Fixed? A TestDisk conundrum.

How to use TestDisk to recover lost partition

Fixed? A TestDisk conundrum.

Postby codeblue » 29 Aug 2012, 19:48

TestDisk has amazed me many times with a simple <enter><enter><enter><confirm>...FIXED! However I have a 32GB FAT32 USB drive that exhibits some of the trickier symptoms discussed on this forum.

I'm starting to understand the TestDisk logs better but this run generated 4GB of output! The CHS seemed very strange and I tried the suggested fix to change from 1 head/cylinder to 32 head/cylinder without success.

Code: Select all
Fri Jun  8 18:01:41 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 9.8.0 (Darwin Kernel Version 9.8.0: Wed Jul 15 16:55:01 PDT 2009; root:xnu-1228.15.
Compiler: GCC 4.0
Compilation date: 2012-05-21T08:46:12
ext2fs lib: 1.41.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
Hard disk list
Disk /dev/disk2 - 32 GB / 29 GiB - CHS 62652416 1 1, sector size=512
Disk /dev/rdisk2 - 32 GB / 29 GiB - CHS 62652416 1 1, sector size=512

Partition table type (auto): Intel
Disk /dev/rdisk2 - 32 GB / 29 GiB
Partition table type: Intel

Analyse Disk /dev/rdisk2 - 32 GB / 29 GiB - CHS 62652416 1 1
Geometry from i386 MBR: head=256 sector=50
BAD_RS LBA=35040 1


test_FAT()
 1 * FAT32 LBA                  35040   62652415   62617376
sector_size  1024
cluster_size 240
reserved     2
fats         5
dir_entries  752
sectors      1536
media        F0
fat_length   2
secs_track   61447
heads        2
hidden       192520
total_sect   192521
check_part_i386 failed for partition type 0C
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=240 nbr=1
Current partition structure:
Invalid FAT boot sector
 1 * FAT32 LBA                  35040   62652415   62617376
 1 * FAT32 LBA                  35040   62652415   62617376

Warning: Bad ending sector (CHS and LBA don't match)
Ask the user for vista mode
search_vista_part: 1

search_part()
Disk /dev/rdisk2 - 32 GB / 29 GiB - CHS 62652416 1 1
FAT32 at 34272/0/1
FAT1 : 32-15311
FAT2 : 15312-30591
start_rootdir : 30592 root cluster : 2
Data : 30592-62617375
sectors : 62617376
cluster_size : 32
no_of_cluster : 1955837 (2 - 1955838)
fat_length 15280 calculated 15280
FAT differs, FAT sectors=0-16/15280
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 34272/0/1
     FAT32 LBA                  34272   62651647   62617376 [NO NAME]
     FAT32, blocksize=16384, 32 GB / 29 GiB
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
Warning: the current number of heads per cylinder is 1 but the correct value may be 32.

Results
   * FAT32 LBA                  34272   62651647   62617376 [NO NAME]
     FAT32, blocksize=16384, 32 GB / 29 GiB


dir_partition inode=0
   * FAT32 LBA                  34272   62651647   62617376 [NO NAME]
     FAT32, blocksize=16384, 32 GB / 29 GiB
FAT: cluster=2(0x2), pos=64864
FAT: cluster=10243(0x2803), pos=392576
Directory /

interface_write()
 1 * FAT32 LBA                  34272   62651647   62617376 [NO NAME]

