Invalid FAT boot sector - unsure what to do

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Jaliso
Posts: 1
Joined: 20 May 2018, 20:37

Invalid FAT boot sector - unsure what to do

#1 Post by Jaliso »

Hey all, so long story but I somehow managed to wipe my 2tb HDD with most storage and steam installs on it, and i used Recuva to dig up all the files but it is such a mess with not one file in a folder so theres like 700k items just stored onto a spare 2tb HDD I have now.

So I got told to use Testdisk and as I was running my deep scan I got two errors for Invalid FAT boot sector at about 60%. Picture below
The attachment Screenshot_11.png is no longer available
and when it finished I got the message that "The harddisk 2000 GB / 1863 GiB) seems too small! The following partition can't be be recovered". Picture below.
Screenshot_11.png
Screenshot_11.png (49.58 KiB) Viewed 2958 times
I am unsure what to do now and this deep search took a good 5-6 hours to complete so I don't want to mess it up now that it has finished. Any help??

and the situation with the HDD is that I have two 2TB HDDs - The accidentally formatted one and now the second one is full as I restored the files recovered with Recuva onto that as I was told you should put them back on the drive you formatted?

here's my log (hopefully done right)

Code: Select all



Sun May 20 17:46:50 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, April 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=275064201216
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdd)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=275064201216
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=119008133120
filewin32_getfilesize(\\.\G:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\G:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=2000263577600
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\P:)=2000396746752
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - INTEL SSDSC2BW120A4, S/N:CVDA4462002D1207GN, FW:DC32
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM001-1ER164, S/N:Z4Z18A5H, FW:CC25
Disk /dev/sdc - 275 GB / 256 GiB - CHS 33441 255 63, sector size=512 - Crucial_CT275MX300SSD1, S/N:1630135E532F, FW:M0CR021
Disk /dev/sdd - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM006-2DM164, S/N:Z4ZASB8Q, FW:CC26

Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - ST2000DM001-1ER164
Partition table type: Intel

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
 1 * HPFS - NTFS              0  32 33 243201  45 44 3907024896

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size           3907024896
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 243201  45 44 3907024896
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(5,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,8,buffer,3907029248(243201/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,3907029376(243201/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,3907029504(243201/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,3907029632(243201/88/24)) lseek err Invalid argument
file_pread(5,8,buffer,3907029760(243201/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,3907029888(243201/92/28)) lseek err Invalid argument
file_pread(5,8,buffer,3907030016(243201/94/30)) lseek err Invalid argument
file_pread(5,8,buffer,3907030144(243201/96/32)) lseek err Invalid argument
file_pread(5,8,buffer,3907030272(243201/98/34)) lseek err Invalid argument
file_pread(5,8,buffer,3907030400(243201/100/36)) lseek err Invalid argument
file_pread(5,8,buffer,3907030528(243201/102/38)) lseek err Invalid argument
file_pread(5,8,buffer,3907030656(243201/104/40)) lseek err Invalid argument
file_pread(5,8,buffer,3907030784(243201/106/42)) lseek err Invalid argument
file_pread(5,8,buffer,3907030912(243201/108/44)) lseek err Invalid argument
file_pread(5,6,buffer,3907031042(243201/110/48)) lseek err Invalid argument
file_pread(5,8,buffer,3907031048(243201/110/54)) lseek err Invalid argument
file_pread(5,3,buffer,3907031056(243201/110/62)) lseek err Invalid argument
file_pread(5,3,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(5,8,buffer,3907031119(243201/111/62)) lseek err Invalid argument
file_pread(5,11,buffer,3907031166(243201/112/46)) lseek err Invalid argument
file_pread(5,2,buffer,3907033088(243201/143/15)) lseek err Invalid argument

