Recovering a FAT32 currupted boot sector Topic is solved

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
televisor
Posts: 4
Joined: 27 Jun 2020, 09:08

Recovering a FAT32 currupted boot sector

#1 Post by televisor »

Hello

I need help recovering the boot sector of a FAT32 formatted SD card used in an Android phone with Testdisk. I tried interactive mode and I could recognize many filenames of my data. Unfortunately none was the main root of the filesystem, which accordingly to what I have read on the internet is what I need to find.

Folder structure was the common one of an Android phone. A bunch of folders in the root like "music", "camera", "screenshots"... and all files inside these folders. In the main root there were only about 10 files outside any folder.

Fortunately I have a backup of all the file contents made about some months ago, so I hope this can be used in some way to recover the actual filesystem. Folder structure and old files should remain the same, the only change is that the damaged filesystem contains newly created files, like photos taken after the backup.

Background of the filesystem corruption, if this helps:

-I checked my phone for notifications after waking up and it didn't power on, so it must have run out of battery overnight. After connecting it to the charger and waiting some minutes, it powered on and I could see a lot of warnings about SD access failure and a notification indicating the SD card was corrupted and a button for formatting it. Of course, I didn't press it. Maybe suddenly losing power during midnight provoked this.

- I took the SD card from the phone and plugged it on the computer using a card reader. It was read correctly, all my files where there, so i didn't understand why the phone reported it as corrupted. I looked for some command for repairing the FAT32 filesystem on it, trying to solve any damage it may have. I executed "sudo dosfsck -w -r -l -a -v -t /dev/sdf1" and I could see and output like "Checking file /DCIM/Camera/IMG_20160911_000514.jpg (IMG_20~1.JPG)". Here comes my worst mistake: as it was taking too long (it's a 32GB SD card almost 80% full), i jus't pressed ctrl+C to stop it before ending.

-I plugged back the SD on the phone. The error persisted. After connecting it back on the PC, the filesystem is no longer recognized. So stopping that command has corrupted it, and this is what I'm trying to repair.

Many thanks for reading to the end. Any help is appreciated.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovering a FAT32 currupted boot sector

#2 Post by cgrenier »

Run PhotoRec, when asked, choose [Whole] instead of [Free].
Once it's done, sort the recovered files (see https://www.cgsecurity.org/testdisk.pdf).
Good luck

televisor
Posts: 4
Joined: 27 Jun 2020, 09:08

Re: Recovering a FAT32 currupted boot sector

#3 Post by televisor »

cgrenier wrote: 28 Jun 2020, 09:06 Run PhotoRec, when asked, choose [Whole] instead of [Free].
Once it's done, sort the recovered files (see https://www.cgsecurity.org/testdisk.pdf).
Good luck
Hello

I leave photorec as last option. It is a great utility that saved my files many times, but sorting the files is a long and cumbersome work.

I found what i think is the file allocation table of the main root of the corrupted FAT32 filesystem by using an HEX editor, as it contains all the filenames and folders that where at the root of the the filesystem. About in the middle of this block, at offset 97A of the attached portion, there is an empty space which i think is some sort of corruption that makes Testdisk jump it. Can I edit it somehow so Testdisk recognizes it and can restore the boot sector?

I have attached that portion so anyone can download and have a look at it. It is zipped because otherwise the forum didn't accept it. If a bigger block or anything else is needed, just ask and I will upload it.

Many thanks for your help
Attachments
FAT32_MAIN_ROOT_PORTION.zip
(1.59 KiB) Downloaded 283 times

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering a FAT32 currupted boot sector

#4 Post by recuperation »

televisor wrote: 28 Jun 2020, 13:07 I found what i think is the file allocation table of the main root of the corrupted FAT32 filesystem by using an HEX editor, as it contains all the filenames and folders that where at the root of the the filesystem.
There is no file allocation table specifically for the root directory. There is just one FAT for everything and possibly a copy of it. What you showed is a part of bootsector combined with something that looks like a directory.
About in the middle of this block, at offset 97A of the attached portion, there is an empty space which i think is some sort of corruption that makes Testdisk jump it. Can I edit it somehow so Testdisk recognizes it and can restore the boot sector?
Editing some bytes somewhere on your drive will not rescue anything. Guessing is not diagnosing. It is like removing the injectors out of a broken car and asking somebody if any modification/repair will get the car back running.
You should have copied your faulty drive before running chkdsk on it.

