Repair FAT of HDD

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Adrinux
Posts: 3
Joined: 06 Apr 2015, 15:08

Repair FAT of HDD

#1 Post by Adrinux »

Hello, I am Adrian and 6 days ago when recovering from a system failure with my backup HDD (1TB) the very backup HDD had its file system corrupted.

Now I ask/beg for advice because I don't know how to proceed, I have little bullets left. There is very important data on the drive: code, projects, personal information...


I think that the corrupted drive is physically ok, (at least SMART stats seem ok).

I created an image of the drive using ddrescue (forgot to create the log) and worked on it. No errors in the process. I didn't specify an extension of the image and I don't know what is the default format for ddrescue. I guess it must be ".dd".

The drive partition format is MBR, and the only partition it has -default partition of the product- seems to be ok.
I ran TestDisk first on Windows and now on Ubuntu and it detects Intel/PC partition system, and when entering on the Analyse option shows the partition info:
Picture of the partition
Picture of the partition
WDimagen_Partition.png (108.68 KiB) Viewed 3007 times
QuickSearch->P and I think that it shows the files following the data of a corrupted FAT:
Listed Files
Listed Files
WDimagen_Files.png (251.07 KiB) Viewed 3007 times
These kind of strange names are the same (or similar) that I see when I plug in the device in Windows. Testdisk highlights some of the files in red.

This is what happens when I try to enter in one of the directories shown on the picture:
File System damaged message
File System damaged message
WDimagen_FileSystem.png (110.18 KiB) Viewed 3007 times
Thus I came to the conclusion that the FAT of the main partition has been corrupted and the system is not able to properly swim throw the file system. It shows random directories and it is not able to enter to the files because the pointers are random.

Now I ran the Advanced options, and boot sector and backup bootsector are Ok. It shows this message:

Code: Select all

     Partition                  Start        End    Size in sectors
 1 * FAT32 LBA                0   1  1 121596 254 63 1953455742

Boot sector
OK

Backup boot sector
OK

First sectors (Boot code and partition information) are not identical.
Second sectors (cluster information) are not identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.
And here is where I am lost. I don't know what to do here. I have used the RebuildBS option just to see what happened though if the boot sectors are ok it doesn't make sense. I pressed the Automatic option and it came to the result that Extrapolated boot sector and current boot sector are different.

Am I wrong in some conclusion?
What should be my next step?



Thank you.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Repair FAT of HDD

#2 Post by cgrenier »

If you think the partition was using NTFS, in the Advanced menu of TestDisk, force the type to 7 HPFS-NTFS and try Boot, RebuildBS, List.

If it was a FAT32 or TestDisk failed, you can always try PhotoRec but it will not recover the original filenames.

Adrinux
Posts: 3
Joined: 06 Apr 2015, 15:08

Re: Repair FAT of HDD

#3 Post by Adrinux »

The filesystem is FAT32. But what should I do now? Should I write the auto-extrapolated boot sector? Should I repeat the BuildBS and manually check all what TestDisk finds?...

Adrinux
Posts: 3
Joined: 06 Apr 2015, 15:08

Re: Repair FAT of HDD

#4 Post by Adrinux »

Actually I was wrong. I checked the box of the HDD and it says "Formatted NTFS". I am doing what you said, right now it is searching the mft. Photorec is not very usefull because I don't get the name of the files nor the directories (and there were a lot of files) and I think that it does not recover all kind of files (like .dll, .css, .m...)

Locked