both File Allocation Tables corrupted in FAT32 partition

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
landroni
Posts: 10
Joined: 19 Apr 2012, 15:21

both File Allocation Tables corrupted in FAT32 partition

#1 Post by landroni »

Hello
I am trying to fix the harddisk of a friend and I am at a loss. The disk is:

root@liv-laptop:/home/liv/Build/ppa/midori# fdisk -l

[..]

Disk /dev/sdb: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x5b6ac646

Device Boot Start End Blocks Id System
/dev/sdb1 1 38913 312568641 c W95 FAT32 (LBA)


The issue seems to have arrived when my friend plugged out the disk without 'Removing it safely' first. Now plugging it into Windows doesn't work: trying to access H:/ asks to reformat the drive. Scandisk seems not installed on this system. I have tried:
chkdsk h: /f

but it fails with (rough translation from French):
The type of the file system is FAT32.
Error while reading the file allocation table (FAT 1).
Error while reading the file allocation table (FAT 2).
There is no readable file allocation table (FAT).

So, as far as I understand FAT32 has two copies of the FAT, and both are corrupted. When trying 'fsck' on Linux it fails:
root@liv-laptop:/home/liv/Build/ppa/midori# fsck.vfat /dev/sdb
dosfsck 3.0.7, 24 Dec 2009, FAT32, LFN
Logical sector size (64543 bytes) is not a multiple of the physical sector size.

HOWEVER, the strange part is that plugging the disk on Ubuntu Linux initially takes a lot of time, but subsequently allows to browse the directories on the partition. It also allows to copy _some_ files, but for others Thunar fails to copy with either 'bad sector' or 'invalid address' or 'file input/output' errors. So at this point I'm stuck.

Next I'd like to use 'testdisk' to repair the damned table but I'm not sure how to proceed. I found [1] but I'm not sure I understand it properly. Specifically, what does this mean: "This function must only be used on FAT filesystems with correct values in the boot sector."? How can I check that the FAT FS has correct values in the boot sector?

Moreover, "the menu Repair FAT will have TestDisk compare the two FAT copies. If the FATs mismatch (sector by sector check) or contains errors, TestDisk uses the FAT copy with less errors and removes the obvious errors. " Does this procedure put the data to risk? (Not that they're particularly available right now..) In other words, is it safe, or should I try something more conservative first?

If these last two questions are put to rest, what is the exact procedure that I should use in the 'testdisk' interface? Is it documented somewhere?

Regards
Liviu

[1] http://www.cgsecurity.org/wiki/Advanced_FAT_Repair

landroni
Posts: 10
Joined: 19 Apr 2012, 15:21

Re: both File Allocation Tables corrupted in FAT32 partition

#2 Post by landroni »

To complete the original post. When using 'testdisk' I get the following screens. Immediately after hitting the 'analyse' button I am getting this:

Code: Select all

Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 P FAT32 LBA                0   1  1 38912 254 63  625137282 [My Passport]

Bad sector count.
No partition is bootable

I'm not sure what the messages really mean, and I'm not sure if I should heed this [1].
[1] http://www.cgsecurity.org/wiki/Menu_Geo ... f_heads.3F


After doing the 'Quick search' I got:

Code: Select all

Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Analyse cylinder 38913/38912: 100%


  FAT32 LBA                0   1  1 38912 254 63  625137282 [My Passport]


Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
FAT32, 320 GB / 298 GiB

This info looked fine to me (especially since the directory and file listing---using P---seemed OK) so I went ahead and hit 'Write'. But now I'm wondering if that was a good idea. Do you see anything interesting in this output? Any advice on how to proceed?

UPDATE: After the 'Write' above, fsck still fails on the drive:

Code: Select all

root@liv-laptop:/home/liv/Build/ppa/midori# fsck.vfat -n /dev/sdb
dosfsck 3.0.7, 24 Dec 2009, FAT32, LFN
Logical sector size (64543 bytes) is not a multiple of the physical sector size.

landroni
Posts: 10
Joined: 19 Apr 2012, 15:21

Re: both File Allocation Tables corrupted in FAT32 partition

#3 Post by landroni »

Yet another update. Now accessing Advanced > Boot I get the following screen:

Code: Select all

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
     Partition                  Start        End    Size in sectors
 1 * FAT32 LBA                0   1  1 38912 254 63  625137282 [My Passport]

Boot sector
OK

Backup boot sector
OK

First sectors (Boot code and partition information) are not identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.
But I'm not sure how to parse it. Should I 'Rebuild BS'?

