Arch Linux

blablubb1234

Member

Registered: 2013-07-04

Posts: 34

[SOLVED] (U)EFI dualboot Win7 Arch Linux - partitions gone - recovery?

Hi everybody,

I have a slight problem with my (U)EFI dualboot system (Windows 7 and Arch Linux) which used to be configured using rEFInd like it is described in my previous post:

https://bbs.archlinux.org/viewtopic.php … 6#p1300356

<EFI PARTITION> is /dev/sda1 and I used to boot via <EFI PARTITION>\EFI\Boot\Bootx64.efi which then successfully either loaded Windows or Linux kernel.

Thanks to my own stupidity and a recent update of refind I decided to copy the new driver, font and icon folders to the <EFI PARTITION> in order to be up-to-date.
After doing so, the rEFInd boot menu had a third icon which said "Boot via \EFI\Boot\Bootx64.efi" and if I clicked on it a second rEFInd boot menu appeared with only the two icons for Windows 7 and Arch.
So I figured I could delete Bootx64.efi and ultimately did so, unfortunately. Afterwards I couldn't boot neither Windows nor Linux anymore.

Following this I went through my noumerous USB boot sticks in order to be able to recover the Bootx64.efi. Unfortunately the first USB stick was a Windows XP one which has the plop bootloader alongside:

http://www.plop.at/en/bootmanager/thebootmanager.html

Out of couriousity I entered this bootloader and found HDA and HDB (I assume resembling my SSD and my USB stick).
To my knowledge I didn't change anything but after entering the bootloader again I just found HDA left, HDB seemed to be gone. But I didn't think of anything bad happening yet.

Then I found a working Archiso which I booted and using blkid I couldn't find the partitions of my earlier system anymore, only its device and the USB stick:

/dev/sda: PTUUID="..." PTTYPE="gpt"
/dev/sdb1: UUID="..." LABEL="ARCH_201312" TYPE="..." and so on
/dev/sdb2: SEC_TYPE="msdos" and so on

Even within the EFI shell I could not detect any internal drive anymore (only fs0: which is the USB stick)

Using Archiso onboard tool testdisk I could find the old partitions. The correct result of the GPT from testdisk is:

Fri Jul  4 08:45:25 2014
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.12.1-3-ARCH (#1 SMP PREEMPT Tue Nov 26 11:17:02 CET 2013) x86_64
Compiler: GCC 4.8
Compilation date: 2013-08-06T08:42:31
ext2fs lib: 1.42.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.0.5, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size       500118192 sectors
/dev/sda: user_max   500118192 sectors
/dev/sda: native_max 500118192 sectors
/dev/sda: dco        500118192 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - Samsung SSD 840 PRO Series, S/N:S12RNEAD322171L, FW:DXM04B0Q
Disk /dev/sdb - 2013 MB / 1920 MiB - CHS 1022 62 62, sector size=512 - SMI USB DISK, FW:1100
Disk /dev/sdc - 4210 MB / 4015 MiB - CHS 1020 130 62, sector size=512 - Generic Flash Disk, FW:8.07
Disk /dev/mapper/arch_root-image - 1478 MB / 1410 MiB - 2887680 sectors, sector size=512
Disk /dev/dm-0 - 1478 MB / 1410 MiB - 2887680 sectors, sector size=512

Partition table type (auto): Intel
Disk /dev/sda - 256 GB / 238 GiB - Samsung SSD 840 PRO Series
Partition table type: EFI GPT
New options :
 Dump : No
 Align partition: Yes
 Expert mode : Yes

Analyse Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=500118191 (expected 500118191)
hdr_lba_start=34
hdr_lba_end=500118158
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
hdr_size=92
hdr_lba_self=500118191
hdr_lba_alt=1 (expected 1)
hdr_lba_start=34
hdr_lba_end=500118158
hdr_lba_table=500118159
hdr_entries=128
hdr_entsz=128
Trying alternate GPT
Current partition structure:
Trying alternate GPT

search_part()
Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
FAT32 at 0/32/33
FAT1 : 4110-6150
FAT2 : 6151-8191
start_rootdir : 8192 root cluster : 2
Data : 8192-2097151
sectors : 2097152
cluster_size : 8
no_of_cluster : 261120 (2 - 261121)
fat_length 2041 calculated 2041
set_FAT_info: name from BS used

FAT32 at 0/32/33
     MS Data                     2048    2099199    2097152 [NO NAME]
     FAT32, blocksize=4096, 1073 MB / 1024 MiB
NTFS at 146/251/42
filesystem size           249593856
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
NTFS part_offset=1209008128, part_size=127792054272, sector_size=512
NTFS partition cannot be added (part_offset<part_size).
NTFS at 146/251/42
filesystem size           249593856
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     MS Data                  2361344  251955199  249593856
     NTFS, blocksize=4096, 127 GB / 119 GiB

recover_EXT2: s_block_group_nr=0/160, s_mnt_count=1318/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 5242880
recover_EXT2: part_size 41943040
     MS Data                251955200  293898239   41943040
     ext4 blocksize=4096 Large file Sparse superblock, 21 GB / 20 GiB

recover_EXT2: s_block_group_nr=0/80, s_mnt_count=1317/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 2621440
recover_EXT2: part_size 20971520
     MS Data                293898240  314869759   20971520
     ext4 blocksize=4096 Large file Sparse superblock, 10 GB / 10 GiB

recover_EXT2: s_block_group_nr=0/706, s_mnt_count=1317/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 23156049
recover_EXT2: part_size 185248392
     MS Data                314869760  500118151  185248392
     ext4 blocksize=4096 Large file Sparse superblock, 94 GB / 88 GiB

