gpart

GPART(8)                    System Manager's Manual                   GPART(8)



NAME
       gpart - guess PC-type hard disk partitions

SYNOPSIS
       gpart [options] device

       Options: [-b <backup MBR>][-C c,h,s][-c][-d][-E][-e][-f]
       [-g][-h][-i][-K <last-sector>][-k <# of sectors>] [-L] [-l <log
       file>][-n <increment>] [-q][-s <sector-size>] [-t <module-
       name>][-V][-v] [-W <device>][-w <module-name, weight>]

DESCRIPTION
       gpart tries to guess which partitions are on a hard disk.  If the
       primary partition table has been lost, overwritten or destroyed the
       partitions still exist on the disk but the operating system cannot
       access them.

       gpart ignores the primary partition table and scans the disk (or disk
       image, file) sector after sector for several filesystem/partition
       types. It does so by "asking" filesystem recognition modules if they
       think a given sequence of sectors resembles the beginning of a
       filesystem or partition type. Currently the following filesystem types
       are known to gpart (listed by module names) :


       beos   BeOS filesystem type.

       bsddl  FreeBSD/NetBSD/386BSD disklabel sub-partitioning scheme used on
              Intel platforms.

       ext2   Linux second extended filesystem.

       fat    MS-DOS FAT12/16/32 "filesystems".

       hpfs   IBM OS/2 High Performance filesystem.

       hmlvm  Linux LVM physical volumes (LVM by Heinz Mauelshagen).

       lswap  Linux swap partitions (versions 0 and 1).

       minix  The Minix operating system filesystem type.

       ntfs   MS Windows NT/2000 filesystem.

       qnx4   QNX 4.x filesystem.

       rfs    The Reiser filesystem (version 3.5.X, X > 11).

       s86dl  Sun Solaris on Intel platforms uses a sub-partitioning scheme on
              PC hard disks similar to the BSD disklabels.

       xfs    Silicon Graphic's journalling filesystem for Linux.

       More filesystem guessing modules can be added at runtime (see the -t
       option). Please consult the gpart README file for detailed explanations
       on how to create guessing modules. All modules are accompanied by a
       guessing weight factor which denotes how "educated" their guesses are
       compared to other modules. This weight can be changed if a certain
       module keeps on mis-identifying a partition.

       Naturally only partitions which have been formatted in some way can be
       recognized. If the type of a partition entry in the primary partition
       table is changed from x to y while the filesystem is still of type x,
       gpart will also still guess a type x.

       No checks are performed whether a found filesystem is clean or even
       consistent/mountable, so it is quite possible that gpart may identify
       partitions which existed prior to the current partitioning scheme of
       the disk. Especially on large disks old file system headers/superblocks
       may be present a long time until they are finally overwritten with user
       data.

       It should be stressed that gpart does a very heuristic job, never
       believe its output without any plausability checks. It can be easily
       right in its guesswork but it can also be terribly wrong. You have been
       warned.

       After having found a list of possible partition types, the list is
       checked for consistency. For example, a partition which overlaps with
       the previous one will be discarded. All remaining partitions are
       labelled with one of the following attributes: "primary", "logical",
       "orphaned" or "invalid".

       A partition labelled "orphaned" is a logical partition which seems ok
       but is missed in the chain of logical partitions. This may occur if a
       logical partition is deleted from the extended partition table without
       overwriting the actual disk space.

       An "invalid" partition is one that cannot be accepted because of
       various reasons. If a consistent primary partition table was created in
       this process it is printed and can be written to a file or device.


EXTENDED PARTITIONS
       If the disk/file to be examined consists of primary partitions only,
       gpart has quite a good chance to identify them. Extended partitions on
       the other hand can result in a lot of problems.

       Extended partitions are realized as a linked list of extended partition
       tables, each of which include an entry pointing to a logical partition.
       The size of an extended partition depends on where the last logical
       partition ends. This means that extended partitions may include
       "holes", unallocated disk space which should only be assigned to
       logical, not primary partitions.

       gpart tries to do its best to check a found chain of logical partitions
       but there are very many possible points of failure. If "good" fdisk
       programs are used to create extended partitions, the resulting tables
       consist of a zeroed boot record and the four partition entries of which
       at least two should be marked unused. Unfortunately e.g. the fdisk
       program shipped with Windows NT does not seem to zero out the boot
       record area so gpart has to be overly tolerant in recognizing extended
       partition tables. This tolerance may result in quite stupid guesses.


