fdisk variants out there creating links with up to
362       three logical partition entries but these are not accepted.
363
364

TO DO

366       - Support big-endian architectures.
367       - Test on 64-bit architectures.
368       - Look for boot manager partitions (e.g. OS/2 BM).
369       - Think about reconstructing logical partition chains.
370
371

AUTHOR

373       Please send bug reports, suggestions, comments etc. to
374
375              Michail Brzitwa <michail@brzitwa.de>
376
377

SEE ALSO

379       fdisk(8).
380
381
382
383Administration Tools             January 2001                         GPART(8)
Impressum