search_part()
Disk /dev/rdisk2 - 32 GB / 29 GiB - CHS 62652416 1 1
FAT32 at 34272/0/1
FAT1 : 32-15311
FAT2 : 15312-30591
start_rootdir : 30592 root cluster : 2
Data : 30592-62617375
sectors : 62617376
cluster_size : 32
no_of_cluster : 1955837 (2 - 1955838)
fat_length 15280 calculated 15280
FAT differs, FAT sectors=0-16/15280
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 34272/0/1
     FAT32 LBA                  34272   62651647   62617376 [NO NAME]
     FAT32, blocksize=16384, 32 GB / 29 GiB
FAT32 at 34278/0/1
FAT1 : 32-15311
FAT2 : 15312-30591
start_rootdir : 30592 root cluster : 2
Data : 30592-62617375
sectors : 62617376
cluster_size : 32
no_of_cluster : 1955837 (2 - 1955838)
fat_length 15280 calculated 15280
FAT differs, FAT sectors=0-16/15280
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 34278/0/1
     FAT32 LBA                  34278   62651653   62617376 [NO NAME]
     FAT32, blocksize=16384, 32 GB / 29 GiB
BAD_RS LBA=1652261642 747
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
     FAT16 LBA             1652261642 1686138699   33877058
This partition ends after the disk limits. (start=1652261642, size=33877058, end=1686138699, disk end=62652416)
BAD_RS LBA=74002839 589
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
     FAT16 LBA               74002839 1266107570 1192104732
This partition ends after the disk limits. (start=74002839, size=1192104732, end=1266107570, disk end=62652416)
BAD_RS LBA=3548055557 1073
check_part_i386 failed for partition type 07
     HPFS - NTFS           3548055557 3790967756  242912200
This partition ends after the disk limits. (start=3548055557, size=242912200, end=3790967756, disk end=62652416)
BAD_RS LBA=3713335774 284
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0B
     FAT32                 3713335774 3780510178   67174405
This partition ends after the disk limits. (start=3713335774, size=67174405, end=3780510178, disk end=62652416)
BAD_RS LBA=1835220519 1006
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
     FAT12                 1835220519 4832337624 2997117106
This partition ends after the disk limits. (start=1835220519, size=2997117106, end=537370328, disk end=62652416)
BAD_RS LBA=2147778372 752
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
     FAT32 LBA             2147778372 4472727576 2324949205
This partition ends after the disk limits. (start=2147778372, size=2324949205, end=177760280, disk end=62652416)
BAD_RS LBA=2593345976 890
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0E
     FAT16 LBA             2593345976 5457731290 2864385315
This partition ends after the disk limits. (start=2593345976, size=2864385315, end=1162763994, disk end=62652416)
BAD_RS LBA=4220769357 876
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
     FAT32 LBA             4220769357 4887627305  666857949
This partition ends after the disk limits. (start=4220769357, size=666857949, end=592660009, disk end=62652416)
BAD_RS LBA=1455169624 1103
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
     FAT32 LBA             1455169624 4229651894 2774482271
This partition ends after the disk limits. (start=1455169624, size=2774482271, end=4229651894, disk end=62652416)

HFS magic value at 18159392/0/1
part_size 83888898
     HFS                     18159392  102048289   83888898
     HFS, 42 GB / 40 GiB
This partition ends after the disk limits. (start=18159392, size=83888898, end=102048289, disk end=62652416)

HFS magic value at 18159394/0/1

LVM magic value at 21923778/0/1
Disk /dev/rdisk2 - 32 GB / 29 GiB - CHS 62652416 1 1
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (32 GB / 29 GiB) seems too small! (< 2794 GB / 2602 GiB)
The following partitions can't be recovered:
     HFS                     18159392  102048289   83888898
     HFS, 42 GB / 40 GiB
     FAT16 LBA               74002839 1266107570 1192104732
     FAT32 LBA             1455169624 4229651894 2774482271
     FAT16 LBA             1652261642 1686138699   33877058
     FAT12                 1835220519 4832337624 2997117106
     FAT32 LBA             2147778372 4472727576 2324949205
     FAT16 LBA             2593345976 5457731290 2864385315
     HPFS - NTFS           3548055557 3790967756  242912200
     FAT32                 3713335774 3780510178   67174405
     FAT32 LBA             4220769357 4887627305  666857949
get_geometry_from_list_part_aux head=1 nbr=4
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2

Results
     FAT32 LBA                  34272   62651647   62617376 [NO NAME]
     FAT32, blocksize=16384, 32 GB / 29 GiB
     FAT32 LBA                  34278   62651653   62617376 [NO NAME]
     FAT32, blocksize=16384, 32 GB / 29 GiB


dir_partition inode=0
     FAT32 LBA                  34278   62651653   62617376 [NO NAME]
     FAT32, blocksize=16384, 32 GB / 29 GiB
FAT: cluster=2(0x2), pos=64870
Directory /


dir_partition inode=0
     FAT32 LBA                  34272   62651647   62617376 [NO NAME]
     FAT32, blocksize=16384, 32 GB / 29 GiB
FAT: cluster=2(0x2), pos=64864
FAT: cluster=10243(0x2803), pos=392576
Directory /

