Provided by: gpart_0.3-6_amd64 bug

NAME

       gpart - guess PC-type hard disk partitions

SYNOPSIS

       gpart [options] device

       Options: [-b <backup MBR>][-C c,h,s][-c][-d][-E][-e][-f] [-g][-h][-i][-K <last-sector>][-k
       <# of sectors>] [-L] [-l <log file>][-n <increment>] [-q][-s <sector-size>]  [-t  <module-
       name>][-V][-v] [-W <device>][-w <module-name, weight>]

DESCRIPTION

       gpart  tries to guess which partitions are on a hard disk.  If the primary partition table
       has been lost, overwritten or destroyed the partitions still exist on  the  disk  but  the
       operating system cannot access them.

       gpart  ignores the primary partition table and scans the disk (or disk image, file) sector
       after sector for several filesystem/partition types. It does  so  by  "asking"  filesystem
       recognition modules if they think a given sequence of sectors resembles the beginning of a
       filesystem or partition type. Currently the following filesystem types are known to  gpart
       (listed by module names) :

       beos   BeOS filesystem type.

       bsddl  FreeBSD/NetBSD/386BSD disklabel sub-partitioning scheme used on Intel platforms.

       ext2   Linux second extended filesystem.

       fat    MS-DOS FAT12/16/32 "filesystems".

       hpfs   IBM OS/2 High Performance filesystem.

       hmlvm  Linux LVM physical volumes (LVM by Heinz Mauelshagen).

       lswap  Linux swap partitions (versions 0 and 1).

       minix  The Minix operating system filesystem type.

       ntfs   MS Windows NT/2000 filesystem.

       qnx4   QNX 4.x filesystem.

       reiserfs
              The Reiser filesystem (version 3.5.X, X > 11, 3.6.X).

       s86dl  Sun  Solaris  on  Intel  platforms  uses a sub-partitioning scheme on PC hard disks
              similar to the BSD disklabels.

       xfs    Silicon Graphic's journalling filesystem for Linux.

       More filesystem guessing modules can be added at  runtime  (see  the  -t  option).  Please
       consult the gpart README file for detailed explanations on how to create guessing modules.
       All modules are accompanied by a guessing weight factor which denotes how "educated" their
       guesses  are  compared  to  other  modules. This weight can be changed if a certain module
       keeps on mis-identifying a partition.

       Naturally only partitions which have been formatted in some way can be recognized. If  the
       type  of a partition entry in the primary partition table is changed from x to y while the
       filesystem is still of type x, gpart will also still guess a type x.

       No checks are performed whether a found filesystem is clean or even  consistent/mountable,
       so  it  is  quite  possible  that gpart may identify partitions which existed prior to the
       current partitioning scheme of the  disk.  Especially  on  large  disks  old  file  system
       headers/superblocks  may  be  present  a long time until they are finally overwritten with
       user data.

       It should be stressed that gpart does a very  heuristic  job,  never  believe  its  output
       without  any  plausability checks. It can be easily right in its guesswork but it can also
       be terribly wrong. You have been warned.

       After having  found  a  list  of  possible  partition  types,  the  list  is  checked  for
       consistency.  For  example,  a  partition  which  overlaps  with  the previous one will be
       discarded. All remaining partitions are labelled with one  of  the  following  attributes:
       "primary", "logical", "orphaned" or "invalid".

       A partition labelled "orphaned" is a logical partition which seems ok but is missed in the
       chain of logical partitions. This may occur if a logical partition  is  deleted  from  the
       extended partition table without overwriting the actual disk space.

       An  "invalid"  partition  is  one that cannot be accepted because of various reasons. If a
       consistent primary partition table was created in this process it is printed  and  can  be
       written to a file or device.

EXTENDED PARTITIONS

       If  the  disk/file  to  be examined consists of primary partitions only, gpart has quite a
       good chance to identify them. Extended partitions on the other hand can result in a lot of
       problems.

       Extended  partitions  are  realized as a linked list of extended partition tables, each of
       which include an entry pointing to a logical partition. The size of an extended  partition
       depends  on where the last logical partition ends. This means that extended partitions may
       include "holes", unallocated disk space which should only  be  assigned  to  logical,  not
       primary partitions.

       gpart tries to do its best to check a found chain of logical partitions but there are very
       many possible points of failure. If "good" fdisk programs  are  used  to  create  extended
       partitions,  the  resulting  tables consist of a zeroed boot record and the four partition
       entries of which at least two should  be  marked  unused.  Unfortunately  e.g.  the  fdisk
       program  shipped  with  Windows NT does not seem to zero out the boot record area so gpart
       has to be overly tolerant in recognizing extended partition  tables.  This  tolerance  may
       result in quite stupid guesses.

