FAT 32: Relink directories to Main directory? Topic is solved

[mifritscher]

Scenario:

* 1000 GB HDD with about 100k files
* 200 MB defective Sektors
* Bootsector + FAT seem to be ok
* Main directory is broken (had only about 10 Entries)
* Got a complete image from the disk (with dd_rescue, have also a list of defective sectors))

I need a functionality Scandisk from Win98 had: search for lost clusters in the FAT, detect the "highest level directories" (=the ones which are not connected to any other directory) and relink them to the main directory e.g. under found.000. Both dosfsck and chkdsk (from Winedows) can only recovery the leaf files, but not the directories - so the filenames are lost.

testdisk boot sector recovery works, but asks me for every directory whether this is the main directory. I would like to have function "link this directory to the main directory (or a found.000 directory)". Is this possible?

[recuperation]

I need a functionality Scandisk from Win98 had: search for lost clusters in the FAT, detect the "highest level directories" (=the ones which are not connected to any other directory) and relink them to the main directory e.g. under found.000.

testdisk boot sectory recovery works, but asks me for every directory whether this is the main directory. I would like to have function "link this directory to the main directory (or a found.000 directory)". Is this possible?

I don't understand the words/sentences marked red.
It seems that you would like Testdisk to do extensive file system repairs with regards to fodlers.
The few repairs that Testdisk does are kind of limited and well-defined and a possible dammage by writing on the defective device is limited to a few sectors.
What you want goes beyond this scope.

Any other recovery software is recovering stuff on a separate device.
Modifying a defective structure beyond what Testdisk does is not professional.

If Testdisk is not comfortable enough for your current incident, try out third party software.

Please be aware that there is a German forum as well.

[mifritscher]

Sorry, meant boot sector recovery, fixed this.

Many FAT repair tools, like dosfsck or chkdsk, have the ability to relink lost fat chains (which are often called lost cluster chains as well) - which causes to create the (im)famous FSCKxxxx files in / or /FOUND.000.
Scandisk from Windows 9x, at least the DOS version, had also the capability to detect folders in the lost cluster chains, and recovered these folders in a whole, preserving the sub directories and files.
Actually, if testdisk would try to rebuild the directory structure in memory and let me safe them in a whole on an external folder this would be fine for me as well. But recreating the root directory is a matter of reusing the cluster chain meant for it (the original cluster chain could be determined from the boot sector). Additionally, the main directory is only one (or few) clusters (in most cases, there aren't many entries in it). so the risk of damaging it further is about zero. Ok, the risk of damaging is exactly zero, because the image lives on a zfs with snapshots

As testdisk has the ability to detect directories: At least the functionality to not ask every time "is this the root directory?", but to give the starting cluster of all directories would be very helpful. Version 2.0 could automatically detect the directories (+files) which are not linked to other found directories - exactly these directories were directly in the root directory. At this stage, virtual browsing through these directories - and copying the structures to a second medium would be fine for me.

[recuperation]

Feel free to submit your code to Christophe Grenier!

[cgrenier]

Hello

It's possible to backup the disk using ddrescue as explained in https://www.cgsecurity.org/testdisk.pdf

"Answer Y(es), N(o), Q(uit) or A(bort interactive mode). N or A if not sure."
=> Answer 'A' to avoid being prompted for FAT32 root directory confirmation.

In expert mode, if testdisk failed to find the FAT32 root directory or if the recovery is aborted, it will prompt
"Create a new root cluster with XXX first-level directories (Expert only) (Y/N)"


Good luck

[mifritscher]

Many thanks - "expert" mode was the hint I needed

And I can confirm that it does what i should - I programmed a PoC in Java yesterday, and the results are almost the same

The last step is to correlate the bad sector map from ddrescue (saved me already multiple times...) with the affected files (https://unix.stackexchange.com/question ... ery-atempt has some ideas) - then I think the recovery is finished - and successful

Many thanks again!