Accidently initialized external hdd in Fat32Formatter

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
CyKoDeLiC
Posts: 6
Joined: 01 Dec 2014, 22:37

Accidently initialized external hdd in Fat32Formatter

#1 Post by CyKoDeLiC »

Hi there, I accidentally clicked on initialized on the wrong external harddrive in Fat32Formatter and now I cannot use this drive anymore. A german forum pointed me to this program, that it could help me. How is it possible to build up the old file structure? First partition was Fat32, sencond was NTFS.

Hope you could help me here!

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Accidently initialized external hdd in Fat32Formatter

#2 Post by Fiona »

I've no idea what your FAT32 formatter means with initializing?
Initializing under Windows writes only a 4 Bytes signature to your MBR, so that Windows can handle it.
Initializing Disks under Windows is necessary since W2k.
How is your listed under your disk management console?
Can you run a Diagnose, running Analyse, Quick Search and if no parrtition is found, Deeper Search also?
If partitions are found, please mark them and press p to have a try to list your files.
Please copy and paste the content of your testdisk.log into your next post!

Fiona

CyKoDeLiC
Posts: 6
Joined: 01 Dec 2014, 22:37

Re: Accidently initialized external hdd in Fat32Formatter

#3 Post by CyKoDeLiC »

Hey there, thanks for replying. I think initializing is exactly, what you think it is. You can download the program here and see for yourself:

http://www.heise.de/download/fat32formatter.html

In disk manager it is unallocated and it has got no drive letters either, but is online.

I am doing an analyse with your program right now. It takes some time and I will show the results, if it is done.

CyKoDeLiC
Posts: 6
Joined: 01 Dec 2014, 22:37

Re: Accidently initialized external hdd in Fat32Formatter

#4 Post by CyKoDeLiC »

Ok, here is the log. I've managed to get the second NTFS partition to work again, but not the first 500GB Fat32 partition. But he didn't even recognized it in the program.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Accidently initialized external hdd in Fat32Formatter

#5 Post by Fiona »

Didn't find your log?
You can either zip and upload your log or copy and paste the content of your logfile into your next post.

Fiona

CyKoDeLiC
Posts: 6
Joined: 01 Dec 2014, 22:37

Re: Accidently initialized external hdd in Fat32Formatter

#6 Post by CyKoDeLiC »

Sorry, thought I attached the file. Here is the log:

Tue Dec 02 13:58:51 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, October 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.8, MinGW 3.11
Compilation date: Nov 13 2014 18:59:59
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=1500267937792
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=479548407808
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=31457280
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=499896025088
filewin32_getfilesize(\\.\G:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\G:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=451687743488
filewin32_getfilesize(\\.\I:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\I:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=1048577048576
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 480 GB / 447 GiB - CHS 58369 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512
Disk \\.\PhysicalDrive3 - 1500 GB / 1397 GiB - CHS 182397 255 63, sector size=512
Drive C: - 479 GB / 446 GiB - CHS 58301 255 63, sector size=512
Drive E: - 31 MB / 30 MiB - CHS 7 64 32, sector size=2048
Drive F: - 499 GB / 465 GiB - CHS 60775 255 63, sector size=512
Drive H: - 451 GB / 420 GiB - CHS 54914 255 63, sector size=512
Drive J: - 1048 GB / 976 GiB - CHS 127482 255 63, sector size=512

Partition table type default to Intel
Disk \\.\PhysicalDrive2 - 2000 GB / 1862 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive2 - 2000 GB / 1862 GiB - CHS 243197 255 63
Current partition structure:
No partition is bootable

search_part()
Disk \\.\PhysicalDrive2 - 2000 GB / 1862 GiB - CHS 243197 255 63
NTFS at 243197/57/60
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
filesystem size 2930400949
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 183150059
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 60788 52 12 243197 57 60 2930400949
NTFS found using backup sector, blocksize=4096, 1500 GB / 1397 GiB