DISK TRANSFERS

       If you want to investigate hard disks from other systems you should note down the geometry
       (number of cylinders, heads per cylinder and sectors per head) used  for  that  disk,  and
       tell gpart about this geometry.

       Investigating  disks  from  machines with a different endianness than the scanning one has
       not been tested at all, and is currently not recommended.

LARGE DISKS

       gpart relies on the OS reporting the correct disk geometry.  Unfortunately  sometimes  the
       OS  may  report  a  geometry smaller the the actual one (e.g. disks with more than 1024 or
       16384 cylinder).

       gpart checks if guessed partitions extend beyond the disk size and marks those  "invalid",
       but  may  be  mistaken in case the disk size is calculated from an incorrect geometry. For
       instance if a disk with the geometry 1028/255/63 should be scanned,  and  the  OS  reports
       1024/255/63 gpart should be called like

              gpart -C 1028,255,63 <other options> <device>

PRECAUTIONS

       gpart  may  be  of some help when the primary partition table was lost or destroyed but it
       can under no circumstances replace proper  disk/partition  table  backups.   To  save  the
       master boot record (MBR) including the primary partition table to a file type

              dd if=/dev/hda of=mbr bs=512 count=1

       exchanging  /dev/hda  with  the  block device name of the disk in question. This should be
       done for all disks  in  the  system.  To  restore  the  primary  partition  table  without
       overwriting the MBR type

              dd if=mbr of=/dev/hda bs=1 count=64 skip=446 seek=446

       Warning:  make  sure  that  all  parameters are typed as shown and that the disk device is
       correct. Failing to do so may result in  severe  filesystem  corruption.  The  saved  file
       should be stored in a safe place like a floppy disk.

OPTIONS

       -b backupfile
              If  the guessed primary partition table seems consistent and should be written (see
              the -W option) backup the current MBR into the specified file.

       -C c,h,s
              Set the disk geometry (cylinders, heads, sectors) for the scan. This is useful if a
              disk  should  be  scanned  which was partitioned using a different geometry, if the
              device is a disk-image or if the disk geometry cannot be retrieved through the  PCs
              BIOS.  No  spaces are allowed between the numbers, unless all three are enclosed in
              quotes.

       -c     Check/compare mode (implies the -q quiet option).  After  the  scan  is  done,  the
              resulting  primary partition table is compared to the existing one. The return code
              of gpart then contains the number of differences (0 if they  are  identical  except
              for  the boot/active flag which cannot be guessed). This option has no effect if -d
              is given on the command line.

       -d     Do not start the guessing loop. Useful if the partition table should be printed (in
              combination with the -v option) without actually scanning for partitions.

       -E     Do  not try to identify extended partition tables. If there are extended partitions
              on the given device gpart will most  certainly  complain  about  too  many  primary
              partitions  because  there  can  be  only four primary partitions. Existing logical
              partitions will be listed as primary ones.

       -e     Do not skip disk read errors. If this option is given,  and  short  disk  reads  or
              general  disk read errors (EIO) are encountered, gpart will exit. If not given, the
              program tries to continue.

       -f     Full scan. When a possible partition is found, gpart  normally  skips  all  sectors
              this entry seems to occupy and continues the scan from the end of the last possible
              partition. The disk scan can take quite  a  while  if  this  option  is  given,  be
              patient.

       -g     Do  not  try  to  get  the  disk geometry from the OS. If the device is no block or
              character device but a plain file this option should be supplied. If the file to be
              scanned is an image of a disk, the geometry can be given by the -C option.

       -h     Show some help.

       -i     Run  interactively.  Each time a possible partition is identified the user is asked
              for confirmation.

       -K last sector
              Scan only up to the given sector or the end of the file or device  whichever  comes
              first.

       -k sectors
              Skip  given number of sectors before the scan. Potentially useful if a partition is
              looked for at the end of a large disk.

       -L     List available filesystem/partition type modules and their weights, then exit.

       -l logfile
              Log output to the given file (even if -q was supplied).

       -n increment
              Scan increment: number of sectors or "s" for single sector increment,  "h"  for  an
              increment of sectors per head (depends on geometry) or "c" for cylinder increment.

