Graham,
I hope you have a backup! (yes?)
Ok, on with the gory details.
IF you have a fdisk printout or df handy, grab it.
I don't know of anything other than fdisk the /dev/sda
and setting the partitions 5,6,7 and 8 back EXACTLY as
they were.
If you can do that, the information on the lost partitions
may still be intact. (hoping?...)
You would have to know the EXACT start cylinder and stop
cylinder to make this happen.
Otherwise, repartition the 5,6,7 and 8 and restore from
your backups.
My thoughts on HDs are that the info is held on the drive
itself after the fdisk and is read once the disk spins up.
(Not my profession, just my thoughts.)
As for amd, I haven't even read the man page or looked
at it. Don't know there.
You could have had a disk failure. Disks sometimes do
*wierd* things while they are dying.
I had some bad RAM a couple of weeks ago that blew out
my ncurses info and had to reinstall a few rpms.. :(
I even ran memtest86 for over 21 hours on the RAM and
it reported Good! Only clue was, it was new and after
removing it and doing a visual on it, I realized the
chips were different sizes on the 2 different sticks.
I'd probably not supect a hacker at this point, but may
be wrong.
More below...
On Wed, 10 Jun 1998, Graham Knopp wrote:
>
<clip of my system>
>
> Thanks for the response. fstab looks normal, but fdisk -l shows that my
> partition table is apparently messed up. Hereis the output:
>
> >fdisk -l
>
> The number of cylinders for this disk is set to 2063.
> This is larger than 1024, and may cause problems with:
> 1) software that runs at boot time (e.g., LILO)
> 2) booting and partitioning software form (sic) other OS's
> (e.g., DOS FDISK, OS/2 FDISK)
> Warning: ignoring extra data in partition table 5
> Warning: ignoring extra data in partition table 5
> Warning: ignoring extra data in partition table 5
> Warning: invalid flag ffff of partition table 5 will be corrected by
> w(rite).
>
> Disk /dev/sda: 64 heads, 32 sectors, 2063 cylinders
> Units = cylinders of 2048 * 512 bytes
>
> Device Boot Begin Start End Blocks Id System
> /dev/sda1 1 1 200 204784 6 DOS 16-bit >=32M
> /dev/sda2 * 201 201 232 32768 83 Linux native
> /dev/sda3 233 233 2063 1874944 5 Extended
> /dev/sda5 ? 1028 232 2322147483647+ ff BBT
^^^^
/dev/sda5 looks to start on cylinder 232 and your extended partition
starts on 233! I would think that /dev/sda5 would need to start
on 233 as that is where your extended partition starts.
Looks like partitions 1 - 3 are *probably* OK but the rest need
fixing. (I bet you had that figured out, huh?)
If you change /dev/sda5 to start on 233 and stop on even
1 cylinder past what it was, you will blow away the info that
was /dev/sda6. Sorry, that is my understanding of the way
it works. (corrections welcome)
>
>
> ---------------------------------------
>
> and of course there should be /sda6 /sda7 /sda8.
>
> I neglected to say what I was doing when this happened - I was starting
> amd, but this was only to mount remote filesystems. I turned this off and
> rebooted in case it was the cause, but the table was already corrupted.
>
> So, this situation begs two questions. First, what could have caused
> this? Is there any chance that this is the result of a malicious security
> compromise (I've been checking the logs though and there haven't been any
> obvious compromises). Also, does this mean there has been a disk failure,
> or can I just recreate the partition table and everything will be happy
> once again? How would I go about fixing the partition table (i.e. where
> is it located)?
>
Don't know of a file or anything like it. :(
Maybe someone on the list can help you here.
> Graham
>
>
Good Luck,
Rick
--
Rick L. Mantooth [EMAIL PROTECTED]
http://www.why.net/users/rickdman/index.html
Lead me not into temptation, I can find it myself.
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
http://www.redhat.com/RedHat-FAQ /RedHat-Errata /RedHat-Tips /mailing-lists
To unsubscribe: mail [EMAIL PROTECTED] with
"unsubscribe" as the Subject.
