1GPART(8) System Manager's Manual GPART(8)
2
6 gpart - guess PC-type hard disk partitions
7
9 gpart [options] device
10 Options: [-b <backup MBR>][-C c,h,s][-c][-d][-E][-e][-f]
12 [-g][-h][-i][-K <last-sector>][-k <# of sectors>] [-L] [-l <log
13 file>][-n <increment>] [-q][-s <sector-size>] [-t <module-
14 name>][-V][-v] [-W <device>][-w <module-name, weight>]
15
17 gpart tries to guess which partitions are on a hard disk. If the pri‐
18 mary partition table has been lost, overwritten or destroyed the parti‐
19 tions still exist on the disk but the operating system cannot access
20 them.
21 gpart ignores the primary partition table and scans the disk (or disk
23 image, file) sector after sector for several filesystem/partition
24 types. It does so by "asking" filesystem recognition modules if they
25 think a given sequence of sectors resembles the beginning of a filesys‐
26 tem or partition type. Currently the following filesystem types are
27 known to gpart (listed by module names) :
28 beos BeOS filesystem type.
31 bsddl FreeBSD/NetBSD/386BSD disklabel sub-partitioning scheme used on
33 Intel platforms.
34 ext2 Linux second extended filesystem.
36 fat MS-DOS FAT12/16/32 "filesystems".
38 hpfs IBM OS/2 High Performance filesystem.
40 hmlvm Linux LVM physical volumes (LVM by Heinz Mauelshagen).
42 lswap Linux swap partitions (versions 0 and 1).
44 minix The Minix operating system filesystem type.
46 ntfs MS Windows NT/2000 filesystem.
48 qnx4 QNX 4.x filesystem.
50 reiserfs
52 The Reiser filesystem (version 3.5.X, X > 11, 3.6.X).
53 s86dl Sun Solaris on Intel platforms uses a sub-partitioning scheme on
55 PC hard disks similar to the BSD disklabels.
56 xfs Silicon Graphic's journalling filesystem for Linux.
58 More filesystem guessing modules can be added at runtime (see the -t
60 option). Please consult the gpart README file for detailed explanations
61 on how to create guessing modules. All modules are accompanied by a
62 guessing weight factor which denotes how "educated" their guesses are
63 compared to other modules. This weight can be changed if a certain mod‐
64 ule keeps on mis-identifying a partition.
65 Naturally only partitions which have been formatted in some way can be
67 recognized. If the type of a partition entry in the primary partition
68 table is changed from x to y while the filesystem is still of type x,
69 gpart will also still guess a type x.
70 No checks are performed whether a found filesystem is clean or even
72 consistent/mountable, so it is quite possible that gpart may identify
73 partitions which existed prior to the current partitioning scheme of
74 the disk. Especially on large disks old file system headers/superblocks
75 may be present a long time until they are finally overwritten with user
76 data.
77 It should be stressed that gpart does a very heuristic job, never
79 believe its output without any plausability checks. It can be easily
80 right in its guesswork but it can also be terribly wrong. You have been
81 warned.
82 After having found a list of possible partition types, the list is
84 checked for consistency. For example, a partition which overlaps with
85 the previous one will be discarded. All remaining partitions are
86 labelled with one of the following attributes: "primary", "logical",
87 "orphaned" or "invalid".
88 A partition labelled "orphaned" is a logical partition which seems ok
90 but is missed in the chain of logical partitions. This may occur if a
91 logical partition is deleted from the extended partition table without
92 overwriting the actual disk space.
93 An "invalid" partition is one that cannot be accepted because of vari‐
95 ous reasons. If a consistent primary partition table was created in
96 this process it is printed and can be written to a file or device.
97
100 If the disk/file to be examined consists of primary partitions only,
101 gpart has quite a good chance to identify them. Extended partitions on
102 the other hand can result in a lot of problems.
103 Extended partitions are realized as a linked list of extended partition
105 tables, each of which include an entry pointing to a logical partition.
106 The size of an extended partition depends on where the last logical
107 partition ends. This means that extended partitions may include
108 "holes", unallocated disk space which should only be assigned to logi‐
109 cal, not primary partitions.
110 gpart tries to do its best to check a found chain of logical partitions
112 but there are very many possible points of failure. If "good" fdisk
113 programs are used to create extended partitions, the resulting tables
114 consist of a zeroed boot record and the four partition entries of which
115 at least two should be marked unused. Unfortunately e.g. the fdisk pro‐
116 gram shipped with Windows NT does not seem to zero out the boot record
117 area so gpart has to be overly tolerant in recognizing extended parti‐
118 tion tables. This tolerance may result in quite stupid guesses.
