Advanced FAT Repair

From CGSecurity

Jump to: navigation, search

en.png english version de.png deutsche Version es.png versión español fr.png version française


If the FAT boot sector is damaged, data can not be accessed. Windows will prompt The drive is not formatted, do you want to format it now? Linux mount will display wrong fs type, bad option, bad superblock

TestDisk let you manipulate the boot sector of FAT partitions. In the Advanced menu, select the partition you want to modify and choose Boot.

Contents

Repair FAT boot sector 

TestDisk 6.2-WIP, Data Recovery Utility, November 2005
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63

     Partition                  Start        End    Size in sectors
 1 * FAT32                    0   1  1  1010 254 63   16241652 [NO NAME]
 2 P Linux                 1011   0  1  1023 254 63     208845 [/boot]
 3 E extended LBA          1024   0  1 14592 254 63  217985985
 5 L Linux RAID            1024   1  1  3573 254 63   40965687 [md0]
   X extended              3574   0  1  4210 254 63   10233405
 6 L Linux RAID            3574   1  1  4210 254 63   10233342 [md1]
   X extended              4211   0  1 14592 254 63  166786830
 7 L Linux                 4211   1  1 14592 254 63  166786767








[  Type  ]  [  Boot  ]  [  Quit  ]
                              Boot sector recovery

Recover the FAT32 boot sector

TestDisk can fix corrupted FAT32 boot sector: the quickest way is to restore the FAT32 boot sector from its backup. TestDisk checks the boot sector and the backup boot sector. If the boot sector and backup boot sector mismatch, you can

  • restore the boot sector from the FAT32 backup boot sector if it's valid (Backup BS)
  • update the backup boot sector with the current FAT32 boot sector if it's valid (Org. BS).

Dump can used to display the sector content in both hexadecimal and ASCII.

If the boot sector is overwritten, it's also often the case for its backup as they are very near:

  • the primary boot sector is sector zero of the filesystem,
  • the backup FAT32 boot sector is usually located at sector 6.

Fortunatly TestDisk can deal with this problem by creating a new boot sector.

Rebuild a valid FAT boot sector

There is no backup boot sector for FAT12 and FAT16, so if the boot sector is damaged, it has to be recreated. The same thing applies for a FAT32 if both the boot sector its backup are corrupted. TestDisk can rebuild FAT boot sector: choose RebuildBS in the menu, it's safe, it doesn't modify the disk. Use List to check the result and Write if you have been able to list your files. 

TestDisk 6.2-WIP, Data Recovery Utility, November 2005
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63
     Partition                  Start        End    Size in sectors
 1 * FAT32                    0   1  1  1010 254 63   16241652 [NO NAME]
Boot sector
OK
Backup boot sector
OK
Sectors are identical.










[  Quit  ]  [Rebuild BS][  Dump  ]  [Repair FAT]

                            Return to Advanced menu

Technical information about FAT boot sector rebuild

To rebuild a FAT boot sector, TestDisk assumes that

  • filesystem size is equal to partition size
  • fragmentation is low

The steps are

  • select which FAT type are compatible with the filesystem size
  • identify the sectors where begin the two FAT (number of reserved sector, fat length) and the FAT type (FAT12/16/32)
  • If only one FAT is found:

If FAT12 or FAT16 is found, assumes there is only one reserved sector. If it's the second FAT, deduce the the fat length. If beginning of FAT32 first fat is found at sector 32 or 33, deduce the number of reserved sectors.

  • If two or more FAT sector beginning has been found:

assumes the first two are the two copies of the FAT. Deduce the number of reserved sectors and fat length.

  • If number of reserved sector or fat length hasn't been found,

use inode of . directory entries to get the cluster size and deduce where the first cluster begin. From the number of cluster, deduce if it's a FAT12, FAT16 or FAT32. If FAT12 or FAT16, assume there is only one reserved sector. Try to find the number of directories entree (512 by default). Deduce the FAT length.

  • If FAT12 or FAT16, find the root directory size
  • Find the cluster size
  • If FAT32, find the root cluster
  • Create a boot sector with this information
  • ask the user if he want to write this new boot sector or not,

the user can also list the files of the FAT partition

Repair FAT tables

File Allocation Tables are maps of the data region, indicating which clusters are used by files and directories. To repair FAT, menu Repair FAT, TestDisk compares the two FAT copies. If FAT mismatches (sector by sector check) or contains errors, TestDisk uses the FAT copy with less errors and remove the obvious errors. This function must only be used on FAT filesystem with correct values in the boot sector. It has been used with success when scandisk, chkdsk or fsck.vfat refused to repair the filesystem or crashes.

Back to Running the TestDisk Program

Data Recovery