DISK TRANSFERS
       If you want to investigate hard disks from other systems you should
       note down the geometry (number of cylinders, heads per cylinder and
       sectors per head) used for that disk, and tell gpart about this
       geometry.

       Investigating disks from machines with a different endianness than the
       scanning one has not been tested at all, and is currently not
       recommended.


LARGE DISKS
       gpart relies on the OS reporting the correct disk geometry.
       Unfortunately sometimes the OS may report a geometry smaller the the
       actual one (e.g. disks with more than 1024 or 16384 cylinder).

       gpart checks if guessed partitions extend beyond the disk size and
       marks those "invalid", but may be mistaken in case the disk size is
       calculated from an incorrect geometry. For instance if a disk with the
       geometry 1028/255/63 should be scanned, and the OS reports 1024/255/63
       gpart should be called like

              gpart -C 1028,255,63 <other options> <device>


PRECAUTIONS
       gpart may be of some help when the primary partition table was lost or
       destroyed but it can under no circumstances replace proper
       disk/partition table backups.  To save the master boot record (MBR)
       including the primary partition table to a file type

              dd if=/dev/hda of=mbr bs=512 count=1

       exchanging /dev/hda with the block device name of the disk in question.
       This should be done for all disks in the system. To restore the primary
       partition table without overwriting the MBR type

              dd if=mbr of=/dev/hda bs=1 count=64 skip=446 seek=446

       Warning: make sure that all parameters are typed as shown and that the
       disk device is correct. Failing to do so may result in severe
       filesystem corruption. The saved file should be stored in a safe place
       like a floppy disk.


OPTIONS
       -b backupfile
              If the guessed primary partition table seems consistent and
              should be written (see the -W option) backup the current MBR
              into the specified file.

       -C c,h,s
              Set the disk geometry (cylinders, heads, sectors) for the scan.
              This is useful if a disk should be scanned which was partitioned
              using a different geometry, if the device is a disk-image or if
              the disk geometry cannot be retrieved through the PCs BIOS. No
              spaces are allowed between the numbers, unless all three are
              enclosed in quotes.

       -c     Check/compare mode (implies the -q quiet option). After the scan
              is done, the resulting primary partition table is compared to
              the existing one. The return code of gpart then contains the
              number of differences (0 if they are identical except for the
              boot/active flag which cannot be guessed). This option has no
              effect if -d is given on the command line.

       -d     Do not start the guessing loop. Useful if the partition table
              should be printed (in combination with the -v option) without
              actually scanning for partitions.

       -E     Do not try to identify extended partition tables. If there are
              extended partitions on the given device gpart will most
              certainly complain about too many primary partitions because
              there can be only four primary partitions. Existing logical
              partitions will be listed as primary ones.

       -e     Do not skip disk read errors. If this option is given, and short
              disk reads or general disk read errors (EIO) are encountered,
              gpart will exit. If not given, the program tries to continue.

       -f     Full scan. When a possible partition is found, gpart normally
              skips all sectors this entry seems to occupy and continues the
              scan from the end of the last possible partition. The disk scan
              can take quite a while if this option is given, be patient.

       -g     Do not try to get the disk geometry from the OS. If the device
              is no block or character device but a plain file this option
              should be supplied. If the file to be scanned is an image of a
              disk, the geometry can be given by the -C option.

       -h     Show some help.

       -i     Run interactively. Each time a possible partition is identified
              the user is asked for confirmation.

       -K last sector
              Scan only up to the given sector or the end of the file or
              device whichever comes first.

       -k sectors
              Skip given number of sectors before the scan. Potentially useful
              if a partition is looked for at the end of a large disk.

       -L     List available filesystem/partition type modules and their
              weights, then exit.

       -l logfile
              Log output to the given file (even if -q was supplied).

       -n increment
              Scan increment: number of sectors or "s" for single sector
              increment, "h" for an increment of sectors per head (depends on
              geometry) or "c" for cylinder increment.

              The increment also influences the condition where extended
              partition tables are searched: if the scan increment is "s"
              (i.e. 1) extended partition tables are required to be on a head
              boundary, otherwise they must be on a cylinder boundary.

