SYNOPSIS

       gpart [options] device

       Options:  [-b  <backup MBR>][-C c,h,s][-c][-d][-E][-e][-f]
       [-g][-h][-i][-K <last-sector>][-k <# of sectors>] [-L] [-l
       <log  file>][-n  <increment>]  [-q][-s  <sector-size>] [-t
       <module-name>][-V][-v]  [-W   <device>][-w   <module-name,
       weight>]
 
 

DESCRIPTION

       gpart  tries to guess which partitions are on a hard disk.
       If the primary partition table has been lost,  overwritten
       or  destroyed  the  partitions still exist on the disk but
       the operating system cannot access them.

       gpart ignores the primary partition table  and  scans  the
       disk (or disk image, file) sector after sector for several
       filesystem/partition  types.  It  does  so   by   "asking"
       filesystem  recognition  modules  if  they  think  a given
       sequence of sectors resembles the beginning of a  filesys­
       tem  or partition type. Currently the following filesystem
       types are known to gpart (listed by module names) :
 

       beos   BeOS filesystem type.

       bsddl  FreeBSD/NetBSD/386BSD  disklabel   sub-partitioning
              scheme used on Intel platforms.

       ext2   Linux second extended filesystem.

       fat    MS-DOS FAT12/16/32 "filesystems".

       hpfs   IBM OS/2 High Performance filesystem.

       hmlvm  Linux  LVM physical volumes (LVM by Heinz Mauelsha­
              gen).

       lswap  Linux swap partitions (versions 0 and 1).

       minix  The Minix operating system filesystem type.

       ntfs   MS Windows NT filesystem.  The  recognition  of  an
              NTFS partition is quite weak because only little is
              known about its internals.

       qnx4   QNX 4.x filesystem.

       rfs    The Reiser filesystem (version 3.5.X, X > 11).

       s86dl  Sun Solaris on Intel platforms  uses  a  sub-parti­
              tioning  scheme on PC hard disks similar to the BSD
              disklabels.

       xfs    Silicon Graphic's journalling filesystem for Linux.

       More filesystem guessing modules can be added  at  runtime
       (see  the -t option). Please consult the gpart README file
       for detailed explanations on how to create  guessing  mod­
       ules.  All  modules  are  accompanied by a guessing weight
       factor which denotes how "educated" their guesses are com­
       pared  to  other  modules. This weight can be changed if a
       certain module keeps on mis-identifying a partition.

       Naturally only partitions which  have  been  formatted  in
       some  way  can  be  recognized. If the type of a partition
       entry in the primary partition table is changed from x  to
       y while the filesystem is still of type x, gpart will also
       still guess a type x.

       No checks are performed  whether  a  found  filesystem  is
       clean  or even consistent/mountable, so it is quite possi­
       ble that gpart may identify partitions which existed prior
       to the current partitioning scheme of the disk. Especially
       on large disks old file system headers/superblocks may  be
       present  a  long  time  until they are finally overwritten
       with user data.

       It should be stressed that gpart  does  a  very  heuristic
       job,  never  believe  its  output without any plausability
       checks. It can be easily right in its guesswork but it can
       also be terribly wrong. You have been warned.

       After having found a list of possible partition types, the
       list is checked for consistency. For example, a  partition
       which  overlaps  with  the previous one will be discarded.
       All remaining partitions are labelled with one of the fol­
       lowing  attributes:  "primary",  "logical",  "orphaned" or
       "invalid".

       A partition labelled "orphaned"  is  a  logical  partition
       which  seems ok but is missed in the chain of logical par­
       titions. This may occur if a logical partition is  deleted
       from  the extended partition table without overwriting the
       actual disk space.

       An "invalid" partition is  one  that  cannot  be  accepted
       because of various reasons. If a consistent primary parti­
       tion table was created in this process it is  printed  and
       can be written to a file or device.
 
 
 

EXTENDED PARTITIONS

       If the disk/file to be examined consists of primary parti­
       tions only, gpart has quite  a  good  chance  to  identify
       them.  Extended partitions on the other hand can result in
       a lot of problems.

       Extended partitions are  realized  as  a  linked  list  of
       extended  partition tables, each of which include an entry
       pointing to a logical partition. The size of  an  extended
       partition  depends  on  where  the  last logical partition
       ends. This means  that  extended  partitions  may  include
       "holes",  unallocated  disk  space  which  should  only be
       assigned to logical, not primary partitions.

       gpart tries to do its best to check a found chain of logi­
       cal  partitions but there are very many possible points of
       failure. If "good"  fdisk  programs  are  used  to  create
       extended  partitions,  the  resulting  tables consist of a
       zeroed boot record and the four partition entries of which
       at  least  two should be marked unused. Unfortunately e.g.
       the fdisk program shipped with Windows NT does not seem to
       zero  out  the  boot record area so gpart has to be overly
       tolerant in recognizing extended  partition  tables.  This
       tolerance may result in quite stupid guesses.
 