WHen I hit 'List', I get this:

Code: Select all

 1 * FAT32 LBA                0   1  1 38912 254 63  625137282 [My Passport]
Directory /

No file found, filesystem may be damaged.
Does this mean that there is other trouble with the disk that should be addressed first?

Moreover, when I analyse the disk I get this:

Code: Select all

Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
Analyse cylinder 38913/38912: 100%


  FAT32 LBA                0   1  1 38912 254 63  625137282 [My Passport]
Notice "38913/38912". Does this suggest something fishy?

Thanks!

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: both File Allocation Tables corrupted in FAT32 partition

#4 Post by Fiona »

Chkdsk fsck etc.. would be only a try to repair a file system, but it's not intended to recover data.
Using it can increase damage.
Moreover, "the menu Repair FAT will have TestDisk compare the two FAT copies. If the FATs mismatch (sector by sector check) or contains errors, TestDisk uses the FAT copy with less errors and removes the obvious errors. " Does this procedure put the data to risk? (Not that they're particularly available right now..) In other words, is it safe, or should I try something more conservative first?
Did you read the note at the bottom of the screen?
It means very dangerous!

Your partition table looks ok, so there is nothing to do.
This info looked fine to me (especially since the directory and file listing---using P---seemed OK) so I went ahead
Would you like to copy/backup important files first?
It's highly recommendable to do so first!
Don't run any disk utilities against your disk anymore and don't change, edit or write anything to your affected disk.

Code: Select all

But I'm not sure how to parse it. Should I 'Rebuild BS'? 
Yes, test Rebuild BS.
If it's successful, you'll see the menu List.
Please check, are your data are listed or an error message.
Please let me know.
If yes, consider backing up data first.
Don't use write at the moment.
Upload the infos from Rebuild BS.

Fiona

landroni
Posts: 10
Joined: 19 Apr 2012, 15:21

Re: both File Allocation Tables corrupted in FAT32 partition

#5 Post by landroni »

Hello
Thanks for the speedy reply.
Fiona wrote:Your partition table looks ok, so there is nothing to do.
At least some good news.

Would you like to copy/backup important files first?
I tried to do so, but failed. First I tried with Linux and Thunar, and it did work for some files, but for many others it was failing with 'bad sector' or 'invalid address' or 'file input/output' errors.

I also tried to use the 'testdisk' interface, but copying seemed to be taking forever (on a relatively small folder), and since there was no progress bar I stopped the process.

Can I approach this differently?

Yes, test Rebuild BS.
If it's successful, you'll see the menu List.
Please check, are your data are listed or an error message.
I will try so tomorrow when I get physical access to the drive. Will keep you posted.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: both File Allocation Tables corrupted in FAT32 partition

#6 Post by Fiona »

The purpose of testing Rebuild BS makes only sense if the extrapolated boot sector is different to the current one.
It might be possible that copying gets improved.

Fiona

landroni
Posts: 10
Joined: 19 Apr 2012, 15:21

Re: both File Allocation Tables corrupted in FAT32 partition

#7 Post by landroni »

Fiona wrote:The purpose of testing Rebuild BS makes only sense if the extrapolated boot sector is different to the current one.
It might be possible that copying gets improved.
After several hours 'Rebuild BS' finished and the extrapolated boot sector was indeed different. Unfortunately, it didn't improve the copying: it still takes 3-4 hours for a 300MB file (and although the .zip archive opens, it fails an integrity test).

I am trying to upload the log here, but apparently the forum rejects .txt and .log files. See [1] for the full log.
[1] http://s000.tinyupload.com/index.php?fi ... 6902990921

I guess the most important part is this:

Code: Select all

Disk /dev/sdb - 320 GB / 298 GiB - CHS 38913 255 63
     Partition                  Start        End    Size in sectors
 1 * FAT32 LBA                0   1  1 38912 254 63  625137282 [My Passport]

FAT : 32
cluster_size 64 64
reserved     32 32
total_sect   625137282 625137282
fat32_length 76302 76302
root_cluster 2 2
free_count   18446744073709551615 18446744073709551615
next_free    18446744073709551615 8
Extrapolated boot sector and current boot sector are different.

Any advice on how to proceed?

Thanks!

Locked