Fix an accidental sector write on disk
mouse 48 · person cloud · link
Last update
2018-10-31
2018
10-31
«fix mbr, find damaged/altered file»

MBR overwritten

Read kernel's in-memory partition table, start and size in sectors:

1
2
3
4
5
for i in /sys/block/sda/sda*; do
  echo -n "`basename $i` : "
  cat $i/start $i/size | tr "\n" "\t"
  echo
done

and use fdisk to recreate that scheme entering start then +size.

Alternatively read this sfdisk post.

A known sector was overwritten

Use debugfs to check if it were in use and find the file who owns it:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
debugfs
  open /dev/sda1
  testb  2269012 # is used?
  # find the inode using it (low num = maybe the journal)
  icheck 2269012
  # find the file using it (no filename = maybe the journal)
  ncheck 2269012

# remove journal then retry steps above
tune2fs -O ^has_journal /dev/sda1
# re-add journal
tune2fs -j /dev/sda1

# replace the damaged file with a backup

Source: Stackexchange.com, Serverfault.com answer 1 and 2, Smartmontools.org