 
 

DISK TRANSFERS

       If  you  want to investigate hard disks from other systems
       you should note down the geometry  (number  of  cylinders,
       heads  per  cylinder  and  sectors per head) used for that
       disk, and tell gpart about this geometry.

       Investigating disks from machines with a different endian­
       ness than the scanning one has not been tested at all, and
       is currently not recommended.
 
 
 

LARGE DISKS

       gpart relies on the OS reporting the correct  disk  geome­
       try.  Unfortunately sometimes the OS may report a geometry
       smaller the the actual one (e.g. disks with more than 1024
       or 16384 cylinder).

       gpart  checks if guessed partitions extend beyond the disk
       size and marks those "invalid", but  may  be  mistaken  in
       case  the disk size is calculated from an incorrect geome­
       try. For instance if a disk with the geometry  1028/255/63
       should  be  scanned,  and the OS reports 1024/255/63 gpart
       should be called like

              gpart -C 1028,255,63 <other options> <device>
 
 
 

PRECAUTIONS

       gpart may be of some help when the primary partition table
       was  lost  or  destroyed but it can under no circumstances
       replace proper disk/partition table backups.  To save  the
       master  boot  record (MBR) including the primary partition
       table to a file type

              dd if=/dev/hda of=mbr bs=512 count=1

       exchanging /dev/hda with the block device name of the disk
       in question. This should be done for all disks in the sys-
       tem. To restore the primary partition table without  over­
       writing the MBR type

              dd   if=mbr   of=/dev/hda  bs=1  count=64  skip=446
              seek=446

       Warning: make sure that all parameters are typed as  shown
       and  that the disk device is correct. Failing to do so may
       result in severe filesystem  corruption.  The  saved  file
       should be stored in a safe place like a floppy disk.
 
 
 

OPTIONS

       -b backupfile
              If  the  guessed primary partition table seems con­
              sistent and should be written (see the  -W  option)
              backup the current MBR into the specified file.

       -C c,h,s
              Set  the  disk geometry (cylinders, heads, sectors)
              for the scan. This is useful if a  disk  should  be
              scanned  which  was  partitioned  using a different
              geometry, if the device is a disk-image or  if  the
              disk  geometry  cannot be retrieved through the PCs
              BIOS. No spaces are allowed  between  the  numbers,
              unless all three are enclosed in quotes.

       -c     Check/compare  mode  (implies the -q quiet option).
              After the scan is done, the resulting primary  par­
              tition  table  is compared to the existing one. The
              return code of gpart then contains  the  number  of
              differences (0 if they are identical except for the
              boot/active flag which  cannot  be  guessed).  This
              option  has no effect if -d is given on the command
              line.

       -d     Do not start the guessing loop. Useful if the  par­
              tition table should be printed (in combination with
              the -v option) without actually scanning for parti­
              tions.

       -E     Do  not  try to identify extended partition tables.
              If there  are  extended  partitions  on  the  given
              device gpart will most certainly complain about too
              many primary partitions because there can  be  only
              four  primary  partitions.  Existing logical parti­
              tions will be listed as primary ones.

       -e     Do not skip disk read errors.  If  this  option  is
              given,  and  short  disk reads or general disk read
              errors (EIO) are encountered, gpart will  exit.  If
              not given, the program tries to continue.

       -f     Full  scan.  When  a  possible  partition is found,
              gpart normally skips all sectors this  entry  seems
              to  occupy  and  continues the scan from the end of
              the last possible partition. The disk scan can take
              quite  a while if this option is given, be patient.

       -g     Do not try to get the disk geometry from the OS. If
              the  device  is  no block or character device but a
              plain file this option should be supplied.  If  the
              file to be scanned is an image of a disk, the geom­
              etry can be given by the -C option.

       -h     Show some help.

       -i     Run interactively. Each time a  possible  partition
              is identified the user is asked for confirmation.

       -K last sector
              Scan  only up to the given sector or the end of the
              file or device whichever comes first.

       -k sectors
              Skip given  number  of  sectors  before  the  scan.
              Potentially  useful if a partition is looked for at
              the end of a large disk.

       -L     List available  filesystem/partition  type  modules
              and their weights, then exit.

       -l logfile
              Log  output  to the given file (even if -q was sup­
              plied).

       -n increment
              Scan increment: number of sectors or "s" for single
              sector  increment,  "h" for an increment of sectors
              per head (depends on geometry) or "c" for  cylinder
              increment.

              The  increment  also influences the condition where
              extended partition tables are searched: if the scan
              increment is "s" (i.e. 1) extended partition tables
              are required to be on a  head  boundary,  otherwise
              they must be on a cylinder boundary.

