gpart - Guess PC-type hard disk partitions
gpart [options] device
Options: [-b <backup
<# of sectors>] [-L] [-l
<increment>] [-q][-s <sector-size>] [-t
[-W <device>][-w <module-name,
gpart tries to guess
which partitions are on a hard disk.
If the primary partition table
has been lost, overwritten
or destroyed the
partitions still exist on the disk but
the operating system cannot
gpart ignores the primary partition
table and scans the
disk (or disk image, file)
sector after sector for several
types. It does so by "asking"
modules if they think a given
sequence of sectors resembles
the beginning of a filesys
tem or partition type.
Currently the following filesystem
types are known to gpart (listed
by module names) :
beos BeOS filesystem
scheme used on Intel platforms.
ext2 Linux second
hpfs IBM OS/2 High
hmlvm Linux LVM
physical volumes (LVM by Heinz Mauelsha
lswap Linux swap partitions
(versions 0 and 1).
minix The Minix operating
system filesystem type.
ntfs MS Windows
NT filesystem. The recognition of an
NTFS partition is quite weak because only little is
known about its internals.
qnx4 QNX 4.x
rfs The Reiser
filesystem (version 3.5.X, X > 11).
s86dl Sun Solaris on
Intel platforms uses a sub-parti
tioning scheme on PC hard disks similar to the BSD
xfs Silicon Graphic's
journalling filesystem for Linux.
More filesystem guessing modules
can be added at runtime
(see the -t option).
Please consult the gpart README file
for detailed explanations
on how to create guessing mod
ules. All modules
are accompanied by a guessing weight
factor which denotes how "educated"
their guesses are com
pared to other
modules. This weight can be changed if a
certain module keeps on mis-identifying
Naturally only partitions which
have been formatted in
some way can
be recognized. If the type of a partition
entry in the primary partition
table is changed from x to
y while the filesystem is
still of type x, gpart will also
still guess a type x.
No checks are performed
whether a found filesystem is
clean or even consistent/mountable,
so it is quite possi
ble that gpart may identify
partitions which existed prior
to the current partitioning
scheme of the disk. Especially
on large disks old file system
headers/superblocks may be
present a long
time until they are finally overwritten
with user data.
It should be stressed that
gpart does a very heuristic
job, never believe
its output without any plausability
checks. It can be easily right
in its guesswork but it can
also be terribly wrong. You
have been warned.
After having found a list of
possible partition types, the
list is checked for consistency.
For example, a partition
with the previous one will be discarded.
All remaining partitions are
labelled with one of the fol
"primary", "logical", "orphaned" or
A partition labelled "orphaned"
is a logical partition
which seems ok but is
missed in the chain of logical par
titions. This may occur if
a logical partition is deleted
from the extended partition
table without overwriting the
actual disk space.
An "invalid" partition is
one that cannot be accepted
because of various reasons.
If a consistent primary parti
tion table was created in
this process it is printed and
can be written to a file or
If the disk/file to be examined
consists of primary parti
tions only, gpart has quite
a good chance to identify
them. Extended partitions
on the other hand can result in
a lot of problems.
Extended partitions are
realized as a linked list of
extended partition tables,
each of which include an entry
pointing to a logical partition.
The size of an extended
on where the last logical partition
ends. This means that
extended partitions may include
disk space which should only be
assigned to logical, not primary
gpart tries to do its best
to check a found chain of logi
cal partitions but there
are very many possible points of
failure. If "good" fdisk
programs are used to create
the resulting tables consist of a
zeroed boot record and the
four partition entries of which
at least two should
be marked unused. Unfortunately e.g.
the fdisk program shipped
with Windows NT does not seem to
zero out the
boot record area so gpart has to be overly
tolerant in recognizing extended
partition tables. This
tolerance may result in quite
If you want to
investigate hard disks from other systems
you should note down the geometry
(number of cylinders,
heads per cylinder
and sectors per head) used for that
disk, and tell gpart about
Investigating disks from machines
with a different endian
ness than the scanning one
has not been tested at all, and
is currently not recommended.
gpart relies on the OS reporting
the correct disk geome
try. Unfortunately sometimes
the OS may report a geometry
smaller the the actual one
(e.g. disks with more than 1024
or 16384 cylinder).
gpart checks if guessed
partitions extend beyond the disk
size and marks those "invalid",
but may be mistaken in
case the disk size is
calculated from an incorrect geome
try. For instance if a disk
with the geometry 1028/255/63
should be scanned,
and the OS reports 1024/255/63 gpart
should be called like
gpart -C 1028,255,63 <other options> <device>
gpart may be of some help when
the primary partition table
was lost or
destroyed but it can under no circumstances
replace proper disk/partition
table backups. To save the
master boot record
(MBR) including the primary partition
table to a file type
dd if=/dev/hda of=mbr bs=512 count=1
exchanging /dev/hda with the
block device name of the disk
in question. This should be
done for all disks in the sys-
tem. To restore the primary
partition table without over
writing the MBR type
dd if=mbr of=/dev/hda bs=1 count=64
Warning: make sure that all
parameters are typed as shown
and that the disk device
is correct. Failing to do so may
result in severe filesystem
corruption. The saved file
should be stored in a safe
place like a floppy disk.
If the guessed primary partition table seems con
sistent and should be written (see the -W option)
backup the current MBR into the specified file.
Set the disk geometry (cylinders, heads, sectors)
for the scan. This is useful if a disk should be
scanned which was partitioned using a different
geometry, if the device is a disk-image or if the
disk geometry cannot be retrieved through the PCs
BIOS. No spaces are allowed between the numbers,
unless all three are enclosed in quotes.