              The  increment  also  influences  the condition where extended partition tables are
              searched: if the scan increment is "s"  (i.e.  1)  extended  partition  tables  are
              required to be on a head boundary, otherwise they must be on a cylinder boundary.

              If  the  disk  geometry  could  not  be  retrieved and no geometry was given on the
              command line, the default increment is one sector.

       -q     Quiet/no output mode. However if a logfile was specified (see -l option) all output
              is written to that file. This option overrides the -i interactive mode.

       -s sector size
              Preset medium sector size.  gpart tries to find out the sector size but may fail in
              doing so. Probed sector sizes are 2^i, i=9..14 (512 to 16384  bytes).  The  default
              medium sector size is 512 bytes.

       -V     Show version number.

       -v     Be  verbose.  This  option  can be given more than once resulting in quite a lot of
              information.

       -W device
              Write partition table. If a consistent primary partition table has been guessed  it
              can be written to the specified file or device. The supplied device can be the same
              as the scanned one.

              Additionally the guessed partition entries can be edited. No checks  are  performed
              on  the  entered  values,  thus  the  resulting  table  is  allowed  to  be  highly
              inconsistent. Please beware.

              Warning: The guessed partition  table  should  be  checked  very  carefully  before
              writing it back. You can always write the guessed partition table into a plain file
              and write this into sector 0 using dd(1) (see section PRECAUTIONS above).

       -w module name,weight
              Put the given module at the head of the module chain and assign  a  new  weight  to
              that  module.  All  modules are given an initial weight of 1.0. Again no spaces are
              allowed.

       Default settings are "-n h".

EXAMPLES

       - To scan the first IDE hard disk under Linux using default settings type

              gpart /dev/hda

       - To print the primary partition table of the third IDE drive without  starting  the  scan
       loop in FreeBSD type

              gpart -vvd /dev/wd2

       - If  lilo(8)  was  installed  in the master boot record (MBR) of a hard disk it saves the
       contents of the first sector in  a  file  called  /boot/boot.<major/minor>.  To  list  the
       partitions contained in such a file type e.g.

              gpart -vdg /boot/boot.0300

       If  the  partition table contains an extended partition, gpart will complain about invalid
       extended partition tables because the extended entry points to  sectors  not  within  that
       file.

       - Usually  the first primary partition starts on the second head. If gpart cannot identify
       the first partition properly this may not be the case.  gpart can be  told  to  start  the
       scan directly from sector one of the disk, using the sector-wise scan mode:

              gpart -k 1 -n s /dev/hdb

       - Suppose  gpart  identifies an NTFS partition as FAT on a certain disk. In this situation
       the "ntfs" module should be made the first module to be probed and given a  weight  higher
       than the usual weight of 1.0:

              gpart -w ntfs,1.5 /dev/hdb

       To list the available modules and their weights use the -L option.

       - After  having  checked  the output of gpart at least thrice, the primary partition table
       can be written back to the device this way:

              gpart -W /dev/sdc /dev/sdc

       This of course may be extremely dangerous to your health and social security, so beware.

       - A hard disk with 63 sectors per head is scanned in steps of 63 sectors. To  perform  the
       scan on every second head while skipping the first 1008 sectors type

              gpart -k 1008 -n 126 /dev/sda

       - If  you  want  to  see  how easily gpart can be mislead, and how many probable partition
       starts are on a disk, search the whole disk really sector by sector, writing all output to
       a logfile:

              gpart -vvfn s -ql /tmp/gpart.log /dev/sd2 &

       Usually gpart will not be able to produce an educated guess of the primary partition table
       in this mode. The logfile however may contain enough hints  to  manually  reconstruct  the
       partition table.

FILES

       /dev/*
              Hard  disk  block  devices.  The  naming  scheme  of  hard disk block devices is OS
              dependent, consult your system manuals for more information.

DIAGNOSTICS

       There are many error message types, all of them should be  self-explanatory.  Complain  if
       they are not.

BUGS

       gpart is beta software, so expect buggy behaviour.

       -   gpart  only  accepts extended partition links with one logical partition. There may be
       fdisk variants out there creating links with up to three  logical  partition  entries  but
       these are not accepted.

TO DO

       - Support big-endian architectures.
       - Test on 64-bit architectures.
       - Look for boot manager partitions (e.g. OS/2 BM).
       - Think about reconstructing logical partition chains.

AUTHOR

       Please send bug reports, suggestions, comments etc. to

              Michail Brzitwa <michail@brzitwa.de>

SEE ALSO

       fdisk(8).