Forensicsdiskpartitionsrecoveryforensicsfilesystem

gpart

Gpart guesses PC disk partition tables and finds lost partitions when the primary table is damaged, incorrect, or deleted. It lists types, locations, and sizes of deleted partitions for manual recreation.

Description

Gpart is a tool which tries to guess the primary partition table of a PC-type disk in case the primary partition table in sector 0 is damaged, incorrect or deleted. It is also good at finding and listing the types, locations, and sizes of inadvertently-deleted partitions, both primary and logical. It gives you the information you need to manually re-create them (using fdisk, cfdisk, sfdisk, etc.).

The guessed table can also be written to a file or (if you firmly believe the guessed table is entirely correct) directly to a disk device. Currently supported filesystem or partition types include BeOS, BtrFS, FreeBSD/NetBSD/386BSD disklabel, Linux Ext2, MS-DOS FAT12/16/32, IBM OS/2 HPFS, Linux LVM/LVM2, Linux swap, Minix, MS Windows NT/2000, QNX 4.x, ReiserFS 3.5.X, Sun Solaris on Intel, and Silicon Graphics journaled filesystem.

Gpart is useful in recovery actions and forensics investigations.

How It Works

Gpart scans PC-type hard disks to guess partition tables by analyzing sector data for supported filesystem and partition types. It performs a guessing loop to identify primary and logical partitions, optionally using specified disk geometry, sector sizes, and scan limits. It supports writing guessed tables back to files or devices after analysis.

Installation

bash
sudo apt install gpart

Flags

-b <backup MBR>Save a backup of the original MBR to specified file.
-C c,h,sSet c/h/s to be used in the scan.
-cCheck/compare mode.
-dDo not start the guessing loop.
-EDo not try to identify extended partition tables.
-eDo not skip disk read errors.
-fFull scan.
-gDo not try to get the disk geometry.
-hShow help.
-iShow info.
-K <last sector>Set last sector.
-k <# of sectors>Set number of sectors.
-LList supported types.
-l <log file>Set log file.
-n <increment>Set increment.
-qQuiet mode.
-s <sector-size>Set sector size.
-VShow version.
-vVerbose mode.
-W <device>Write to device.
-w <module-name,weight>Set module name and weight.

Examples

Display usage and available options for gpart.
gpart --help
Guess partition table for the specified disk device.
gpart /dev/sda
Guess partitions and save backup of original MBR to file.
gpart -b backup.mbr /dev/sda
Perform check/compare mode on disk partitions.
gpart -c /dev/sda
Run full scan to guess partitions on disk.
gpart -f /dev/sda
Guess partitions in verbose mode.
gpart -v /dev/sda
Write guessed partition table directly to disk device.
gpart -W /dev/sda /dev/sda
Updated 2026-04-16kali.org ↗