Results
   P MS Data                     2048    2099199    2097152 [NO NAME]
     FAT32, blocksize=4096, 1073 MB / 1024 MiB
   P MS Data                  2361344  251955199  249593856
     NTFS, blocksize=4096, 127 GB / 119 GiB
   P MS Data                251955200  293898239   41943040
     ext4 blocksize=4096 Large file Sparse superblock, 21 GB / 20 GiB
   P MS Data                293898240  314869759   20971520
     ext4 blocksize=4096 Large file Sparse superblock, 10 GB / 10 GiB
   P MS Data                314869760  500118151  185248392
     ext4 blocksize=4096 Large file Sparse superblock, 94 GB / 88 GiB

interface_write()
 1 P MS Data                     2048    2099199    2097152 [NO NAME]
 2 P MS Data                  2361344  251955199  249593856
 3 P MS Data                251955200  293898239   41943040
 4 P MS Data                293898240  314869759   20971520
 5 P MS Data                314869760  500118151  185248392
simulate write!

TestDisk exited normally.
ext4 blocksize=4096 Large file Sparse superblock, 94 GB  / 88 GiB

Now the question is: Can I - using testdisk or any other tool - recover those partitions successfully so I will be able to boot again afterwards? I tested and I could mark them as:

P Primary

Any help will be greately appreciated.

Best regards

Last edited by blablubb1234 (2014-07-08 09:20:08)

srs5694

Member

From: Woonsocket, RI

Registered: 2012-11-06

Posts: 719

Website

Re: [SOLVED] (U)EFI dualboot Win7 Arch Linux - partitions gone - recovery?

First, be aware that GPT support is optional in the Linux kernel. It's conceivable that some Random Linux Recovery Disk might completely lack GPT support, in which case you'd see just the /dev/sda1 type-0xEE protective partition on the disk. It could be that this is the sole source of your problem. If so, you should simply use another recovery disk -- one with a GPT-aware kernel -- to look at your partitions.

Second, before resorting to TestDisk, I recommend you look at the disk with gdisk. If your primary GPT data have been damaged, gdisk will detect the backup GPT data and should enable you to recover everything from that. This is likely to be safer and quicker than using TestDisk.

Also, no matter what recovery path you take, I recommend you back up the disk before you do anything major with it. A full-disk low-level backup using dd (as in "dd if=/dev/sda of=foo.img") should do the trick -- but you'll need enough free disk space to hold the entire original disk.

blablubb1234

Member

Registered: 2013-07-04

Posts: 34

Re: [SOLVED] (U)EFI dualboot Win7 Arch Linux - partitions gone - recovery?

Thanks for your reply. I looked at the disk using gdisk, but I don't get any error message about corrupted GPT data (like f.i. here: http://rodsbooks.com/gdisk/repairing.html).
I went to the recovery menu which gives me (among others) these 4 recovery options:

b use backup GPT header (rebuilding main)
c load backup partition table from disk (rebuilding main)
d use main GPT header (rebuilding backup)
e load main partition table from disk (rebuilding backup)

As you recommended I tried to use the backup GPT header (as in option 'b') without any result. Printing the partition table still gives me no partitions whatsoever.
I figured I might try to load the backup partition table from disk (using option 'c') but this gives me this warning:
"Warning! This will probably do weird things if you've converted an MBR to GPT form and haven't yet saved the GPT! Proceed? (Y/N)?"
I haven't converted MBR to GPT  but rather installed on a GPT system from the beginning, still I am not sure whether I should go on or not?

Where these the recovery options in gdisk you were talking about or are there others I don't know about yet?

MoonSwan

Member

From: Great White North

Registered: 2008-01-23

Posts: 881

Re: [SOLVED] (U)EFI dualboot Win7 Arch Linux - partitions gone - recovery?

In your case "C" would be a valid operation because you've only used GPT on the hard drive.  It won't hurt to try it and "E" assumes you made a backup of your partition table before you lost the partitions.  So avoid "E" and "D" unless you're sure you made backups of those items by using gdisk or a similar tool in the past before things went south.

The best two recovery distros that I use are System Rescue CD and Universal Boot CD (UBCD).  The latter has Parted Magic on it which, in my opinion, is the best distro I know of to use in these situations.  It has multiple tools available to work with and rescue broken systems.

Last edited by MoonSwan (2014-07-05 18:05:35)

blablubb1234

Member

Registered: 2013-07-04

Posts: 34

Re: [SOLVED] (U)EFI dualboot Win7 Arch Linux - partitions gone - recovery?

Issue resolved If you care to know how, read on:

Looking at the disk using gdisk was doing no good. Neither of the recovery options in gdisk did the trick.

I then returned to testdisk and restored the partitions (successfully). However, afterwards I was greeted by shell telling me the root device was not found (seems like UUIDs get changed when one restores them using testdisk). Adjusting the PARTUUID for root in <EFI SYSTEM PARTIITION>/boot/refind_linux.conf did the trick and I could boot up Archlinux again.

Windows 7 still didn't boot telling me the required device was inaccessible (probably wrong UUID, too). I could however not restore/edit Windows' BCD using bcdedit, see my post Status: 0xc0000225 boot selection failed; required device inaccessible:

To make a long story short: Removing bcd and running autorecovery from withing Windows RE successfully created a new bcd. Unfortunately, Windows writes its backup bootloader at <EFI SYSTEM PARTITION>/boot/EFI/Boot/bootx64.efi. This file originally was a copy of refind_x64.efi which I need to put at that location to be able to dualboot. After chrooting to my Arch system I could restore bootx64.efi, create a new fstab and everything is running fine now again.

Best regards and thanks for the help.