119
122 If you want to investigate hard disks from other systems you should
123 note down the geometry (number of cylinders, heads per cylinder and
124 sectors per head) used for that disk, and tell gpart about this geome‐
125 try.
126 Investigating disks from machines with a different endianness than the
128 scanning one has not been tested at all, and is currently not recom‐
129 mended.
130
133 gpart relies on the OS reporting the correct disk geometry. Unfortu‐
134 nately sometimes the OS may report a geometry smaller the the actual
135 one (e.g. disks with more than 1024 or 16384 cylinder).
136 gpart checks if guessed partitions extend beyond the disk size and
138 marks those "invalid", but may be mistaken in case the disk size is
139 calculated from an incorrect geometry. For instance if a disk with the
140 geometry 1028/255/63 should be scanned, and the OS reports 1024/255/63
141 gpart should be called like
142 gpart -C 1028,255,63 <other options> <device>
144
147 gpart may be of some help when the primary partition table was lost or
148 destroyed but it can under no circumstances replace proper disk/parti‐
149 tion table backups. To save the master boot record (MBR) including the
150 primary partition table to a file type
151 dd if=/dev/hda of=mbr bs=512 count=1
153 exchanging /dev/hda with the block device name of the disk in question.
155 This should be done for all disks in the system. To restore the primary
156 partition table without overwriting the MBR type
157 dd if=mbr of=/dev/hda bs=1 count=64 skip=446 seek=446
159 Warning: make sure that all parameters are typed as shown and that the
161 disk device is correct. Failing to do so may result in severe filesys‐
162 tem corruption. The saved file should be stored in a safe place like a
163 floppy disk.
164
167 -b backupfile
168 If the guessed primary partition table seems consistent and
169 should be written (see the -W option) backup the current MBR
170 into the specified file.
171 -C c,h,s
173 Set the disk geometry (cylinders, heads, sectors) for the scan.
174 This is useful if a disk should be scanned which was partitioned
175 using a different geometry, if the device is a disk-image or if
176 the disk geometry cannot be retrieved through the PCs BIOS. No
177 spaces are allowed between the numbers, unless all three are
178 enclosed in quotes.
179 -c Check/compare mode (implies the -q quiet option). After the scan
181 is done, the resulting primary partition table is compared to
182 the existing one. The return code of gpart then contains the
183 number of differences (0 if they are identical except for the
184 boot/active flag which cannot be guessed). This option has no
185 effect if -d is given on the command line.
186 -d Do not start the guessing loop. Useful if the partition table
188 should be printed (in combination with the -v option) without
189 actually scanning for partitions.
190 -E Do not try to identify extended partition tables. If there are
192 extended partitions on the given device gpart will most cer‐
193 tainly complain about too many primary partitions because there
194 can be only four primary partitions. Existing logical partitions
195 will be listed as primary ones.
196 -e Do not skip disk read errors. If this option is given, and short
198 disk reads or general disk read errors (EIO) are encountered,
199 gpart will exit. If not given, the program tries to continue.
200 -f Full scan. When a possible partition is found, gpart normally
202 skips all sectors this entry seems to occupy and continues the
203 scan from the end of the last possible partition. The disk scan
204 can take quite a while if this option is given, be patient.
205 -g Do not try to get the disk geometry from the OS. If the device
207 is no block or character device but a plain file this option
208 should be supplied. If the file to be scanned is an image of a
209 disk, the geometry can be given by the -C option.
210 -h Show some help.
212 -i Run interactively. Each time a possible partition is identified
214 the user is asked for confirmation.
215 -K last sector
217 Scan only up to the given sector or the end of the file or
218 device whichever comes first.
219 -k sectors
221 Skip given number of sectors before the scan. Potentially useful
222 if a partition is looked for at the end of a large disk.
223 -L List available filesystem/partition type modules and their
225 weights, then exit.
226 -l logfile
228 Log output to the given file (even if -q was supplied).
229 -n increment
231 Scan increment: number of sectors or "s" for single sector
232 increment, "h" for an increment of sectors per head (depends on
233 geometry) or "c" for cylinder increment.
234 The increment also influences the condition where extended par‐
236 tition tables are searched: if the scan increment is "s" (i.e.