Results
   * HPFS - NTFS              0  32 33 243201  45 44 3907024896
     NTFS, blocksize=4096, 2000 GB / 1863 GiB


dir_partition inode=5
   * HPFS - NTFS              0  32 33 243201  45 44 3907024896
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 20-May-2018 17:28 .
       5 dr-xr-xr-x     0      0         0 20-May-2018 17:28 ..
      38 dr-xr-xr-x     0      0         0 19-May-2018 21:29 $RECYCLE.BIN
      36 dr-xr-xr-x     0      0         0 20-May-2018 16:18 System Volume Information

interface_write()
 1 P HPFS - NTFS              0  32 33 243201  45 44 3907024896

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size           3907024896
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 243201  45 44 3907024896
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 16/113/34
filesystem size           3906764800
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS             16 113 34 243201  78 13 3906764800 [HDD]
     NTFS, blocksize=4096, 2000 GB / 1862 GiB
BAD_RS LBA=4650790042 556919
file_pread(5,3,buffer,4650790042(289498/74/11)) lseek err Invalid argument
file_pread(5,1,buffer,4650790042(289498/74/11)) lseek err Invalid argument
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
     FAT12                289498  74 11 378333 249  8 1427145298
This partition ends after the disk limits. (start=4650790042, size=1427145298, end=6077935339, disk end=3907029168)
BAD_RS LBA=2623841512 18446744073709551615
check_part_i386 failed for partition type 01
     FAT12                163326 147 62 385590  57 44 3570665473
This partition ends after the disk limits. (start=2623841512, size=3570665473, end=6194506984, disk end=3907029168)
NTFS at 243201/45/44
filesystem size           3907024896
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 243201  45 44 3907024896
     NTFS found using backup sector, blocksize=4096, 2000 GB / 1863 GiB
file_pread(5,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,11,buffer,3907029168(243201/81/1)) ReadFile Incorrect function.

file_pread(5,1,buffer,3907029168(243201/81/1)) ReadFile Incorrect function.

file_pread(5,2,buffer,3907031090(243201/111/33)) lseek err Invalid argument
file_pread(5,11,buffer,3907029181(243201/81/14)) lseek err Invalid argument
file_pread(5,1,buffer,3907029181(243201/81/14)) lseek err Invalid argument
file_pread(5,2,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(5,2,buffer,3907029169(243201/81/2)) lseek err Invalid argument
file_pread(5,8,buffer,3907029184(243201/81/17)) lseek err Invalid argument
file_pread(5,11,buffer,3907029231(243201/82/1)) lseek err Invalid argument
file_pread(5,2,buffer,3907031153(243201/112/33)) lseek err Invalid argument
file_pread(5,8,buffer,3907029248(243201/82/18)) lseek err Invalid argument
file_pread(5,1,buffer,3907029248(243201/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,3907029376(243201/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,3907029504(243201/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,3907029632(243201/88/24)) lseek err Invalid argument
file_pread(5,8,buffer,3907029760(243201/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,3907029888(243201/92/28)) lseek err Invalid argument
file_pread(5,8,buffer,3907030016(243201/94/30)) lseek err Invalid argument
file_pread(5,8,buffer,3907030144(243201/96/32)) lseek err Invalid argument
file_pread(5,8,buffer,3907030272(243201/98/34)) lseek err Invalid argument
file_pread(5,8,buffer,3907030400(243201/100/36)) lseek err Invalid argument
file_pread(5,8,buffer,3907030528(243201/102/38)) lseek err Invalid argument
file_pread(5,8,buffer,3907030656(243201/104/40)) lseek err Invalid argument
file_pread(5,8,buffer,3907030784(243201/106/42)) lseek err Invalid argument
file_pread(5,8,buffer,3907030912(243201/108/44)) lseek err Invalid argument
file_pread(5,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,1,buffer,3907031040(243201/110/46)) lseek err Invalid argument
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (2000 GB / 1863 GiB) seems too small! (< 3171 GB / 2953 GiB)
The following partitions can't be recovered:
     FAT12                163326 147 62 385590  57 44 3570665473
     FAT12                289498  74 11 378333 249  8 1427145298

