| Stable release | 0.1f |
|---|---|
| Operating system | Unix-like |
| Type | Partition editor |
| License | GNU General Public License |
| Website | www.brzitwa.de |
gpart is a software utility which scans a storage device, examining the data in order to detect partitions which may exist but are absent from the disk's partition tables. Gpart was written by Michail Brzitwa of Germany. The release on the author's website is now older than the releases some distributions are using. It appears that Michail Brzitwa does not actively maintain the code, instead the various distributions (I.E. Fedora[1] or Debian[2]) appear to maintain their own versions.
gpart tries to guess partitions from any device that can be partitioned, even a file. If the primary partition table has been lost, overwritten or destroyed the partitions still exist on the media but the operating system cannot access them.
gpart ignores the primary partition table and scans the disk (or disk image file) sector after sector for several filesystem/partition types. It does so by "asking" filesystem recognition modules if they think a given sequence of sectors resembles the beginning of a filesystem or partition type.
Michail Brzitwa,: man page "gpart(8) - Linux man page", January 2001
A list of these modules are listed below. Also modules can be written for future filesystems and used in the detection process.
If you need to recover partitions that are damaged on the only bootable disk in a machine you can use a live CD such as knoppix to start the machine and use the utilities from the disk.
It is also good at finding and listing the types, locations, and sizes of inadvertently-deleted partitions, both primary and logical. It gives you the information you need to manually re-create them (using fdisk, cfdisk, sfdisk, etc.). The guessed partition table can also be written to a file or (if you firmly believe the guessed table is entirely correct) directly to a disk device.
With some badly damaged devices it is a good idea to use a utility such as ddrescue to make a backup. Then when you have a copy of the device, use gpart to guess the partitions on the copy. If it is successful, you can try writing them back to the device. You may find that when using ddrescue you get read errors because the device is damaged but if you can get the partitions readable with your copy then you can try using Mount (Unix) and retrieve the data from the copy.
$ mount -t <part type> /path/to/imagefile -o loop,offset=<part offset> /mnt/loop
This will mount the partition at offset <part offset> on /mnt/loop so you can recover your data from the file. To get the partition offset you can use either fdisk -ul /path/to/imagefile or use the output from gpart. Look at the sample output at the size line, the last pair of round brackets has the start (16) and then end (3906559). When specifying the offset, always specify the start.
Contents |
This is sample output from a scan of an 8GB flash memory stick with two partitions, one vfat 2GB partition and one xfs 6GB partition.
Begin scan... Possible partition(DOS FAT), size(1907mb), offset(0mb) Possible partition(SGI XFS filesystem), size(5730mb), offset(1907mb) End scan. Checking partitions... Partition(DOS or Windows 95 with 32 bit FAT, LBA): primary Partition(Linux ext2 filesystem): primary Ok. Guessed primary partition table: Primary partition(1) type: 012(0x0C)(DOS or Windows 95 with 32 bit FAT, LBA) size: 1907mb #s(3906544) s(16-3906559) chs: (0/1/1)-(1023/19/16)d (0/1/1)-(12207/19/16)r Primary partition(2) type: 131(0x83)(Linux ext2 filesystem) size: 5730mb #s(11736000) s(3906560-15642559) chs: (1023/19/16)-(1023/19/16)d (12208/0/1)-(48882/19/16)r Primary partition(3) type: 000(0x00)(unused) size: 0mb #s(0) s(0-0) chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r Primary partition(4) type: 000(0x00)(unused) size: 0mb #s(0) s(0-0) chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r
Supported (guessable) filesystem or partition types: