cgsecurity.org

Hi everyone

Looking for some help for a recent blunder I had.
I dd image an old unix disk ( i386 PrimOS ) to a file ( dd if=/dev/sdc of=oldmaxtor.dd ), and didn't check it after doing so, original disk was wiped out, and I am trying to write the image back to a new disk.

fdisk -l oldmaxtor.dd shows nothing, nor does writing it back to the actual disk (in terms of a visible partition structure).

I ran testdisk on the oldmaxtor.dd file ...and the only menu selection which can find the old partition structure I want to restore is: [None ] Non partitioned media

When I scan the disk with [None ] Non partitioned media -> Quick Search -> Enter to continue -> Deeper Search, I am presented the following;
I want to write this back to the disk! but... cannot as testdisk says "Write isn't available because the partition table type "None" has been selected."

So, since this was an i386 disk, I went back to select disk -> [Intel ] -> Analyze -> Quick search -> Enter -> Deeper Search and get So I hit "A" to add, and entered in start cyl0, head 6, sector 9, and end on
I set the partition type to Linux for now, until I can figure out what that was, but I am presented with this screen just before writing the changes... and for some reason I have a EXTended listed first - What!?
Any ideas how I can restore this properly ?

I have tried to recreate the partitions with fdisk, but those don't seem to quite line up!

thanks for any help!
Jonathan

jc179 wrote: 20 Apr 2022, 22:57 Hi everyone

Looking for some help for a recent blunder I had.
I dd image an old unix disk ( i386 PrimOS ) to a file ( dd if=/dev/sdc of=oldmaxtor.dd ), and didn't check it after doing so, original disk was wiped out, and I am trying to write the image back to a new disk.

fdisk -l oldmaxtor.dd shows nothing, nor does writing it back to the actual disk (in terms of a visible partition structure).

The parameter -l does not write anything. It just lists an existing table or do I get something wrong?

I ran testdisk on the oldmaxtor.dd file

Code: Select all

Select a media (use Arrow keys, then press Enter):
>Disk oldmaxtor.dd - 259 MB / 247 MiB

...and the only menu selection which can find the old partition structure I want to restore is: [None ] Non partitioned media

When I scan the disk with [None ] Non partitioned media -> Quick Search -> Enter to continue -> Deeper Search, I am presented the following;

Code: Select all

Disk oldmaxtor.dd - 259 MB / 247 MiB - CHS 32 255 63
     Partition               Start        End    Size in sectors
>P SysV 4                   0   6  9     1 197 62      28152
 P SysV 4                   5 130 54    31 118 17     416898 [usr]

I want to write this back to the disk! but... cannot as testdisk says "Write isn't available because the partition table type "None" has been selected."

So, since this was an i386 disk, I went back to select disk -> [Intel ] -> Analyze -> Quick search -> Enter -> Deeper Search and get

Code: Select all

Disk oldmaxtor.dd - 259 MB / 247 MiB - CHS 32 255 63

     Partition                  Start        End    Size in sectors
No partition found or selected for recovery

So I hit "A" to add, and entered in start cyl0, head 6, sector 9, and end on

Code: Select all

Disk oldmaxtor.dd - 259 MB / 247 MiB - CHS 32 255 63

  No partition             0   6  9     1 197 62      28152

 [Cylinder]  [  Head  ]  [ Sector ]  [Cylinder]  [  Head  ]  [ Sector ]
>[  Type  ]  [  Done  ]

                             Change partition type

I set the partition type to Linux for now, until I can figure out what that was, but I am presented with this screen just before writing the changes... and for some reason I have a EXTended listed first - What!?

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk oldmaxtor.dd - 259 MB / 247 MiB - CHS 32 255 63

     Partition                  Start        End    Size in sectors

 1 E extended                 0   1  1     1 254 63      32067    <- Uh, where'd that come from ? 
 5 L Linux                    0   6  9     1 197 62      28152   <- why is this part #5, I want to do part #1

The number 1,2,3 and 4 are reserved for primary partitions.

Any ideas how I can restore this properly ?

I have tried to recreate the partitions with fdisk, but those don't seem to quite line up!

You did not document what you did when writing using fdisk.

Why are you using an outdated version of Testdisk?

The parameter -l does not write anything. It just lists an existing table or do I get something wrong?

Ah, sorry it is probably my communication here - Yes, "fdisk -l" only prints the existing partition table, that is all I was trying to show, is that fdisk -l ddfile does not print (or recognize ) the partition table... : ( I did not make any 'writes' to this image with fdisk at all. I don't know what to write, as the output from testdisk appears to be cyl-heads-sectors, which I do not know how to translate to starting cylinder or sector to even try partitioning in fdisk.

###############################

The number 1,2,3 and 4 are reserved for primary partitions.

Yes, I want to put back primary partition #1 and Primary partition #2 as shown here :
Results
P SysV 4 0 3 8 28 6 9 14076
SysV4, 14 MB / 13 MiB
P SysV 4 89 2 17 509 4 21 208449 [usr]
SysV4, 213 MB / 203 MiB




I have tried to recreate the partitions with fdisk, but those don't seem to quite line up!

You did not document what you did when writing using fdisk.

Why are you using an outdated version of Testdisk?

to clarify, I did not write anything with fdisk - see above answer on that..

I didn't realize my testdisk version was so old, will update that! thanks !