Page 1 of 1

Repair FAT of HDD

Posted: 06 Apr 2015, 16:19
by Adrinux
Hello, I am Adrian and 6 days ago when recovering from a system failure with my backup HDD (1TB) the very backup HDD had its file system corrupted.

Now I ask/beg for advice because I don't know how to proceed, I have little bullets left. There is very important data on the drive: code, projects, personal information...

I think that the corrupted drive is physically ok, (at least SMART stats seem ok).

I created an image of the drive using ddrescue (forgot to create the log) and worked on it. No errors in the process. I didn't specify an extension of the image and I don't know what is the default format for ddrescue. I guess it must be ".dd".

The drive partition format is MBR, and the only partition it has -default partition of the product- seems to be ok.
I ran TestDisk first on Windows and now on Ubuntu and it detects Intel/PC partition system, and when entering on the Analyse option shows the partition info:
Picture of the partition
Picture of the partition
WDimagen_Partition.png (108.68 KiB) Viewed 2270 times
QuickSearch->P and I think that it shows the files following the data of a corrupted FAT:
Listed Files
Listed Files
WDimagen_Files.png (251.07 KiB) Viewed 2270 times
These kind of strange names are the same (or similar) that I see when I plug in the device in Windows. Testdisk highlights some of the files in red.

This is what happens when I try to enter in one of the directories shown on the picture:
File System damaged message
File System damaged message
WDimagen_FileSystem.png (110.18 KiB) Viewed 2270 times
Thus I came to the conclusion that the FAT of the main partition has been corrupted and the system is not able to properly swim throw the file system. It shows random directories and it is not able to enter to the files because the pointers are random.

Now I ran the Advanced options, and boot sector and backup bootsector are Ok. It shows this message:

Code: Select all

     Partition                  Start        End    Size in sectors
 1 * FAT32 LBA                0   1  1 121596 254 63 1953455742

Boot sector

Backup boot sector

First sectors (Boot code and partition information) are not identical.
Second sectors (cluster information) are not identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.
And here is where I am lost. I don't know what to do here. I have used the RebuildBS option just to see what happened though if the boot sectors are ok it doesn't make sense. I pressed the Automatic option and it came to the result that Extrapolated boot sector and current boot sector are different.

Am I wrong in some conclusion?
What should be my next step?

Thank you.

Re: Repair FAT of HDD

Posted: 07 Apr 2015, 07:21
by cgrenier
If you think the partition was using NTFS, in the Advanced menu of TestDisk, force the type to 7 HPFS-NTFS and try Boot, RebuildBS, List.

If it was a FAT32 or TestDisk failed, you can always try PhotoRec but it will not recover the original filenames.

Re: Repair FAT of HDD

Posted: 07 Apr 2015, 14:42
by Adrinux
The filesystem is FAT32. But what should I do now? Should I write the auto-extrapolated boot sector? Should I repeat the BuildBS and manually check all what TestDisk finds?...

Re: Repair FAT of HDD

Posted: 07 Apr 2015, 22:09
by Adrinux
Actually I was wrong. I checked the box of the HDD and it says "Formatted NTFS". I am doing what you said, right now it is searching the mft. Photorec is not very usefull because I don't get the name of the files nor the directories (and there were a lot of files) and I think that it does not recover all kind of files (like .dll, .css, .m...)