Provided by: gpart_0.1h-4_i386 bug

NAME

       gpart - guess PC-type hard disk partitions

SYNOPSIS

       gpart [options] device

       Options:     [-b     <backup     MBR>][-C    c,h,s][-c][-d][-E][-e][-f]
       [-g][-h][-i][-K  <last-sector>][-k  <#  of  sectors>]  [-L]  [-l   <log
       file>][-n    <increment>]    [-q][-s    <sector-size>]   [-t   <module-
       name>][-V][-v] [-W <device>][-w <module-name, weight>]

DESCRIPTION

       gpart tries to guess which partitions are  on  a  hard  disk.   If  the
       primary  partition  table  has  been lost, overwritten or destroyed the
       partitions still exist on the disk  but  the  operating  system  cannot
       access them.

       gpart  ignores  the primary partition table and scans the disk (or disk
       image, file)  sector  after  sector  for  several  filesystem/partition
       types.  It  does  so by "asking" filesystem recognition modules if they
       think a  given  sequence  of  sectors  resembles  the  beginning  of  a
       filesystem  or partition type. Currently the following filesystem types
       are known to gpart (listed by module names) :

       beos   BeOS filesystem type.

       bsddl  FreeBSD/NetBSD/386BSD disklabel sub-partitioning scheme used  on
              Intel platforms.

       ext2   Linux second extended filesystem.

       fat    MS-DOS FAT12/16/32 "filesystems".

       hpfs   IBM OS/2 High Performance filesystem.

       hmlvm  Linux LVM physical volumes (LVM by Heinz Mauelshagen).

       lswap  Linux swap partitions (versions 0 and 1).

       minix  The Minix operating system filesystem type.

       ntfs   MS Windows NT/2000 filesystem.

       qnx4   QNX 4.x filesystem.

       rfs    The Reiser filesystem (version 3.5.X, X > 11).

       s86dl  Sun Solaris on Intel platforms uses a sub-partitioning scheme on
              PC hard disks similar to the BSD disklabels.

       xfs    Silicon Graphic’s journalling filesystem for Linux.

       More filesystem guessing modules can be added at runtime  (see  the  -t
       option). Please consult the gpart README file for detailed explanations
       on how to create guessing modules. All modules  are  accompanied  by  a
       guessing  weight  factor which denotes how "educated" their guesses are
       compared to other modules. This weight can  be  changed  if  a  certain
       module keeps on mis-identifying a partition.

       Naturally  only partitions which have been formatted in some way can be
       recognized. If the type of a partition entry in the  primary  partition
       table  is  changed from x to y while the filesystem is still of type x,
       gpart will also still guess a type x.

       No checks are performed whether a found filesystem  is  clean  or  even
       consistent/mountable,  so  it is quite possible that gpart may identify
       partitions which existed prior to the current  partitioning  scheme  of
       the disk. Especially on large disks old file system headers/superblocks
       may be present a long time until they are finally overwritten with user
       data.

       It  should  be  stressed  that  gpart  does a very heuristic job, never
       believe its output without any plausability checks. It  can  be  easily
       right in its guesswork but it can also be terribly wrong. You have been
       warned.

       After having found a list of possible  partition  types,  the  list  is
       checked  for  consistency. For example, a partition which overlaps with
       the previous one  will  be  discarded.  All  remaining  partitions  are
       labelled  with  one  of the following attributes: "primary", "logical",
       "orphaned" or "invalid".

       A partition labelled "orphaned" is a logical partition which  seems  ok
       but  is  missed in the chain of logical partitions. This may occur if a
       logical partition is deleted from the extended partition table  without
       overwriting the actual disk space.

       An  "invalid"  partition  is  one  that  cannot  be accepted because of
       various reasons. If a consistent primary partition table was created in
       this process it is printed and can be written to a file or device.

EXTENDED PARTITIONS

       If  the  disk/file  to be examined consists of primary partitions only,
       gpart has quite a good chance to identify them. Extended partitions  on
       the other hand can result in a lot of problems.

       Extended partitions are realized as a linked list of extended partition
       tables, each of which include an entry pointing to a logical partition.
       The  size  of  an  extended partition depends on where the last logical
       partition  ends.  This  means  that  extended  partitions  may  include
       "holes",  unallocated  disk  space  which  should  only  be assigned to
       logical, not primary partitions.

       gpart tries to do its best to check a found chain of logical partitions
       but  there  are  very  many possible points of failure. If "good" fdisk
       programs are used to create extended partitions, the  resulting  tables
       consist of a zeroed boot record and the four partition entries of which
       at least two should be marked  unused.  Unfortunately  e.g.  the  fdisk
       program  shipped  with  Windows  NT  does not seem to zero out the boot
       record area so gpart has to be overly tolerant in recognizing  extended
       partition tables. This tolerance may result in quite stupid guesses.