              If  the disk geometry could not be retrieved and no
              geometry was given on the command line, the default
              increment is one sector.

       -q     Quiet/no  output  mode.  However  if  a logfile was
              specified (see -l option) all output is written  to
              that file. This option overrides the -i interactive
              mode.

       -s sector size
              Preset medium sector size.  gpart tries to find out
              the  sector  size  but may fail in doing so. Probed
              sector sizes are 2^i, i=9..14 (512 to 16384 bytes).
              The default medium sector size is 512 bytes.

       -t module name
              Plug  in  another guessing module. The module to be
              dynamically linked in must be a shared object  file
              named "gm_<modname>.so".

       -V     Show version number.

       -v     Be verbose. This option can be given more than once
              resulting in quite a lot of information.

       -W device
              Write partition table. If a consistent primary par­
              tition  table has been guessed it can be written to
              the specified file or device. The  supplied  device
              can be the same as the scanned one.

              Additionally  the  guessed partition entries can be
              edited. No checks are performed on the entered val­
              ues,  thus  the  resulting  table  is allowed to be
              highly inconsistent. Please beware.

              Warning: The  guessed  partition  table  should  be
              checked  very carefully before writing it back. You
              can always write the guessed partition table into a
              plain file and write this into sector 0 using dd(1)
              (see section PRECAUTIONS above).
 

       -w module name,weight
              Put the given module at  the  head  of  the  module
              chain  and  assign a new weight to that module. All
              modules are given an initial weight of  1.0.  Again
              no spaces are allowed.
 
 

       Default settings are "-n h".
 
 
 

EXAMPLES

       - To  scan  the  first  IDE  hard  disk  under Linux using
       default settings type

              gpart /dev/hda

       - To print the primary partition table of  the  third  IDE
       drive without starting the scan loop in FreeBSD type

              gpart -vvd /dev/wd2

       - If lilo(8) was installed in the master boot record (MBR)
       of a hard disk it saves the contents of the  first  sector
       in  a  file  called  /boot/boot.<major/minor>. To list the
       partitions contained in such a file type e.g.

              gpart -vdg /boot/boot.0300

       If the partition table  contains  an  extended  partition,
       gpart  will  complain  about  invalid  extended  partition
       tables because the extended entry points  to  sectors  not
       within that file.

       - Usually the first primary partition starts on the second
       head. If gpart cannot identify the first  partition  prop­
       erly this may not be the case.  gpart can be told to start
       the scan directly from sector one of the disk,  using  the
       sector-wise scan mode:

              gpart -k 1 -n s /dev/hdb

       - Suppose  gpart  identifies an NTFS partition as FAT on a
       certain disk. In this situation the "ntfs"  module  should
       be  made  the first module to be probed and given a weight
       higher than the usual weight of 1.0:

              gpart -w ntfs,1.5 /dev/hdb

       To list the available modules and their weights use the -L
       option.

       - After  having  checked  the  output  of  gpart  at least
       thrice, the primary partition table can be written back to
       the device this way:

              gpart -W /dev/sdc /dev/sdc

       This  of  course may be extremely dangerous to your health
       and social security, so beware.

       - A hard disk with 63 sectors per head is scanned in steps
       of  63  sectors.  To perform the scan on every second head
       while skipping the first 1008 sectors type

              gpart -k 1008 -n 126 /dev/sda

       - If you want to see how easily gpart can be mislead,  and
       how  many  probable partition starts are on a disk, search
       the whole disk really sector by sector, writing all output
       to a logfile:

              gpart -vvfn s -ql /tmp/gpart.log /dev/sd2 &

       Usually  gpart  will  not  be  able to produce an educated
       guess of the primary partition table  in  this  mode.  The
       logfile  however  may  contain  enough  hints  to manually
       reconstruct the partition table.
 
 
 

FILES

       /dev/*
              Hard disk block devices. The naming scheme of  hard
              disk  block  devices  is OS dependent, consult your
              system manuals for more information.
 
 
 

DIAGNOSTICS

       There are many error message types, all of them should  be
       self-explanatory. Complain if they are not.
 
 
 

BUGS

       gpart is beta software, so expect buggy behaviour.

       -   gpart  only  accepts extended partition links with one
       logical partition. There may be fdisk variants  out  there
       creating  links with up to three logical partition entries
       but these are not accepted.
 
 
 

TO DO

       - Support big-endian architectures.
       - Test on 64-bit architectures.
       - Look for boot manager partitions (e.g. OS/2 BM).
       - Think about reconstructing logical partition chains.
 
 
 

AUTHOR

       Please send bug reports, suggestions, comments etc. to

              Michail Brzitwa <michail@brzitwa.de>
 
 
 

SEE ALSO

       fdisk(8).