How to manually edit the MBR to recover lost partition?

Question

I have accidentally deleted two HFS+ partitions. I know the start and end sectors of both of them. These partitions are 100% healthy. I can see them in Raise Data Recovery, but testdisk does not see them. How can I manually edit the MBR to restore these partitions from Ubuntu or Windows?

The "sfdisk -l" command in Ubuntu terminal shows:

Disk /dev/sda: 60801 cylinders, 255 heads, 63 sectors/track
Warning: extended partition does not start at a cylinder boundary.
DOS and Linux will interpret the contents differently.
Units = cylinders of 8225280 bytes, blocks of 1024 bytes, counting from 0

   Device Boot Start     End   #cyls    #blocks   Id  System
/dev/sda1         12+  12747-  12736- 102294528    7  HPFS/NTFS
/dev/sda2      12747+  48643-  35896- 288328704    f  W95 Ext'd (LBA)
/dev/sda3          0       -       0          0    0  Empty
/dev/sda4          0       -       0          0    0  Empty
/dev/sda5      12748+  43870   31123- 249995466    7  HPFS/NTFS
/dev/sda6      43871+  48144-   4274-  34324480   83  Linux
/dev/sda7      48145+  48643-    499-   4001792   82  Linux swap / Solaris

Where sda3 and sda4 are these partitions.

possible duplicate of [Windows FAT/NTFS Low-Level Disk Viewer (Norton DiskEdit alternative)](http://superuser.com/questions/97006/windows-fat-ntfs-low-level-disk-viewer-norton-diskedit-alternative) — JdeBP, Jan 09 '12 at 20:59
actually, the data presented here is a bit odd. Unless, ofcourse, the size of **sda3** and **sda4** is really less than 8MiB? — XXL, Jan 09 '12 at 21:39
sda3 and sda4 physically were located at the end of the disk. Something like this: sda1, sda2 start, sda 5, sda 6, sda 7, sda2 end, sda3, sda4. — Nikita, Jan 11 '12 at 14:29

score 0 · Accepted Answer · edited Jun 12 '20 at 13:48

0

Perhaps, first try this:

apt-get install -y parted (in case of Debian-based distro)

partprobe

parted /dev/sda
u s (switches units to sectors)
p (prints partition table)
mkpart p start end (p - primary, this should be your sda3)
mkpart p start end (should be sda4)

I'd run partprobe again after that's done. If it does not work - then yeah, would need to edit the MBR manually, I guess.

Edit: one thing that occurred to me is that you might run into issues, when parted is complaining about injecting partitions with such "out of spec" boundaries.. Well, just delete everything starting from sda5 and recreate them the same way after the successful addition of sda3 & sda4.

edited Jun 12 '20 at 13:48

Community

1

answered Jan 09 '12 at 19:54

XXL

1,469
4
20
34

Ok, that is my question, how do I edit it? From which tool? – Nikita Jan 09 '12 at 20:26
So, what, **parted** did not work or.. ? – XXL Jan 09 '12 at 21:02
@nik Parted *is* a partition table editor, it is the best tool for editing partitions. – Paul Jan 09 '12 at 23:14

score 0 · Answer 2 · answered Jan 10 '12 at 00:09

You can use sfdisk to add those empty partition, for example

sfdisk /dev/sda << EOF
0,381230,0c
381231,84481,0b
465712,,S
EOF

Each line has three values the start and the end sector and the third value is the partition type. To use this console mode you need to install a special package. But I don't know if this delete the partition content. I suggest to make a copy with dd.

How to manually edit the MBR to recover lost partition?

2 Answers2