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/rdisk2 - 32 GB / 29 GiB - CHS 62652416 1 1
Geometry from i386 MBR: head=256 sector=50
BAD_RS LBA=35040 1


test_FAT()
 1 * FAT32 LBA                  35040   62652415   62617376
sector_size  1024
cluster_size 240
reserved     2
fats         5
dir_entries  752
sectors      1536
media        F0
fat_length   2
secs_track   61447
heads        2
hidden       192520
total_sect   192521
check_part_i386 failed for partition type 0C
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=240 nbr=1
Current partition structure:
Invalid FAT boot sector
 1 * FAT32 LBA                  35040   62652415   62617376
 1 * FAT32 LBA                  35040   62652415   62617376

Warning: Bad ending sector (CHS and LBA don't match)
Ask the user for vista mode
search_vista_part: 1

search_part()
Disk /dev/rdisk2 - 32 GB / 29 GiB - CHS 62652416 1 1
FAT32 at 34272/0/1
FAT1 : 32-15311
FAT2 : 15312-30591
start_rootdir : 30592 root cluster : 2
Data : 30592-62617375
sectors : 62617376
cluster_size : 32
no_of_cluster : 1955837 (2 - 1955838)
fat_length 15280 calculated 15280
FAT differs, FAT sectors=0-16/15280
heads/cylinder 255 (FAT) != 1 (HD)
sect/track 63 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 34272/0/1
     FAT32 LBA                  34272   62651647   62617376 [NO NAME]
     FAT32, blocksize=16384, 32 GB / 29 GiB
get_geometry_from_list_part_aux head=1 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
Warning: the current number of heads per cylinder is 1 but the correct value may be 32.

Results
   * FAT32 LBA                  34272   62651647   62617376 [NO NAME]
     FAT32, blocksize=16384, 32 GB / 29 GiB
file_pread(7,1,buffer,34272(34272/0/1)) read err: Device not configured
Can't read FAT boot sector.
Can't read FAT boot sector.

   * FAT32 LBA                  34272   62651647   62617376 [NO NAME]
     FAT32, blocksize=16384, 32 GB / 29 GiB
Can't open filesystem. Filesystem seems damaged.

interface_write()
 1 * FAT32 LBA                  34272   62651647   62617376 [NO NAME]
simulate write!

write_mbr_i386: starting...
file_pread(7,1,buffer,0(0/0/1)) read err: Device not configured

Partition: Read error
Store new MBR code
write_all_log_i386: starting...
No extended partition
New geometry
Disk /dev/rdisk2 - 32 GB / 29 GiB - CHS 1957888 32 1 sector_size=512

Interface Advanced

Analyse Disk /dev/rdisk2 - 32 GB / 29 GiB - CHS 1957888 32 1
Current partition structure:

Partition: Read error
Ask the user for vista mode
search_vista_part: 1

search_part()
Disk /dev/rdisk2 - 32 GB / 29 GiB - CHS 1957888 32 1
file_pread(7,8,buffer,1(0/1/1)) read err: Device not configured
file_pread(7,8,buffer,9(0/9/1)) read err: Device not configured

The file_pread statements went on for 23,494,558 lines! Then it continued...
Code: Select all
Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
file_pread(7,1,buffer,0(0/0/1)) read err: Device not configured

Partition: Read error
Store new MBR code
write_all_log_i386: starting...
No extended partition

Interface Advanced
New geometry
Disk /dev/rdisk2 - 32 GB / 29 GiB - CHS 62652416 1 1 sector_size=512

Interface Advanced
Partition table type default to EFI GPT
Disk /dev/rdisk2 - 32 GB / 29 GiB
Partition table type: EFI GPT

Interface Advanced

TestDisk exited normally

Does anything stand out as an obvious problem with this testdisk run?

