Introduction to gpart
Gpart is a small GPL 2.0 licensed tool that tries to guess what partitions are on a PC type, MBR partitioned hard drive in case the primary partition table is damaged.
Gpart tries to guess partitions from any device that can be partitioned, even a file. If the primary partition table is lost, overwritten, or destroyed, the partitions will still exist on the media, but the operating system cannot access them.
Currently supported (predictable) file system or partition types:
- BeOS file system type.
- BtrFS file system type.
- FreeBSD/NetBSD/386BSD disk label subpartition scheme used on Intel platforms.
- Linux second extended file system (Ext2).
- MS-DOS FAT12, FAT16 and FAT32 "file systems".
- IBM OS/2 High Performance file system.
- Linux LVM and LVM2 physical volumes.
- Linux swap partitions (versions 0 and 1).
- Minix operating system file system type.
- MS Windows NT/2000 file system.
- QNX 4.x file system.
- xfs - Silicon Graphic's journalling filesystem for Linux.
Gpart is very useful for recovery actions and forensic investigations. Now let's explain how to install this tool on Ubuntu.c
Steps to install Gpart on Ubuntu
First, pull the current package list from the package repository:
foc@ubuntu22desktop:~$ sudo apt update
Version in package repository:
foc@ubuntu22desktop:~$ sudo apt search gpart
Sorting... Done
Full Text Search... Done
gpart/jammy 1:0.3-9 amd64
Guess PC disk partition table, find lost partitions
Install the gpart package using apt command as shown below:
foc@ubuntu22desktop:~$ sudo apt install gpart -y
Installed gpart package version:
foc@ubuntu22desktop:~$ gpart -V
gpart v0.2.3-dev
List the disks you want to scan with gpart after installation:
foc@ubuntu22desktop:~$ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sr0 What is Gpart? 11:0 1 1024M 0 rom
vda 252:0 0 25G 0 disk
├─vda1 252:1 0 1M 0 part
├─vda2 252:2 0 513M 0 part /boot/efi
└─vda3 252:3 0 24,5G 0 part /var/snap/firefox/common/host-hunspell
Then run the command as in the example below to scan a physical disk:
foc@ubuntu22desktop:~$ sudo gpart /dev/vda Begin scan... Possible partition(Linux ext2), size(25084mb), offset(515mb) End scan. Checking partitions... * Warning: partition(Linux ext2 filesystem) starts beyond disk end. Partition(Linux ext2 filesystem): invalid primary Ok. Guessed primary partition table: Primary partition(1) type: 000(0x00)(unused) size: 0mb #s(0) s(0-0) chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r Primary partition(2) type: 000(0x00)(unused) size: 0mb #s(0) s(0-0) chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r Primary partition(3) type: 000(0x00)(unused) size: 0mb #s(0) s(0-0) chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r Primary partition(4) type: 000(0x00)(unused) size: 0mb #s(0) s(0-0) chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r
Start a scan again with 3 parameters:
- -c Check/compare mode.
- -q Run quiet (however log file is written if specified).
- -l Logfile name.
foc@ubuntu22desktop:~$ sudo gpart -cqv -l logs.txt /dev/vda
You can see the logs in the logs.txt file:
foc@ubuntu22desktop:~$ cat logs.txt dev(/dev/vda) mss(512) chs(52012/16/63) #s(0) size(0mb) Primary partition(1) type: 238(0xEE)(UNKNOWN) size: 25599mb #s(52428799) s(1-52428799) chs: (0/0/2)-(1023/255/63)d (0/0/2)-(52012/11/11)r hex: 00 00 02 00 EE FF FF FF 01 00 00 00 FF FF 1F 03 ... Begin scan... Possible partition(Linux ext2), size(25084mb), offset(515mb) type: 131(0x83)(Linux ext2 filesystem) size: 25084mb #s(51372032) s(1054720-52426751) chs: (1023/15/63)-(1023/15/63)d (1046/5/38)-(52010/10/42)r hex: 00 0F FF FF 83 0F FF FF 00 18 10 00 00 E0 0F 03 End scan. Checking partitions... * Warning: partition(Linux ext2 filesystem) starts beyond disk end. Partition(Linux ext2 filesystem): invalid primary Ok. Guessed primary partition table: Primary partition(1) type: 000(0x00)(unused) size: 0mb #s(0) s(0-0) chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r hex: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...
Summary
You can get help from the -h parameter for different parameters of Gpart:
foc@ubuntu22desktop:~$ gpart -h Usage: gpart [options] device Options: [-b <backup MBR>][-C c,h,s][-c][-d][-E][-e][-f][-g][-h][-i] [-K <last sector>][-k <# of sectors>][-L][-l <log file>] [-n <increment>][-q][-s <sector-size>] [-V][-v][-W <device>][-w <module-name,weight>] gpart v0.2.3-dev (c) 1999-2001 Michail Brzitwa <michail@brzitwa.de>. Guess PC-type hard disk partitions. Options: -b Save a backup of the original MBR to specified file. -C Set c/h/s to be used in the scan. -c Check/compare mode. -d Do not start the guessing loop. -E Do not try to identify extended partition tables. -e Do not skip disk read errors. -f Full scan. -g Do not try to get the disk geometry. -h Show this help. -i Run interactively (ask for confirmation). -K Scan only up to given sector. -k Skip sectors before scan. -L List available modules and their weights, then exit. -l Logfile name. -n Scan increment: number or 's' sector, 'h' head, 'c' cylinder. -q Run quiet (however log file is written if specified). ...
You will also find more information about the gpart command on its manual page:
foc@ubuntu22desktop:~$ man gpart NAME gpart - guess PC-type hard disk partitions SYNOPSIS gpart [options] device ...
References
askubuntu.com software installation - Where is gparted in Ubuntu?
man gpart