Results
     HPFS - NTFS              0  32 33 243201  45 44 3907024896
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
     HPFS - NTFS             16 113 34 243201  78 13 3906764800 [HDD]
     NTFS, blocksize=4096, 2000 GB / 1862 GiB

interface_write()
 1 P HPFS - NTFS              0  32 33 243201  45 44 3907024896
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
Current partition structure:
 1 * HPFS - NTFS              0  32 33 243201  45 44 3907024896

search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
NTFS at 0/32/33
filesystem size           3907024896
sectors_per_cluster       8
mft_lcn                   786432
mftmirr_lcn               2
clusters_per_mft_record   -10
clusters_per_index_record 1
     HPFS - NTFS              0  32 33 243201  45 44 3907024896
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
file_pread(5,2,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,1,buffer,3907031039(243201/110/45)) lseek err Invalid argument
file_pread(5,2,buffer,3907031040(243201/110/46)) lseek err Invalid argument
file_pread(5,8,buffer,3907029248(243201/82/18)) lseek err Invalid argument
file_pread(5,8,buffer,3907029376(243201/84/20)) lseek err Invalid argument
file_pread(5,8,buffer,3907029504(243201/86/22)) lseek err Invalid argument
file_pread(5,8,buffer,3907029632(243201/88/24)) lseek err Invalid argument
file_pread(5,8,buffer,3907029760(243201/90/26)) lseek err Invalid argument
file_pread(5,8,buffer,3907029888(243201/92/28)) lseek err Invalid argument
file_pread(5,8,buffer,3907030016(243201/94/30)) lseek err Invalid argument
file_pread(5,8,buffer,3907030144(243201/96/32)) lseek err Invalid argument
file_pread(5,8,buffer,3907030272(243201/98/34)) lseek err Invalid argument
file_pread(5,8,buffer,3907030400(243201/100/36)) lseek err Invalid argument
file_pread(5,8,buffer,3907030528(243201/102/38)) lseek err Invalid argument
file_pread(5,8,buffer,3907030656(243201/104/40)) lseek err Invalid argument
file_pread(5,8,buffer,3907030784(243201/106/42)) lseek err Invalid argument
file_pread(5,8,buffer,3907030912(243201/108/44)) lseek err Invalid argument
file_pread(5,6,buffer,3907031042(243201/110/48)) lseek err Invalid argument
file_pread(5,8,buffer,3907031048(243201/110/54)) lseek err Invalid argument
file_pread(5,3,buffer,3907031056(243201/110/62)) lseek err Invalid argument
file_pread(5,3,buffer,3907031103(243201/111/46)) lseek err Invalid argument
file_pread(5,8,buffer,3907031119(243201/111/62)) lseek err Invalid argument
file_pread(5,11,buffer,3907031166(243201/112/46)) lseek err Invalid argument
file_pread(5,2,buffer,3907033088(243201/143/15)) lseek err Invalid argument

Results
   * HPFS - NTFS              0  32 33 243201  45 44 3907024896
     NTFS, blocksize=4096, 2000 GB / 1863 GiB


dir_partition inode=5
   * HPFS - NTFS              0  32 33 243201  45 44 3907024896
     NTFS, blocksize=4096, 2000 GB / 1863 GiB
Directory /
       5 dr-xr-xr-x     0      0         0 20-May-2018 17:28 .
       5 dr-xr-xr-x     0      0         0 20-May-2018 17:28 ..
      38 dr-xr-xr-x     0      0         0 19-May-2018 21:29 $RECYCLE.BIN
      36 dr-xr-xr-x     0      0         0 20-May-2018 16:18 System Volume Information

interface_write()
 1 P HPFS - NTFS              0  32 33 243201  45 44 3907024896

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Invalid FAT boot sector - unsure what to do

#2 Post by cgrenier »

You have to use 'p' to list the content of each partition.
But as you have reformated the partition, it's probably useless. You can use PhotoRec but like Recuva, it will recover file without the original filenames or directory structure.
https://www.cgsecurity.org/testdisk.pdf contains some tips about sorting the recovered files.

Locked