1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
|
# gpart
[](https://travis-ci.org/baruch/gpart)
Gpart is a small tool which tries to guess what partitions
are on a PC type, MBR-partitioned hard disk in case the
primary partition table was damaged.
Gpart works by scanning through the device (or file) given on
the command line on a sector basis. Each guessing module is
asked if it thinks a filesystem it knows about could start at
a given sector. Several filesystem guessing modules are built
in.
Consult the manual page for command line options and usage.
## Installation
See file *INSTALL*.
## Currently recognized partitions/filesystems types
Modname | Typ | Description
:--------|:----:|:------------
fat | 0x01 | Primary DOS with 12 bit FAT
| 0x04 | Primary DOS with 16 bit FAT (<= 32MB)
| 0x06 | Primary 'big' DOS (> 32MB)
| 0x0B | DOS or Windows 95 with 32 bit FAT
| 0x0C | DOS or Windows 95 with 32 bit FAT, LBA
ntfs | 0x07 | OS/2 HPFS, NTFS, QNX or Advanced UNIX
hpfs | 0x07 | OS/2 HPFS, NTFS, QNX or Advanced UNIX
ext2 | 0x83 | Linux ext2 filesystem
lswap | 0x82 | Linux swap
bsddl | 0xA5 | FreeBSD/NetBSD/386BSD
s86dl | 0x82 | Solaris/x86 disklabel
minix | 0x80 | Minix V1
| 0x81 | Minix V2
reiserfs | 0x83 | ReiserFS filesystem
hmlvm | 0xFE | Linux LVM physical volumes
qnx4 | 0x4F | QNX 4.x
beos | 0xEB | BeOS fs
xfs | 0x83 | SGI XFS filesystem
## Guessing modules
Each guessing module must provide three functions callable from
gpart:
int xxx_init(disk_desc *d,g_module *m)
> Initialisation function. Will be called before a scan.
> It should return the minimum number of bytes it wants
> to receive for a test. The module should set the
> description of the filesystem/partition type it handles
> in `g_module.m_desc`. If the filesystem/partition type
> included a partition table like first sector (like the
> \*BSD disklabels do), the flag `m_hasptbl` should be set.
> Another flag is `m_notinext` which means the tested type
> cannot reside in a logical partition.
int xxx_term(disk_desc *d)
> Termination/cleanup function, called after the scanning
> of the device has been done.
int xxx_gfun(disk_desc *d,g_module *m)
> The actual guessing function, called from within the
> scan loop. It should test the plausibility of the
> given sectors, and return its guess in `m->m_guess` (a
> probability between 0 and 1). See existing modules
> for examples.
>
> The given file descriptor `d->d_fd` can be used for seeking
> and reading (see e.g. *gm_ext2.c* which tries to read
> the first spare superblock). If a module is convinced
> that it has found a filesystem/partition start it should
> fill in the assumed begin and size of the partition.
>
> The test performed should not be too pedantic, for
> instance it should not be relied upon that the file-
> system is clean/was properly unmounted. On the other
> hand too much tolerance leads to misguided guesses,
> so a golden middle way must be found.
## Output explanation
Here is a sample `gpart -v` run on my first IDE hard disk
(comments in block-quotes):
dev(/dev/hda) mss(512) chs(1232/255/63)(LBA) #s(19792080) size(9664mb)
> `mss` is the medium sector size, `chs` the geometry retrieved
> from the OS (or from the command line), `#s` is the total
> sector count.
Primary partition(1)
type: 006(0x06)(Primary 'big' DOS (> 32MB)) (BOOT)
size: 502mb #s(1028097) s(63-1028159)
chs: (0/1/1)-(63/254/63)d (0/1/1)-(63/254/63)r
hex: 80 01 01 00 06 FE 3F 3F 3F 00 00 00 01 B0 0F 00
> `size`: the size of the partition in megabytes, number of
> sectors and the sector range.
> `chs`: the partition table chs range (`d`) and the real one
> (`r`). If the number of cylinders is less than 1024, both
> are identical.
> `hex`: the hexadecimal representation of the partition entry
> as found in the partition table.
...
Begin scan...