I was able to rebuild the BS and see the partition but the data is not the same. TestDisk output:

fat32_boot_sector
1 * FAT32 LBA 35040 62652415 62617376
Boot sector
Bad

Backup boot sector
Bad

First sectors (Boot code and partition information) are not identical.
Second sectors (cluster information) are not identical.
Third sectors (Second part of boot code) are not identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.

1 * FAT32 LBA 35040 62652415 62617376
rebuild_FAT_BS p_fat12 0, p_fat16 0, p_fat32 1
fat_find_type(max_offset=489262, p_fat12=0, p_fat16=0, p_fat32=1, debug=1, dump_ind=0)
FAT32 at 352(35392/0/1), nbr=1
FAT32 at 356(35396/0/1), nbr=1
FAT32 at 357(35397/0/1), nbr=1
FAT32 at 358(35398/0/1), nbr=1
...
FAT32 at 2204(37244/0/1), nbr=1
FAT32 at 2205(37245/0/1), nbr=1
FAT32 at 2206(37246/0/1), nbr=1
FAT32 at 2207(37247/0/1), nbr=1
FAT32 at 864(35904/0/1), nbr=128
FAT32 at 928(35968/0/1), nbr=209
FAT32 at 992(36032/0/1), nbr=64
FAT32 at 1168(36208/0/1), nbr=128
FAT32 at 1232(36272/0/1), nbr=64
FAT32 at 1296(36336/0/1), nbr=192
...FAT32 at 487544(522584/0/1), nbr=1
FAT32 at 448865(483905/0/1), nbr=2
FAT32 at 448833(483873/0/1), nbr=6
FAT32 at 448705(483745/0/1), nbr=2
FAT32 at 448673(483713/0/1), nbr=6
FAT32 at 448459(483499/0/1), nbr=3
FAT32 at 401823(436863/0/1), nbr=17
FAT32 at 15312(50352/0/1), nbr=6698
FAT32 at 32(35072/0/1), nbr=432
FAT32 at 4880(39920/0/1), nbr=65
FAT32 at 4816(39856/0/1), nbr=64
FAT32 at 7584(42624/0/1), nbr=192
FAT32 at 7648(42688/0/1), nbr=64
FAT32 at 4576(39616/0/1), nbr=64
FAT32 at 9040(44080/0/1), nbr=64
FAT32 at 8080(43120/0/1), nbr=192
FAT differs, FAT sectors=0-16/496
first_fat 3232, second_fat 3728


Post 3435 has some similar issues with data corruption. I think these problems TestDisk found in the FATs could explain that. Could any advanced fixes help?

Thanks for your time and consideration. I promise to follow through to some useful resolution.
codeblue
 
Posts: 2
Joined: 28 Aug 2012, 19:16

Fixed? A TestDisk conundrum.

Sponsor

Sponsor
 
 

Re: Fixed? A TestDisk conundrum.

Postby codeblue » 30 Aug 2012, 02:16

I used the advanced mode of PhotoRec to search for files using the "Try to unformat a FAT filesystem" option and the recuped files were complete and readable. So the partition recovery in TestDisk gave a complete list of the files but not a valid map of the contents:

Code: Select all
PhotoRec 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk image.dd - 32 GB / 29 GiB (RO)
     Partition                  Start        End    Size in sectors
   P FAT32                    0   0  1  3897 191 38   62617376 [HP USB FD]


Truly an amazing set of tools!
codeblue
 
Posts: 2
Joined: 28 Aug 2012, 19:16

Re: Fixed? A TestDisk conundrum.

Postby cgrenier » 01 Sep 2012, 07:58

As you have recovered your data using PhotoRec, it's not really needed but recovery using TestDisk may have been possible:
- enable the expert mode in Options menu
- during RebuildBS, choose 32 for FAT1 and 15312 for FAT2
- use RepairFAT to fix the FAT1
User avatar
cgrenier
Site Admin
 
Posts: 1622
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France


Return to Partition Recovery

Who is online

Users browsing this forum: No registered users and 1 guest