televisor
Posts: 4
Joined: 27 Jun 2020, 09:08

Re: Recovering a FAT32 currupted boot sector

#5 Post by televisor »

recuperation wrote: 28 Jun 2020, 18:11
televisor wrote: 28 Jun 2020, 13:07 I found what i think is the file allocation table of the main root of the corrupted FAT32 filesystem by using an HEX editor, as it contains all the filenames and folders that where at the root of the the filesystem.
There is no file allocation table specifically for the root directory. There is just one FAT for everything and possibly a copy of it. What you showed is a part of bootsector combined with something that looks like a directory.
About in the middle of this block, at offset 97A of the attached portion, there is an empty space which i think is some sort of corruption that makes Testdisk jump it. Can I edit it somehow so Testdisk recognizes it and can restore the boot sector?
Editing some bytes somewhere on your drive will not rescue anything. Guessing is not diagnosing. It is like removing the injectors out of a broken car and asking somebody if any modification/repair will get the car back running.
You should have copied your faulty drive before running chkdsk on it.
Sorry, for the terminology mistake, I think the correct term might be "directory entries" of the root of the filesystem. This is a short summary of where I'm stuck:
- On Testdisk I go to Advanced -> Boot -> Rebuid BS
- A progress percentage appears with the text "Searching for FAT table"
- After it reaches 100%, a message appears asking "Cluster XXXX, Directory / found ?". Under it, a list of the contents of the found directory is shown. If I press "No", it continues searching and showing other candidate, and so on. With this, I was able to recognice many folders, like photos, music, downloads... but unfortunately none was the root directory.

Now I'm tryind to understand how Testdisk discovers these folders and why the root one doesn't appear. By using an HEX editor i was able to find what I have attached on the previous post. The question are, only this is needed by testdisk to "discover" a directory? If yes, why does Testdisk not recognize it? And if not, what else is needed and there is any way of checking it?

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering a FAT32 currupted boot sector

#6 Post by recuperation »

televisor wrote: 28 Jun 2020, 22:37 Now I'm tryind to understand how Testdisk discovers these folders and why the root one doesn't appear. By using an HEX editor i was able to find what I have attached on the previous post. The question are, only this is needed by testdisk to "discover" a directory? If yes, why does Testdisk not recognize it? And if not, what else is needed and there is any way of checking it?
To understand what Testdisk does you might read the source code. But to really understand the source code you would need to understand
the file format specification. Search for "Microsoft FAT32 File System Specification - fatgen103.doc".
Go from theory to reality by erasing an USB stick, formatting it with FAT32 and put some files and folders on it - step by step. Use simple text files because you will find them more easily. A length ranging from 1 to 4 clusters is perfectly OK to get an understanding.
After practicing on your healthy file system attack the broken one.

Duplicate your broken drive first!
Check the boot sector, try to find the start and the end of the FAT and the root directory.
Maybe there is no root directory, could have been overwritten by accident?
In such a case you could try to artificially create a root directory within the free space because:

[...For FAT32, the root directory can be of variable size and is a cluster chain, just like any other directory is. The first cluster of the root directory on a FAT32 volume is stored in BPB_RootClus...]

Then create some artifical folder names and let the first cluster point to the subdirectory in question.
Verify the values in your boot sector. Don't forget to let it point to your root directory.

Doing all this corresponds to a manual repair of the partition.

televisor
Posts: 4
Joined: 27 Jun 2020, 09:08

Re: Recovering a FAT32 currupted boot sector

#7 Post by televisor »

recuperation wrote: 29 Jun 2020, 00:30
To understand what Testdisk does you might read the source code. But to really understand the source code you would need to understand
the file format specification. Search for "Microsoft FAT32 File System Specification - fatgen103.doc".
Go from theory to reality by erasing an USB stick, formatting it with FAT32 and put some files and folders on it - step by step. Use simple text files because you will find them more easily. A length ranging from 1 to 4 clusters is perfectly OK to get an understanding.
After practicing on your healthy file system attack the broken one.