              If the disk geometry could not be retrieved and no geometry was
              given on the command line, the default increment is one sector.

       -q     Quiet/no output mode. However if a logfile was specified (see -l
              option) all output is written to that file. This option
              overrides the -i interactive mode.

       -s sector size
              Preset medium sector size.  gpart tries to find out the sector
              size but may fail in doing so. Probed sector sizes are 2^i,
              i=9..14 (512 to 16384 bytes). The default medium sector size is
              512 bytes.

       -t module name
              Plug in another guessing module. The module to be dynamically
              linked in must be a shared object file named "gm_<modname>.so".

       -V     Show version number.

       -v     Be verbose. This option can be given more than once resulting in
              quite a lot of information.

       -W device
              Write partition table. If a consistent primary partition table
              has been guessed it can be written to the specified file or
              device. The supplied device can be the same as the scanned one.

              Additionally the guessed partition entries can be edited. No
              checks are performed on the entered values, thus the resulting
              table is allowed to be highly inconsistent. Please beware.

              Warning: The guessed partition table should be checked very
              carefully before writing it back. You can always write the
              guessed partition table into a plain file and write this into
              sector 0 using dd(1) (see section PRECAUTIONS above).


       -w module name,weight
              Put the given module at the head of the module chain and assign
              a new weight to that module. All modules are given an initial
              weight of 1.0. Again no spaces are allowed.



       Default settings are "-n h".


EXAMPLES
       - To scan the first IDE hard disk under Linux using default settings
       type

              gpart /dev/hda

       - To print the primary partition table of the third IDE drive without
       starting the scan loop in FreeBSD type

              gpart -vvd /dev/wd2

       - If lilo(8) was installed in the master boot record (MBR) of a hard
       disk it saves the contents of the first sector in a file called
       /boot/boot.<major/minor>. To list the partitions contained in such a
       file type e.g.

              gpart -vdg /boot/boot.0300

       If the partition table contains an extended partition, gpart will
       complain about invalid extended partition tables because the extended
       entry points to sectors not within that file.

       - Usually the first primary partition starts on the second head. If
       gpart cannot identify the first partition properly this may not be the
       case.  gpart can be told to start the scan directly from sector one of
       the disk, using the sector-wise scan mode:

              gpart -k 1 -n s /dev/hdb

       - Suppose gpart identifies an NTFS partition as FAT on a certain disk.
       In this situation the "ntfs" module should be made the first module to
       be probed and given a weight higher than the usual weight of 1.0:

              gpart -w ntfs,1.5 /dev/hdb

       To list the available modules and their weights use the -L option.

       - After having checked the output of gpart at least thrice, the primary
       partition table can be written back to the device this way:

              gpart -W /dev/sdc /dev/sdc

       This of course may be extremely dangerous to your health and social
       security, so beware.

       - A hard disk with 63 sectors per head is scanned in steps of 63
       sectors. To perform the scan on every second head while skipping the
       first 1008 sectors type

              gpart -k 1008 -n 126 /dev/sda

       - If you want to see how easily gpart can be mislead, and how many
       probable partition starts are on a disk, search the whole disk really
       sector by sector, writing all output to a logfile:

              gpart -vvfn s -ql /tmp/gpart.log /dev/sd2 &

       Usually gpart will not be able to produce an educated guess of the
       primary partition table in this mode. The logfile however may contain
       enough hints to manually reconstruct the partition table.


FILES
       /dev/*
              Hard disk block devices. The naming scheme of hard disk block
              devices is OS dependent, consult your system manuals for more
              information.


DIAGNOSTICS
       There are many error message types, all of them should be self-
       explanatory. Complain if they are not.


BUGS
       gpart is beta software, so expect buggy behaviour.

       -  gpart only accepts extended partition links with one logical
       partition. There may be fdisk variants out there creating links with up
       to three logical partition entries but these are not accepted.


TO DO
       - Support big-endian architectures.
       - Test on 64-bit architectures.
       - Look for boot manager partitions (e.g. OS/2 BM).
       - Think about reconstructing logical partition chains.


AUTHOR
       Please send bug reports, suggestions, comments etc. to

              Michail Brzitwa <michail@brzitwa.de>


SEE ALSO
       fdisk(8).



Administration Tools             January 2001                         GPART(8)