Results
L HPFS - NTFS 60788 52 12 243197 57 60 2930400949
NTFS found using backup sector, blocksize=4096, 1500 GB / 1397 GiB

interface_write()
1 P HPFS - NTFS 60788 52 12 243197 57 60 2930400949

search_part()
Disk \\.\PhysicalDrive2 - 2000 GB / 1862 GiB - CHS 243197 255 63
NTFS at 243197/57/60
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
filesystem size 2930400949
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 183150059
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 60788 52 12 243197 57 60 2930400949
NTFS found using backup sector, blocksize=4096, 1500 GB / 1397 GiB
Search for partition aborted

Results
L HPFS - NTFS 60788 52 12 243197 57 60 2930400949
NTFS found using backup sector, blocksize=4096, 1500 GB / 1397 GiB

interface_write()
1 P HPFS - NTFS 60788 52 12 243197 57 60 2930400949
write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

ntfs_boot_sector
1 P HPFS - NTFS 60788 52 12 243197 57 60 2930400949
NTFS found using backup sector, blocksize=4096, 1500 GB / 1397 GiB
NTFS at 60788/52/12
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
NTFS at 60788/52/12
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
filesystem size 2930400949
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 183150059
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Warning: number of heads/cylinder mismatches 0 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 0 (NTFS) != 63 (HD)
Status: OK

Backup boot sector
Warning: number of heads/cylinder mismatches 0 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 0 (NTFS) != 63 (HD)
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

Directory /
5 dr-xr-xr-x 0 0 0 24-Nov-2014 22:45 .
5 dr-xr-xr-x 0 0 0 24-Nov-2014 22:45 ..
146 dr-xr-xr-x 0 0 0 10-Oct-2014 16:07 $RECYCLE.BIN
65 dr-xr-xr-x 0 0 0 8-Apr-2014 10:51 847739a0602792fecc273831a7

he found everything. just deleted the rest cause of privacy reasons

ntfs_boot_sector
1 P HPFS - NTFS 60788 52 12 243197 57 60 2930400949
NTFS found using backup sector, blocksize=4096, 1500 GB / 1397 GiB
NTFS at 60788/52/12
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
NTFS at 60788/52/12
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
filesystem size 2930400949
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 183150059
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Warning: number of heads/cylinder mismatches 0 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 0 (NTFS) != 63 (HD)
Status: OK

Backup boot sector
Warning: number of heads/cylinder mismatches 0 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 0 (NTFS) != 63 (HD)
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
repair_MFT
NTFS at 60788/52/12
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
Please quit TestDisk and reboot your computer before trying to fix the MFT.
Please quit TestDisk and reboot your computer before trying to fix the MFT.

ntfs_boot_sector
1 P HPFS - NTFS 60788 52 12 243197 57 60 2930400949
NTFS found using backup sector, blocksize=4096, 1500 GB / 1397 GiB
NTFS at 60788/52/12
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
NTFS at 60788/52/12
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
filesystem size 2930400949
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 183150059
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Warning: number of heads/cylinder mismatches 0 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 0 (NTFS) != 63 (HD)
Status: OK

Backup boot sector
Warning: number of heads/cylinder mismatches 0 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 0 (NTFS) != 63 (HD)
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
Search mft stopped: 1048576/2930400949
Failed to rebuild NTFS boot sector.

ntfs_boot_sector
1 P HPFS - NTFS 60788 52 12 243197 57 60 2930400949
NTFS found using backup sector, blocksize=4096, 1500 GB / 1397 GiB
NTFS at 60788/52/12
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
NTFS at 60788/52/12
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
filesystem size 2930400949
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 183150059
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Warning: number of heads/cylinder mismatches 0 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 0 (NTFS) != 63 (HD)
Status: OK

Backup boot sector
Warning: number of heads/cylinder mismatches 0 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 0 (NTFS) != 63 (HD)
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
You will have to reboot for the change to take effect.
New options :
Dump : No
Align partition: Yes
Expert mode : No
A new copy of MBR code has been written.
You have to reboot for the change to take effect.