Possible partition(DOS FAT), size(502mb), offset(0mb)
type: 006(0x06)(Primary 'big' DOS (> 32MB))
size: 502mb #s(1028097) s(63-1028159)
chs: (0/1/1)-(63/254/63)d (0/1/1)-(63/254/63)r
hex: 00 01 01 00 06 FE 3F 3F 3F 00 00 00 01 B0 0F 00
Possible extended partition at offset(502mb)
Possible partition(Linux ext2), size(31mb), offset(502mb)
type: 131(0x83)(Linux ext2 filesystem)
size: 31mb #s(64196) s(1028223-1092418)
chs: (64/1/1)-(67/254/62)d (64/1/1)-(67/254/62)r
hex: 00 01 01 40 83 FE 3E 43 7F B0 0F 00 C4 FA 00 00
Possible partition(Linux swap), size(125mb), offset(533mb)
type: 130(0x82)(Linux swap or Solaris/x86)
size: 125mb #s(256976) s(1092483-1349458)
chs: (68/1/1)-(83/254/62)d (68/1/1)-(83/254/62)r
hex: 00 01 01 44 82 FE 3E 53 83 AB 10 00 D0 EB 03 00
> During the scan phase all found partitions are listed by
> their real type names. The Linux swap partition above is
> recognized as Linux swap but will get the 0x82 partition
> identifier which can be both a Solaris disklabel or a
> Linux swap partition.
>
> When examining the hex values of the first primary partition
> it can be seen that they are identical to the values of the
> actual partition table (good guess) except for the first
> value (0x80 vs. 0x00). This entry denotes the partition
> 'boot' flag which cannot be guessed.
...
End scan.
Checking partitions...
Partition(Primary 'big' DOS (> 32MB)): primary
Partition(Linux ext2 filesystem): logical
Partition(Linux swap or Solaris/x86): logical
Partition(Linux LVM physical volume): logical
Partition(Linux ext2 filesystem): logical
Partition(DOS or Windows 95 with 32 bit FAT, LBA): logical
Partition(FreeBSD/NetBSD/386BSD): primary
Partition(Linux LVM physical volume): primary
Ok.
> During the scan phase gpart gathers a simple list of possible
> partitions, the check phase now tries to decide if found
> extended partitions seem consistent, if partitions do not
> overlap etc. Overlapping partitions are silently discarded,
> all remaining ones are given an attribute 'primary', 'logical',
> 'orphaned' or 'invalid'. If gpart is called like `gpart -vv ...`,
> it also tells why it thinks a partition guess is invalid.
>
> If any inconsistencies are found, gpart prints the number
> of remaining inconsistencies, otherwise it says 'Ok.'
Guessed primary partition table:
Primary partition(1)
type: 006(0x06)(Primary 'big' DOS (> 32MB))
size: 502mb #s(1028097) s(63-1028159)
chs: (0/1/1)-(63/254/63)d (0/1/1)-(63/254/63)r
hex: 00 01 01 00 06 FE 3F 3F 3F 00 00 00 01 B0 0F 00
Primary partition(2)
type: 005(0x05)(Extended DOS)
size: 6157mb #s(12611025) s(1028160-13639184)
chs: (64/0/1)-(848/254/63)d (64/0/1)-(848/254/63)r
hex: 00 00 01 40 05 FE FF 50 40 B0 0F 00 D1 6D C0 00
Primary partition(3)
type: 165(0xA5)(FreeBSD/NetBSD/386BSD)
size: 1396mb #s(2859570) s(13639185-16498754)
chs: (849/0/1)-(1023/254/63)d (849/0/1)-(1026/254/63)r
hex: 00 00 C1 51 A5 FE FF FF 11 1E D0 00 32 A2 2B 00
Primary partition(4)
type: 254(0xFE)(Linux LVM physical volume)
size: 1608mb #s(3293325) s(16498755-19792079)
chs: (1023/254/63)-(1023/254/63)d (1027/0/1)-(1231/254/63)r
hex: 00 FE FF FF FE FE FF FF 43 C0 FB 00 8D 40 32 00
> This is a resulting primary partition table. Note that
> the logical partition guesses were only used to create
> the extended partition entry. Up to now gpart cannot
> reconstruct a damaged logical partition chain itself.
>
> If a guessed primary partition table should be written to
> some file or device the user must specify (via the `-W`
> option) which partition gets the active (bootable) one.
## Author
gpart README, Aug 1999, Michail Brzitwa <mb@ichabod.han.de>
|
