Recover of disappeared FAT32 partition content

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
bruce
Posts: 5
Joined: 17 Dec 2013, 15:24

Recover of disappeared FAT32 partition content

#1 Post by bruce »

Hello testdisk community,

after a move and an enlargement of one particular partition on a 2 TB HDD, this disk could not be started.
Fortunately I use a multiboot grub system and carried out testdisk with an old win xp system.
After several passes of analysis the MFT was replaced and a new MBR was written to disk.

The result was that the HDD would again not start.
Most of the partitions are available and visible. Except for one with a size of about 104 GiB.

According the testdisk recovery examples at https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step


After several passes of testdisk
[Analyse] --> [Quick Search] --> [Deeper Search]

Code: Select all

Sat Apr  7 22:05:43 2018
Command line: TestDisk

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP2
Compiler: GCC 4.8, Cygwin 1007.34
Compilation date: 2015-04-18T13:01:55
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504, curses lib: ncurses 5.9
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=400088457216
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=400088457216
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=31560367104
filewin32_getfilesize(\\.\D:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=214030139904
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=107602887168
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=31876637184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=100162331136
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=33846994944
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\L:)=64469647872
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\M:)=52169015808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\N:)=32218389504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\O:)=164508664320
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\P:)=32226614784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Q:)=42796099584
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\R:)=10768310784
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\S:)=152191517184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\T:)=60620087808
filewin32_getfilesize(\\.\U:) GetFileSize err Unzulässige Funktion.

filewin32_setfilepointer(\\.\U:) SetFilePointer err Unzulässige Funktion.

Warning: can't get size for \\.\U:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\V:)=160338092544
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\W:)=52169015808
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\X:)=64776208896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\Y:)=54192112128
Hard disk list
Disk /dev/sda - 400 GB / 372 GiB - CHS 48641 255 63, sector size=512
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 3876021 16 63, sector size=512
Drive C: - 31 GB / 29 GiB - CHS 3836 255 63, sector size=512
Drive E: - 214 GB / 199 GiB - CHS 414709 16 63, sector size=512
Drive F: - 107 GB / 100 GiB - CHS 208493 16 63, sector size=512
Drive H: - 31 GB / 29 GiB - CHS 61764 16 63, sector size=512
Drive I: - 100 GB / 93 GiB - CHS 194076 16 63, sector size=512
Drive J: - 33 GB / 31 GiB - CHS 4114 255 63, sector size=512
Drive L: - 64 GB / 60 GiB - CHS 124917 16 63, sector size=512
Drive M: - 52 GB / 48 GiB - CHS 101083 16 63, sector size=512
Drive N: - 32 GB / 30 GiB - CHS 3916 255 63, sector size=512
Drive O: - 164 GB / 153 GiB - CHS 318755 16 63, sector size=512
Drive P: - 32 GB / 30 GiB - CHS 3917 255 63, sector size=512
Drive Q: - 42 GB / 39 GiB - CHS 5202 255 63, sector size=512
Drive R: - 10 GB / 10 GiB - CHS 20864 16 63, sector size=512
Drive S: - 152 GB / 141 GiB - CHS 294889 16 63, sector size=512
Drive T: - 60 GB / 56 GiB - CHS 117458 16 63, sector size=512
Drive V: - 160 GB / 149 GiB - CHS 310674 16 63, sector size=512
Drive X: - 64 GB / 60 GiB - CHS 125511 16 63, sector size=512
Drive Y: - 54 GB / 50 GiB - CHS 105003 16 63, sector size=512

Partition table type (auto): Intel
Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB
Partition table type: Intel

Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 3876021 16 63
Geometry from i386 MBR: head=16 sector=63
NTFS at 0/1/1
FAT32 at 231306/1/1
Info: size boot_sector 118398609, partition 118398609
FAT1 : 32-28947
FAT2 : 28948-57863
start_rootdir : 2396424 root cluster : 73082
Data : 57864-118398599
sectors : 118398609
cluster_size : 32
no_of_cluster : 3698148 (2 - 3698149)
fat_length 28916 calculated 28892
set_FAT_info: name from BS used
NTFS at 348765/1/1
FAT32 at 473683/1/1
Info: size boot_sector 163024785, partition 163024785
FAT1 : 32-39835
FAT2 : 39836-79639
start_rootdir : 118390520 root cluster : 3697217
Data : 79640-163024759
sectors : 163024785
cluster_size : 32
no_of_cluster : 5092035 (2 - 5092036)
fat_length 39804 calculated 39782
set_FAT_info: name from BS used
NTFS at 817512/1/1
NTFS at 1136268/1/1
NTFS at 1431158/1/1
FAT32 at 1845868/1/1
Info: size boot_sector 50181201, partition 50181201
FAT1 : 32-24538
FAT2 : 24539-49045
start_rootdir : 1190582 root cluster : 71348
Data : 49046-50181189
sectors : 50181201
cluster_size : 16
no_of_cluster : 3133259 (2 - 3133260)
fat_length 24507 calculated 24479
set_FAT_info: name from BS used
FAT32 at 1895651/1/1
Info: size boot_sector 62259057, partition 62259057
FAT1 : 32-15231
FAT2 : 15232-30431
start_rootdir : 1700896 root cluster : 52204
Data : 30432-62259039
sectors : 62259057
cluster_size : 32
no_of_cluster : 1944644 (2 - 1944645)
fat_length 15200 calculated 15193
set_FAT_info: name from BS used
FAT32 at 1957416/1/1
Info: size boot_sector 21031857, partition 21031857
FAT1 : 33-10302
FAT2 : 10303-20572
start_rootdir : 309325 root cluster : 18049
Data : 20573-21031852
sectors : 21031857
cluster_size : 16
no_of_cluster : 1313205 (2 - 1313206)
fat_length 10270 calculated 10260
set_FAT_info: name from BS used
FAT32 at 1978281/1/1
Info: size boot_sector 313160337, partition 313160337
FAT1 : 32-76491
FAT2 : 76492-152951
start_rootdir : 3981912 root cluster : 119657
Data : 152952-313160311
sectors : 313160337
cluster_size : 32
no_of_cluster : 9781480 (2 - 9781481)
fat_length 76460 calculated 76418
FAT32 at 2288956/1/1
Info: size boot_sector 101892609, partition 101892609
FAT1 : 33-24910
FAT2 : 24911-49788
start_rootdir : 329021 root cluster : 8728
Data : 49789-101892604
sectors : 101892609
cluster_size : 32
no_of_cluster : 3182588 (2 - 3182589)
fat_length 24878 calculated 24864
set_FAT_info: name from BS used
FAT32 at 2390040/1/1
Info: size boot_sector 85675905, partition 85675905
FAT1 : 32-20955
FAT2 : 20956-41879
start_rootdir : 588504 root cluster : 17084
Data : 41880-85675895
sectors : 85675905
cluster_size : 32
no_of_cluster : 2676063 (2 - 2676064)
fat_length 20924 calculated 20907
set_FAT_info: name from BS used
NTFS at 2475036/1/1
Info: size boot_sector 105843968, partition 105843969
FAT32 at 2580040/1/1
Info: size boot_sector 195629553, partition 195629553
FAT1 : 32-47803
FAT2 : 47804-95575
start_rootdir : 163024760 root cluster : 5091539
Data : 95576-195629527
sectors : 195629553
cluster_size : 32
no_of_cluster : 6110436 (2 - 6110437)
fat_length 47772 calculated 47738
set_FAT_info: name from BS used
FAT32 at 2774117/1/1
Info: size boot_sector 101892609, partition 101892609
FAT1 : 33-24910
FAT2 : 24911-49788