DISK TRANSFERS

       If  you  want  to  investigate hard disks from other systems you should
       note down the geometry (number of cylinders,  heads  per  cylinder  and
       sectors  per  head)  used  for  that  disk,  and  tell gpart about this
       geometry.

       Investigating disks from machines with a different endianness than  the
       scanning  one  has  not  been  tested  at  all,  and  is  currently not
       recommended.

LARGE DISKS

       gpart  relies  on  the  OS  reporting  the   correct   disk   geometry.
       Unfortunately  sometimes  the  OS may report a geometry smaller the the
       actual one (e.g. disks with more than 1024 or 16384 cylinder).

       gpart checks if guessed partitions extend  beyond  the  disk  size  and
       marks  those  "invalid",  but  may be mistaken in case the disk size is
       calculated from an incorrect geometry. For instance if a disk with  the
       geometry  1028/255/63 should be scanned, and the OS reports 1024/255/63
       gpart should be called like

              gpart -C 1028,255,63 <other options> <device>

PRECAUTIONS

       gpart may be of some help when the primary partition table was lost  or
       destroyed   but   it   can   under   no  circumstances  replace  proper
       disk/partition table backups.  To save the  master  boot  record  (MBR)
       including the primary partition table to a file type

              dd if=/dev/hda of=mbr bs=512 count=1

       exchanging /dev/hda with the block device name of the disk in question.
       This should be done for all disks in the system. To restore the primary
       partition table without overwriting the MBR type

              dd if=mbr of=/dev/hda bs=1 count=64 skip=446 seek=446

       Warning:  make sure that all parameters are typed as shown and that the
       disk device  is  correct.  Failing  to  do  so  may  result  in  severe
       filesystem  corruption. The saved file should be stored in a safe place
       like a floppy disk.

OPTIONS

       -b backupfile
              If the guessed primary  partition  table  seems  consistent  and
              should  be  written  (see  the -W option) backup the current MBR
              into the specified file.

       -C c,h,s
              Set the disk geometry (cylinders, heads, sectors) for the  scan.
              This is useful if a disk should be scanned which was partitioned
              using a different geometry, if the device is a disk-image or  if
              the  disk  geometry cannot be retrieved through the PCs BIOS. No
              spaces are allowed between the numbers,  unless  all  three  are
              enclosed in quotes.

       -c     Check/compare mode (implies the -q quiet option). After the scan
              is done, the resulting primary partition table  is  compared  to
              the  existing  one.  The  return code of gpart then contains the
              number of differences (0 if they are identical  except  for  the
              boot/active  flag  which  cannot be guessed). This option has no
              effect if -d is given on the command line.

       -d     Do not start the guessing loop. Useful if  the  partition  table
              should  be  printed  (in combination with the -v option) without
              actually scanning for partitions.

       -E     Do not try to identify extended partition tables. If  there  are
              extended   partitions  on  the  given  device  gpart  will  most
              certainly complain about too  many  primary  partitions  because
              there  can  be  only  four  primary partitions. Existing logical
              partitions will be listed as primary ones.

       -e     Do not skip disk read errors. If this option is given, and short
              disk  reads  or  general disk read errors (EIO) are encountered,
              gpart will exit. If not given, the program tries to continue.

       -f     Full scan. When a possible partition is  found,  gpart  normally
              skips  all  sectors this entry seems to occupy and continues the
              scan from the end of the last possible partition. The disk  scan
              can take quite a while if this option is given, be patient.

       -g     Do  not  try to get the disk geometry from the OS. If the device
              is no block or character device but a  plain  file  this  option
              should  be  supplied. If the file to be scanned is an image of a
              disk, the geometry can be given by the -C option.

       -h     Show some help.

       -i     Run interactively. Each time a possible partition is  identified
              the user is asked for confirmation.

       -K last sector
              Scan  only  up  to  the  given  sector or the end of the file or
              device whichever comes first.

       -k sectors
              Skip given number of sectors before the scan. Potentially useful
              if a partition is looked for at the end of a large disk.

       -L     List  available  filesystem/partition  type  modules  and  their
              weights, then exit.

       -l logfile
              Log output to the given file (even if -q was supplied).

       -n increment
              Scan increment: number of  sectors  or  "s"  for  single  sector
              increment,  "h" for an increment of sectors per head (depends on
              geometry) or "c" for cylinder increment.

              The increment  also  influences  the  condition  where  extended
              partition  tables  are  searched:  if  the scan increment is "s"
              (i.e. 1) extended partition tables are required to be on a  head
              boundary, otherwise they must be on a cylinder boundary.