Analyse Disk \\.\PhysicalDrive2 - 2000 GB / 1862 GiB - CHS 243197 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 60788/52/12
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
Current partition structure:
Warning: number of heads/cylinder mismatches 0 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 0 (NTFS) != 63 (HD)
1 P HPFS - NTFS 60788 52 12 243197 57 60 2930400949
No partition is bootable

search_part()
Disk \\.\PhysicalDrive2 - 2000 GB / 1862 GiB - CHS 243197 255 63
NTFS at 60788/52/12
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
filesystem size 2930400949
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 183150059
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 60788 52 12 243197 57 60 2930400949
NTFS, blocksize=4096, 1500 GB / 1397 GiB
Search for partition aborted

Results
L HPFS - NTFS 60788 52 12 243197 57 60 2930400949
NTFS, blocksize=4096, 1500 GB / 1397 GiB

interface_write()
1 P HPFS - NTFS 60788 52 12 243197 57 60 2930400949



Tue Dec 02 19:02:25 2014
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, October 2014
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.8, MinGW 3.11
Compilation date: Nov 13 2014 18:59:59
ext2fs lib: none, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=480103981056
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=4000752599040
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive3)=2000365289472
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=479548407808
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=31457280
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=499896025088
filewin32_getfilesize(\\.\G:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\G:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=4000751550464
filewin32_getfilesize(\\.\I:) GetFileSize err Unzulässige Funktion.


filewin32_setfilepointer(\\.\I:) SetFilePointer err Unzulässige Funktion.


Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=1500365285888
Hard disk list
Disk \\.\PhysicalDrive0 - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512
Disk \\.\PhysicalDrive1 - 480 GB / 447 GiB - CHS 58369 255 63, sector size=512
Disk \\.\PhysicalDrive2 - 4000 GB / 3725 GiB - CHS 60799 255 63, sector size=4096
Disk \\.\PhysicalDrive3 - 2000 GB / 1862 GiB - CHS 243197 255 63, sector size=512
Drive C: - 479 GB / 446 GiB - CHS 58301 255 63, sector size=512
Drive E: - 31 MB / 30 MiB - CHS 7 64 32, sector size=2048
Drive F: - 499 GB / 465 GiB - CHS 60775 255 63, sector size=512
Drive H: - 4000 GB / 3725 GiB - CHS 60799 255 63, sector size=4096
Drive J: - 1500 GB / 1397 GiB - CHS 182409 255 63, sector size=512

Partition table type (auto): Intel
Disk \\.\PhysicalDrive3 - 2000 GB / 1862 GiB
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive3 - 2000 GB / 1862 GiB - CHS 243197 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 60788/52/12
heads/cylinder 0 (NTFS) != 255 (HD)
sect/track 0 (NTFS) != 63 (HD)
Current partition structure:
Warning: number of heads/cylinder mismatches 0 (NTFS) != 255 (HD)
Warning: number of sectors per track mismatches 0 (NTFS) != 63 (HD)
1 P HPFS - NTFS 60788 52 12 243197 57 60 2930400949
No partition is bootable

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Accidently initialized external hdd in Fat32Formatter

#7 Post by Fiona »

Did you use testdisk 64bit?
Info:
Windows 64-bit Use only on systems lacking WoW64 as some features are missing.
In case, please repeat your diagnose running testdisk 32bit!
Select your Disk instead of your physically drive.
As you mentioned , you're still missing your first FAT32 partition?
Did you already recover your second NTFS-partition?
The backup of the boot sector on a FAT32partition is sektor 6 of your file system.
So it's at the beginning of your partition.
If your boot sector and its backup are overridden, testdisk can't find your partition anymore.
In some cases, recreation of an empty unformatted partition and runng TestDisk / Advanced / RebuildBS could repair it.
But only if you created your empty partition exactly like before.
In case, info will follow!
Formatting a file syestem would overrides your previous file system and you'd need datarecovery software to have a try to recover your data.

Fiona

CyKoDeLiC
Posts: 6
Joined: 01 Dec 2014, 22:37

Re: Accidently initialized external hdd in Fat32Formatter

#8 Post by CyKoDeLiC »

Hey thanks for replying. Wouldn't it be easier for us to write in German instead, maybe via PN?

I used the 32bit Version. I've been able to recover the second NTFS Partition. Everything is readable. Only the first Fat32 isn't. It cannot find it at all. I don't want to erase it, there are some important data on it.

Locked