start_rootdir : 329021 root cluster : 8728
Data : 49789-101892604
sectors : 101892609
cluster_size : 32
no_of_cluster : 3182588 (2 - 3182589)
fat_length 24878 calculated 24864
set_FAT_info: name from BS used
FAT32 at 2875201/1/1
Info: size boot_sector 126515373, partition 126516033
FAT1 : 32-30923
FAT2 : 30924-61815
start_rootdir : 588504 root cluster : 16461
Data : 61816-126515351
sectors : 126515373
cluster_size : 32
no_of_cluster : 3951673 (2 - 3951674)
fat_length 30892 calculated 30873
set_FAT_info: name from BS used
get_geometry_from_list_part_aux head=16 nbr=66
get_geometry_from_list_part_aux head=8 nbr=66
get_geometry_from_list_part_aux head=16 nbr=66
get_geometry_from_list_part_aux head=32 nbr=34
get_geometry_from_list_part_aux head=64 nbr=25
get_geometry_from_list_part_aux head=128 nbr=9
get_geometry_from_list_part_aux head=240 nbr=5
get_geometry_from_list_part_aux head=255 nbr=1
Current partition structure:
 1 * HPFS - NTFS              0   1  1 208493  15 63  210161889
 2 E extended LBA         231306   0  1 3000712  15 63 2791562256
 5 L FAT32 LBA            231306   1  1 348764  15 63  118398609 [NO NAME]
   X extended             348765   0  1 473682  15 63  125917344
 6 L HPFS - NTFS          348765   1  1 473682  15 63  125917281
   X extended             473683   0  1 635413  15 63  163024848
 7 L FAT32 LBA            473683   1  1 635413  15 63  163024785 [NO NAME]
   X extended             817512   0  1 1136267  15 63  321306048
 8 L HPFS - NTFS          817512   1  1 1136267  15 63  321305985
   X extended             1136268   0  1 1431157  15 63  297249120
 9 L HPFS - NTFS          1136268   1  1 1431157  15 63  297249057
   X extended             1431158   0  1 1845867  15 63  418027680
10 L HPFS - NTFS          1431158   1  1 1845867  15 63  418027617
   X extended             1845868   0  1 1895650  15 63   50181264
11 L FAT32 LBA            1845868   1  1 1895650  15 63   50181201 [NO NAME]
   X extended             1895651   0  1 1957415  15 63   62259120
12 L FAT32 LBA            1895651   1  1 1957415  15 63   62259057 [NO NAME]
   X extended             1957416   0  1 1978280  15 63   21031920
13 L FAT32 LBA            1957416   1  1 1978280  15 63   21031857 [NO NAME]
   X extended             1978281   0  1 2288955  15 63  313160400
14 L FAT32 LBA            1978281   1  1 2288955  15 63  313160337 [FOTOS]
   X extended             2288956   0  1 2390039  15 63  101892672
15 L FAT32 LBA            2288956   1  1 2390039  15 63  101892609 [NO NAME]
   X extended             2390040   0  1 2475035  15 63   85675968
16 L FAT32 LBA            2390040   1  1 2475035  15 63   85675905 [NO NAME]
   X extended             2475036   0  1 2580039  15 63  105844032
17 L HPFS - NTFS          2475036   1  1 2580039  15 63  105843969
   X extended             2580040   0  1 2774116  15 63  195629616
18 L FAT32 LBA            2580040   1  1 2774116  15 63  195629553 [NO NAME]
   X extended             2774117   0  1 2875200  15 63  101892672
19 L FAT32 LBA            2774117   1  1 2875200  15 63  101892609 [NO NAME]
   X extended             2875201   0  1 3000712  15 63  126516096
20 L FAT32 LBA            2875201   1  1 3000712  15 63  126516033 [NO NAME]
.
.
.