              If  the disk geometry could not be retrieved and no geometry was
              given on the command line, the default increment is one  sector.

       -q     Quiet/no output mode. However if a logfile was specified (see -l
              option)  all  output  is  written  to  that  file.  This  option
              overrides the -i interactive mode.

       -s sector size
              Preset  medium  sector size.  gpart tries to find out the sector
              size but may fail in doing so.  Probed  sector  sizes  are  2^i,
              i=9..14  (512 to 16384 bytes). The default medium sector size is
              512 bytes.

       -t module name
              Plug in another guessing module. The module  to  be  dynamically
              linked  in must be a shared object file named "gm_<modname>.so".

       -V     Show version number.

       -v     Be verbose. This option can be given more than once resulting in
              quite a lot of information.

       -W device
              Write  partition  table. If a consistent primary partition table
              has been guessed it can be written  to  the  specified  file  or
              device.  The supplied device can be the same as the scanned one.

              Additionally the guessed partition entries  can  be  edited.  No
              checks  are  performed on the entered values, thus the resulting
              table is allowed to be highly inconsistent. Please beware.

              Warning: The guessed partition  table  should  be  checked  very
              carefully  before  writing  it  back.  You  can always write the
              guessed partition table into a plain file and  write  this  into
              sector 0 using dd(1) (see section PRECAUTIONS above).

       -w module name,weight
              Put  the given module at the head of the module chain and assign
              a new weight to that module. All modules are  given  an  initial
              weight of 1.0. Again no spaces are allowed.

       Default settings are "-n h".

EXAMPLES

       - To  scan  the  first IDE hard disk under Linux using default settings
       type

              gpart /dev/hda

       - To print the primary partition table of the third IDE  drive  without
       starting the scan loop in FreeBSD type

              gpart -vvd /dev/wd2

       - If  lilo(8)  was  installed in the master boot record (MBR) of a hard
       disk it saves the contents  of  the  first  sector  in  a  file  called
       /boot/boot.<major/minor>.  To  list  the partitions contained in such a
       file type e.g.

              gpart -vdg /boot/boot.0300

       If the partition table  contains  an  extended  partition,  gpart  will
       complain  about  invalid extended partition tables because the extended
       entry points to sectors not within that file.

       - Usually the first primary partition starts on  the  second  head.  If
       gpart  cannot identify the first partition properly this may not be the
       case.  gpart can be told to start the scan directly from sector one  of
       the disk, using the sector-wise scan mode:

              gpart -k 1 -n s /dev/hdb

       - Suppose  gpart identifies an NTFS partition as FAT on a certain disk.
       In this situation the "ntfs" module should be made the first module  to
       be probed and given a weight higher than the usual weight of 1.0:

              gpart -w ntfs,1.5 /dev/hdb

       To list the available modules and their weights use the -L option.

       - After having checked the output of gpart at least thrice, the primary
       partition table can be written back to the device this way:

              gpart -W /dev/sdc /dev/sdc

       This of course may be extremely dangerous to  your  health  and  social
       security, so beware.

       - A  hard  disk  with  63  sectors  per  head is scanned in steps of 63
       sectors. To perform the scan on every second head  while  skipping  the
       first 1008 sectors type

              gpart -k 1008 -n 126 /dev/sda

       - If  you  want  to  see  how easily gpart can be mislead, and how many
       probable partition starts are on a disk, search the whole  disk  really
       sector by sector, writing all output to a logfile:

              gpart -vvfn s -ql /tmp/gpart.log /dev/sd2 &

       Usually  gpart  will  not  be  able to produce an educated guess of the
       primary partition table in this mode. The logfile however  may  contain
       enough hints to manually reconstruct the partition table.

FILES

       /dev/*
              Hard  disk  block  devices. The naming scheme of hard disk block
              devices is OS dependent, consult your system  manuals  for  more
              information.

DIAGNOSTICS

       There  are  many  error  message  types,  all  of  them should be self-
       explanatory. Complain if they are not.

BUGS

       gpart is beta software, so expect buggy behaviour.

       -  gpart  only  accepts  extended  partition  links  with  one  logical
       partition. There may be fdisk variants out there creating links with up
       to three logical partition entries but these are not accepted.

TO DO

       - Support big-endian architectures.
       - Test on 64-bit architectures.
       - Look for boot manager partitions (e.g. OS/2 BM).
       - Think about reconstructing logical partition chains.

AUTHOR

       Please send bug reports, suggestions, comments etc. to

              Michail Brzitwa <michail@brzitwa.de>

SEE ALSO

       fdisk(8).