237 1) extended partition tables are required to be on a head bound‐
238 ary, otherwise they must be on a cylinder boundary.
239 If the disk geometry could not be retrieved and no geometry was
241 given on the command line, the default increment is one sector.
242 -q Quiet/no output mode. However if a logfile was specified (see -l
244 option) all output is written to that file. This option over‐
245 rides the -i interactive mode.
246 -s sector size
248 Preset medium sector size. gpart tries to find out the sector
249 size but may fail in doing so. Probed sector sizes are 2^i,
250 i=9..14 (512 to 16384 bytes). The default medium sector size is
251 512 bytes.
252 -V Show version number.
254 -v Be verbose. This option can be given more than once resulting in
256 quite a lot of information.
257 -W device
259 Write partition table. If a consistent primary partition table
260 has been guessed it can be written to the specified file or
261 device. The supplied device can be the same as the scanned one.
262 Additionally the guessed partition entries can be edited. No
264 checks are performed on the entered values, thus the resulting
265 table is allowed to be highly inconsistent. Please beware.
266 Warning: The guessed partition table should be checked very
268 carefully before writing it back. You can always write the
269 guessed partition table into a plain file and write this into
270 sector 0 using dd(1) (see section PRECAUTIONS above).
271 -w module name,weight
274 Put the given module at the head of the module chain and assign
275 a new weight to that module. All modules are given an initial
276 weight of 1.0. Again no spaces are allowed.
277 Default settings are "-n h".
281
284 - To scan the first IDE hard disk under Linux using default settings
285 type
286 gpart /dev/hda
288 - To print the primary partition table of the third IDE drive without
290 starting the scan loop in FreeBSD type
291 gpart -vvd /dev/wd2
293 - If lilo(8) was installed in the master boot record (MBR) of a hard
295 disk it saves the contents of the first sector in a file called
296 /boot/boot.<major/minor>. To list the partitions contained in such a
297 file type e.g.
298 gpart -vdg /boot/boot.0300
300 If the partition table contains an extended partition, gpart will com‐
302 plain about invalid extended partition tables because the extended
303 entry points to sectors not within that file.
304 - Usually the first primary partition starts on the second head. If
306 gpart cannot identify the first partition properly this may not be the
307 case. gpart can be told to start the scan directly from sector one of
308 the disk, using the sector-wise scan mode:
309 gpart -k 1 -n s /dev/hdb
311 - Suppose gpart identifies an NTFS partition as FAT on a certain disk.
313 In this situation the "ntfs" module should be made the first module to
314 be probed and given a weight higher than the usual weight of 1.0:
315 gpart -w ntfs,1.5 /dev/hdb
317 To list the available modules and their weights use the -L option.
319 - After having checked the output of gpart at least thrice, the primary
321 partition table can be written back to the device this way:
322 gpart -W /dev/sdc /dev/sdc
324 This of course may be extremely dangerous to your health and social
326 security, so beware.
327 - A hard disk with 63 sectors per head is scanned in steps of 63 sec‐
329 tors. To perform the scan on every second head while skipping the first
330 1008 sectors type
331 gpart -k 1008 -n 126 /dev/sda
333 - If you want to see how easily gpart can be mislead, and how many
335 probable partition starts are on a disk, search the whole disk really
336 sector by sector, writing all output to a logfile:
337 gpart -vvfn s -ql /tmp/gpart.log /dev/sd2 &
339 Usually gpart will not be able to produce an educated guess of the pri‐
341 mary partition table in this mode. The logfile however may contain
342 enough hints to manually reconstruct the partition table.
343
346 /dev/*
347 Hard disk block devices. The naming scheme of hard disk block
348 devices is OS dependent, consult your system manuals for more
349 information.
350
353 There are many error message types, all of them should be self-explana‐
354 tory. Complain if they are not.
355
358 gpart is beta software, so expect buggy behaviour.
359 - gpart only accepts extended partition links with one logical parti‐
361 tion. There may be fdisk variants out there creating links with up to
362 three logical partition entries but these are not accepted.
363
366 - Support big-endian architectures.
367 - Test on 64-bit architectures.
368 - Look for boot manager partitions (e.g. OS/2 BM).
369 - Think about reconstructing logical partition chains.
370
373 Please send bug reports, suggestions, comments etc. to
374 Michail Brzitwa <michail@brzitwa.de>
376
379 fdisk(8).
380Administration Tools January 2001 GPART(8)