Check/compare mode (implies the -q quiet option).
After the scan is done, the resulting primary par
tition table is compared to the existing one. The
return code of gpart then contains the number of
differences (0 if they are identical except for the
boot/active flag which cannot be guessed). This
option has no effect if -d is given on the command
Do not start the guessing loop. Useful if the par
tition table should be printed (in combination with
the -v option) without actually scanning for parti
Do not try to identify extended partition tables.
If there are extended partitions on the
device gpart will most certainly complain about too
many primary partitions because there can be only
four primary partitions. Existing logical parti
tions will be listed as primary ones.
Do not skip disk read errors. If this option is
given, and short disk reads or general disk read
errors (EIO) are encountered, gpart will exit. If
not given, the program tries to continue.
Full scan. When a possible partition is found,
gpart normally skips all sectors this entry seems
to occupy and continues the scan from the end of
the last possible partition. The disk scan can take
quite a while if this option is given, be patient.
Do not try to get the disk geometry from the OS. If
the device is no block or character device but a
plain file this option should be supplied. If the
file to be scanned is an image of a disk, the geom
etry can be given by the -C option.
Show some help.
Run interactively. Each time a possible partition
is identified the user is asked for confirmation.
-K last sector
Scan only up to the given sector or the end of the
file or device whichever comes first.
Skip given number of sectors before the
Potentially useful if a partition is looked for at
the end of a large disk.
List available filesystem/partition type modules
and their weights, then exit.
Log output to the given file (even if -q was sup
Scan increment: number of sectors or "s" for single
sector increment, "h" for an increment of sectors
per head (depends on geometry) or "c" for cylinder
The increment also influences the condition where
extended partition tables are searched: if the scan
increment is "s" (i.e. 1) extended partition tables
are required to be on a head boundary, otherwise
they must be on a cylinder boundary.
If the disk geometry could not be retrieved and no
geometry was given on the command line, the default
increment is one sector.
Quiet/no output mode. However if a logfile
specified (see -l option) all output is written to
that file. This option overrides the -i interactive
-s sector size
Preset medium sector size. gpart tries to find out
the sector size but may fail in doing so. Probed
sector sizes are 2^i, i=9..14 (512 to 16384 bytes).
The default medium sector size is 512 bytes.
-t module name
Plug in another guessing module. The module to be
dynamically linked in must be a shared object file
Show version number.
Be verbose. This option can be given more than once
resulting in quite a lot of information.
Write partition table. If a consistent primary par
tition table has been guessed it can be written to
the specified file or device. The supplied device
can be the same as the scanned one.
Additionally the guessed partition entries can be
edited. No checks are performed on the entered val
ues, thus the resulting table is allowed
highly inconsistent. Please beware.
Warning: The guessed partition table should
checked very carefully before writing it back. You
can always write the guessed partition table into a
plain file and write this into sector 0 using dd(1)
(see section PRECAUTIONS above).
-w module name,weight
Put the given module at the head of the module
chain and assign a new weight to that module. All
modules are given an initial weight of 1.0. Again
no spaces are allowed.
Default settings are "-n h".
- To scan the
first IDE hard disk under Linux using
default settings type
- To print the primary partition
table of the third IDE
drive without starting the
scan loop in FreeBSD type
gpart -vvd /dev/wd2
- If lilo(8) was installed
in the master boot record (MBR)
of a hard disk it saves the
contents of the first sector
in a file
called /boot/boot.<major/minor>. To list the
partitions contained in such
a file type e.g.
gpart -vdg /boot/boot.0300
If the partition table
contains an extended partition,
gpart will complain
about invalid extended partition
tables because the extended
entry points to sectors not
within that file.
- Usually the first primary
partition starts on the second
head. If gpart cannot identify
the first partition prop
erly this may not be the case.
gpart can be told to start
the scan directly from sector
one of the disk, using the
sector-wise scan mode:
gpart -k 1 -n s /dev/hdb
- Suppose gpart
identifies an NTFS partition as FAT on a
certain disk. In this situation
the "ntfs" module should
be made the first
module to be probed and given a weight
higher than the usual weight
gpart -w ntfs,1.5 /dev/hdb
To list the available modules
and their weights use the -L
- After having
checked the output of gpart at least
thrice, the primary partition
table can be written back to
the device this way:
gpart -W /dev/sdc /dev/sdc
This of course
may be extremely dangerous to your health
and social security, so beware.
- A hard disk with 63 sectors
per head is scanned in steps
of 63 sectors.
To perform the scan on every second head
while skipping the first 1008
gpart -k 1008 -n 126 /dev/sda
- If you want to see how easily
gpart can be mislead, and
how many probable
partition starts are on a disk, search
the whole disk really sector
by sector, writing all output
to a logfile:
gpart -vvfn s -ql /tmp/gpart.log /dev/sd2 &
Usually gpart will
not be able to produce an educated
guess of the primary partition
table in this mode. The
may contain enough hints to manually
reconstruct the partition
Hard disk block devices. The naming scheme of hard
disk block devices is OS dependent, consult your
system manuals for more information.
There are many error message
types, all of them should be
if they are not.
gpart is beta software, so
expect buggy behaviour.
- gpart only
accepts extended partition links with one
logical partition. There may
be fdisk variants out there
creating links with
up to three logical partition entries
but these are not accepted.
- Support big-endian architectures.
- Test on 64-bit architectures.
- Look for boot manager partitions
(e.g. OS/2 BM).
- Think about reconstructing
logical partition chains.
Please send bug reports, suggestions,
comments etc. to
Michail Brzitwa <email@example.com>