Duplicate your broken drive first!
Check the boot sector, try to find the start and the end of the FAT and the root directory.
Maybe there is no root directory, could have been overwritten by accident?
In such a case you could try to artificially create a root directory within the free space because:

[...For FAT32, the root directory can be of variable size and is a cluster chain, just like any other directory is. The first cluster of the root directory on a FAT32 volume is stored in BPB_RootClus...]

Then create some artifical folder names and let the first cluster point to the subdirectory in question.
Verify the values in your boot sector. Don't forget to let it point to your root directory.

Doing all this corresponds to a manual repair of the partition.
Hello

Finally, I achieved recovering my broken filesystem following your advice. I created a test filesystem as you suggested, and with the help of it and this Wikipedia article: https://en.wikipedia.org/wiki/Design_of ... ile_system I could understand the basics of a FAT32 filesystem and compare it's structure with the broken one. With this, I have edited the root directory cluster. I have attached how the root directory cluster beginning looked before editing and after editing. What could be the origin of these blocks marked as garbage?

With the root cluster edited, I ran Testdisk and this time it recognized the root directory without asking me anything. I just checked from the built-in file browser that I could access folders and data and chose to write boot sector. Now the SD card is recognized in both computer and phone, and so far everything is right. So now it's matter of having good backup practices avoiding this happening again, as this time I have been very lucky. Is there any recommended guide about having backups organized and prevent wasting space and/or losing data?

Many thanks for your help and to everyone who has participated in the development of Testdisk and Photorec.
Attachments
root_entries.zip
(3.12 KiB) Downloaded 283 times
Diagram.png
Diagram.png (13.66 KiB) Viewed 7480 times

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering a FAT32 currupted boot sector

#8 Post by recuperation »

televisor wrote: 01 Jul 2020, 10:23 Finally, I achieved recovering my broken filesystem following your advice. I created a test filesystem as you suggested, and with the help of it and this Wikipedia article: https://en.wikipedia.org/wiki/Design_of ... ile_system I could understand the basics of a FAT32 filesystem and compare it's structure with the broken one. With this, I have edited the root directory cluster. I have attached how the root directory cluster beginning looked before editing and after editing. What could be the origin of these blocks marked as garbage?
I have no clue. Everyhting is possible!
With the root cluster edited, I ran Testdisk and this time it recognized the root directory without asking me anything. I just checked from the built-in file browser that I could access folders and data and chose to write boot sector. Now the SD card is recognized in both computer and phone, and so far everything is right. So now it's matter of having good backup practices avoiding this happening again, as this time I have been very lucky. Is there any recommended guide about having backups organized and prevent wasting space and/or losing data?
Congratulations, well done!
I am happy to hear that I could contribute to your success in recovering your data.

As for the backups, I am not aware of any special guide.
The things that come to my mind are the following - not necessary backup related:
Separate your data from the operating system. Use a second physical drive. This might be difficult on a consumer laptop.
Backups should not be connected to a running system.
Respect the generational principle.
Read https://en.wikipedia.org/wiki/Backup
Store an encrypted backup (don't forget to save the backup header seperately) at a remote location (friends or family).
Applying a defragmentation software regularly on hard disc drives (not SSDs!) increases your success in case of using Photorec.

A way to produce full backup views implementing the copy-on-write feature on machines running the NTFS hardlink feature:
https://www.heise.de/download/product/r ... .vbs-39087

The backup frequency depends on your ability to absorb losses.
RAID configurations are not backups.
Backups only qualify as backups if they are disconnected from the network and power system.

Keep it simple. Do not use undocumented products and file systems like Microsoft dynamic discs and storage places. NTFS has been sufficiently reverse engineered. Use file systems where you can find recovery software for: FATxx, NTFS, EXTx. BRTFS and ZFS are beautiful but there is no cheap recovery software available.

Locked