After several passes the following testdisk messages are observed:

Code: Select all

.
.
.
Results
   * HPFS - NTFS              0   1  1 208493  15 63  210161889 
     NTFS, blocksize=4096, 107 GB / 100 GiB
     FAT32 LBA            231306   1  1 348764  15 63  118398609 [NO NAME]
     FAT32, blocksize=16384, 60 GB / 56 GiB
     FAT32 LBA            270503   1  1 348764  15 63   78888033 [NO NAME]
     FAT32, blocksize=16384, 40 GB / 37 GiB
   L HPFS - NTFS          348765   1  1 473682  15 63  125917281
     NTFS, blocksize=4096, 64 GB / 60 GiB
     FAT32 LBA            473683   1  1 635413  15 63  163024785 [NO NAME]
     FAT32, blocksize=16384, 83 GB / 77 GiB
     FAT32 LBA            599089   1  1 817511  15 63  220170321 [NO NAME]
     FAT32, blocksize=16384, 112 GB / 104 GiB
     FAT32 LBA            700789   0  8 1804279   3 42 1112318144
     HPFS - NTFS          817512   1  1 1136267  15 63  321305985
     NTFS, blocksize=4096, 164 GB / 153 GiB
     HPFS - NTFS          1136268   1  1 1431157  15 63  297249057
     NTFS, blocksize=4096, 152 GB / 141 GiB
     HPFS - NTFS          1431158   1  1 1845867  15 63  418027617
     NTFS, blocksize=4096, 214 GB / 199 GiB
   L FAT32 LBA            1845868   1  1 1895650  15 63   50181201 [NO NAME]
     FAT32, blocksize=8192, 25 GB / 23 GiB
   L FAT32 LBA            1895651   1  1 1957415  15 63   62259057 [NO NAME]
     FAT32, blocksize=16384, 31 GB / 29 GiB
   L FAT32 LBA            1957416   1  1 1978280  15 63   21031857 [NO NAME]
     FAT32, blocksize=8192, 10 GB / 10 GiB
   L FAT32 LBA            1978281   1  1 2288955  15 63  313160337 [FOTOS]
     FAT32, blocksize=16384, 160 GB / 149 GiB
   L FAT32 LBA            2288956   1  1 2390039  15 63  101892609 [NO NAME]
     FAT32, blocksize=16384, 52 GB / 48 GiB
   L FAT32 LBA            2390040   1  1 2475035  15 63   85675905 [NO NAME]
     FAT32, blocksize=16384, 43 GB / 40 GiB
     HPFS - NTFS          2475036   1  1 2496358  15 63   21493521
     NTFS found using backup sector, blocksize=4096, 11 GB / 10 GiB
     HPFS - NTFS          2475036   1  1 2580039  15 63  105843969
     NTFS, blocksize=4096, 54 GB / 50 GiB
     FAT32 LBA            2580040   1  1 2774116  15 63  195629553 [NO NAME]
     FAT32, blocksize=16384, 100 GB / 93 GiB
     FAT32 LBA            2719242   0  8 3822732   3 42 1112318144
     FAT32 LBA            2774117   1  1 2875200  15 63  101892609 [NO NAME]
     FAT32, blocksize=16384, 52 GB / 48 GiB
     FAT32 LBA            2875201   1  1 3000712  15 63  126516033 [NO NAME]
     FAT32, blocksize=16384, 64 GB / 60 GiB
.
.
.
So finally the file content of the relevant partition could be found at:

==>
FAT32 LBA 599089 1 1 817511 15 63 220170321 [NO NAME]
FAT32, blocksize=16384, 112 GB / 104 GiB


At first sight the complete directories and probably all files in the FAT32 partition can be listed. :roll:

But if I continue with testdisk, the partition will be no more indicated:

Code: Select all

.
.
.
interface_write()
 1 * HPFS - NTFS              0   1  1 208493  15 63  210161889
 2 E extended LBA         348765   0  1 2475035  15 63 2143281168
 5 L HPFS - NTFS          348765   1  1 473682  15 63  125917281
 6 L FAT32 LBA            1845868   1  1 1895650  15 63   50181201 [NO NAME]
 7 L FAT32 LBA            1895651   1  1 1957415  15 63   62259057 [NO NAME]
 8 L FAT32 LBA            1957416   1  1 1978280  15 63   21031857 [NO NAME]
 9 L FAT32 LBA            1978281   1  1 2288955  15 63  313160337 [FOTOS]
10 L FAT32 LBA            2288956   1  1 2390039  15 63  101892609 [NO NAME]
11 L FAT32 LBA            2390040   1  1 2475035  15 63   85675905 [NO NAME]

Because of the high quantity of files in sub-folders now the question is what to do now?
It would be a megatask for weeks rescuing file by file of the partition to another partition.

Has anyone an idea how to carry out the data rescue? :idea: :idea:

For example could ddrescue present an option to copy the relevant sectors at acceptable efforts to generate an image of the partition?
Start ........... End
599089 1 1 817511 15 63 220170321 [NO NAME]


Any help for support would be very kind and great.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recover of disappeared FAT32 partition content

#2 Post by cgrenier »

You can use testdisk to copy several directories, no need to select the file or directory one at the time.

bruce
Posts: 5
Joined: 17 Dec 2013, 15:24

Re: Recover of disappeared FAT32 partition content

#3 Post by bruce »

@cgrenier
Thank you so much for your hint to follow consequently the program instructions.

After several passes of testdisk
[Analyse] --> [Quick Search] --> [Deeper Search]

finally it seems that I could recover most of the folders and files together with original filenames, dates.

The result was:

Code: Select all

copy done! 213177 ok, 213 failed
Hallelujah!!!!!!!!!!!

Without your support I would never have reached the recovery. :-)
Sans votre soutien, je n'aurais jamais atteint le rétablissement.
Encore merci beaucoup pour votre aide.

Locked