lost exFat partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
strabbe
Posts: 4
Joined: 02 Jan 2017, 10:58

lost exFat partition

#1 Post by strabbe »

Hello.
After running fsck.ext4 [/ b] on my exFat disk i lost exFat partition and my partition began mounting as ext4 disk. After this i'm found exFat partition via testdisk utility and wrote new one, also i'm rebuild BS and MBR. Now i can explore files on exFat disk throw testdisk and partition table look nice in testdisk output (third disk on testdisk output):

Code: Select all

Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63

     Partition                  Start        End    Size in sectors
  1 P HPFS - NTFS              0   1  1 26132 254 63  419826582
  2 P Linux                26133   0  1 26255 254 63    1975995 [OPT]
> 3 * HPFS - NTFS          26256   0  1 60800 254 63  554965425
But any os does not see my exFat disk. Windows offer me to format this disk. When i open any of partition manager applications, they show this third disk as ext4 disk. I tried opened this harddrive in WinHex on start sector of exFat partition (421 802 640) and its looks ok, but when i'm jump to next 2 sector (421 802 642), i found here Ext4 superblock from previously ext4 partition. WinHex also showing my third disk as Ext4 partition (look at screenshot)
123b.jpg
123b.jpg (115.98 KiB) Viewed 3945 times
How can i fixed this and make exFat disk for visible to any os, may be i cat just erase ext4 boot sector 421 802 642?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: lost exFat partition

#2 Post by cgrenier »

You can erase the ext4 signature by overwritting the value "53 EF" (0x438 bytes from the beginning of the partition). It may help to identify the partition as an exfat.

strabbe
Posts: 4
Joined: 02 Jan 2017, 10:58

Re: lost exFat partition

#3 Post by strabbe »

i'm already tried this solution (by rewriting "53 EF" on "00 00"), now winhex showing partition as exFat, but any os still can't recognize filesystem of partition.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: lost exFat partition

#4 Post by cgrenier »

Did you try a fsck.exfat ?

strabbe
Posts: 4
Joined: 02 Jan 2017, 10:58

Re: lost exFat partition

#5 Post by strabbe »

thanks for advice, but

Code: Select all

~$ sudo fsck.exfat /dev/sdb3
exfatfsck 1.0.1
ERROR: invalid VBR checksum 0x180000 (expected 0xb2efab44).
also i tried run os x fsck_exfat utility:

Code: Select all

~$ sudo fsck_exfat -d /dev/rdisk3s3 
Password:
Opening /dev/rdisk3s3
** Checking volume.
** Checking main boot region.
fsck_exfat: Invalid boot region checksum
   Main boot region is invalid.  Trying alternate boot region.
** Checking alternate boot region.
fsck_exfat: Invalid boot region checksum
   Alternate boot region is invalid.
** The volume  could not be verified completely.

strabbe
Posts: 4
Joined: 02 Jan 2017, 10:58

Re: lost exFat partition

#6 Post by strabbe »

today i'm fix wrong Boot Checksum (11 sector) by filling this sector of repeating values of needed checksum. after this when i run fsck.exfat or mount disk on ubuntu i get one same message:

Code: Select all

 Unknown entry type 0xa0 
But on mac os x i have success mounting this disk. And data (files and directories) is very well reading! But some files i can't find...

When i several times try to mount this disk on virtualbox Windows, i getting kernel panic of main host.

I already made backup of needed data and i think from this point i will delete partition and create new one, because i think fsck.ext4 made to many changes on exfat partition and find/fix all is to very hard.

Locked