"Bad Jump in FAT partition" and "Bad number of sectors per cluster" right before ext4 offset

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
dyed
Posts: 1
Joined: 16 Sep 2023, 05:26

"Bad Jump in FAT partition" and "Bad number of sectors per cluster" right before ext4 offset

#1 Post by dyed »

For a while I've had a 1TB drive with a ~330GB NTFS data partition+windows recovery partition as a data drive and ~660GB of ext4 linux filesystem. Recently, I deleted and reformatted the windows volume. I then transferred some data into that volume, then deleted it again.
After this, I attempted to boot into my linux system and got kicked into GRUB rescue with an unknown filesystem. After booting into a live CD to investigate, I found some curious results when inspecting the filesystem:
result of running fdisk -l:

Disk /dev/sdb: 931.51 GiB, 1000204886016 bytes, 1953525168 sectors
Disk model: CT1000MX500SSD4
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 02CF7D49-F583-4C04-9795-0455F781C90B

Device Start End Sectors Size Type
/dev/sdb2 660166656 1953523711 1293357056 616.7G Linux filesystem

Trying to mount to reinstall GRUB(why does it think it's NTFS lol):
NTFS signature is missing.
Failed to mount '/dev/sdb2': Invalid argument
The device '/dev/sdb2' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
NTFS signature is missing.
Failed to mount '/dev/sdb2': Invalid argument
The device '/dev/sdb2' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

Mounting with ext4 explicit
mount: /mnt: wrong fs type, bad option, bad superblock on /dev/sdb2, missing codepage or helper program, or other error.
dmesg(1) may have more information after failed mount system call.


Trying to fsck (tried every single recovery block i got from mke2fs to no avail and same result)
fsck from util-linux 2.38.1
e2fsck 1.47.0 (5-Feb-2023)
ext2fs_open2: Bad magic number in super-block
fsck.ext2: Superblock invalid, trying backup blocks...
fsck.ext2: Bad magic number in super-block while trying to open /dev/sdb2

The superblock could not be read or does not describe a valid ext2/ext3/ext4
filesystem. If the device is valid and it really contains an ext2/ext3/ext4
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193 <device>
or
e2fsck -b 32768 <device>

Trying to figure out what filesystem we think the partition is (wtf LOL)
ubuntu@ubuntu:~$ sudo file -sL /dev/sdb2
/dev/sdb2: OpenPGP Public Key

This (especially the last thing which indicates it is just reading of completely random bytes) I think all points to either a corrupted filesystem or misaligned/screwed up partition table. I think it is unlikely that serious (if any) damage occurred to the actual filesystem considering the fact that I never performed any operations directly on that
partition and only worked on other partitions on that drive, and there is no evidence that pointed to any destructive operations occurring on that drive such as a hard format. My guess is that Windows somehow screwed with the partition table (as it often does) and we are trying to interpret from the wrong offsets.

Ran some file recovery tools and didn't get anything useful besides some garbage misinterpreted file types.

Then I tried testdisk. It initially sees that same Linux filesystem partition we found in fdisk, but is also entirely unable to interpret the filetypes. Both quick and deeper search turn out nothing, except for some strange error messages at the exact transition point between what was the NTFS filesystem and the ext4 filesystem. (they are related to FAT which is the format of the windows recovery partition that was once on that drive, maybe that caused the problem (?)
I'm attaching the testdisk logs below. Not sure what do do at this point honestly


Sat Sep 16 04:30:31 2023
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 6.2.0-20-generic (#20-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr 6 07:48:48 UTC 2023) x86_64
Compiler: GCC 12.2
ext2fs lib: 1.47.0, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.3
User is not root!
Hard disk list


TestDisk exited normally.
Using locale 'C.UTF-8'.


Sat Sep 16 04:30:31 2023
Command line: TestDisk /debug

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 6.2.0-20-generic (#20-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr 6 07:48:48 UTC 2023) x86_64
Compiler: GCC 12.2
ext2fs lib: 1.47.0, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.3
/dev/sda: LBA, HPA, LBA48 support
/dev/sda: size 468862128 sectors
/dev/sda: user_max 468862128 sectors
/dev/sda: native_max 468862128 sectors
/dev/sdb: LBA, LBA48 support
/dev/sdb: size 1953525168 sectors
/dev/sdb: user_max 1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - KINGSTON SA400S37240G, S/N:50026B7783AA5D9F, FW:SBFKB1H5
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - CT1000MX500SSD4, S/N:2031E2BDCD5C, FW:M3CR023
Disk /dev/loop0 - 2372 MB / 2263 MiB - 4634632 sectors (RO), sector size=512
Disk /dev/loop1 - 369 MB / 352 MiB - 722280 sectors (RO), sector size=512
Disk /dev/loop10 - 462 KB / 452 KiB - 904 sectors (RO), sector size=512
Disk /dev/loop11 - 157 MB / 150 MiB - 307552 sectors (RO), sector size=512
Disk /dev/loop12 - 14 MB / 13 MiB - 28120 sectors (RO), sector size=512
Disk /dev/loop2 - 1015 MB / 968 MiB - 1983984 sectors (RO), sector size=512
Disk /dev/loop3 - 253 MB / 242 MiB - 495928 sectors (RO), sector size=512
Disk /dev/loop4 - 4096 B - 8 sectors (RO), sector size=512
Disk /dev/loop5 - 76 MB / 72 MiB - 149488 sectors (RO), sector size=512
Disk /dev/loop6 - 96 MB / 91 MiB - 187776 sectors (RO), sector size=512
Disk /dev/loop7 - 482 MB / 460 MiB - 943256 sectors (RO), sector size=512
Disk /dev/loop8 - 12 MB / 12 MiB - 25240 sectors (RO), sector size=512
Disk /dev/loop9 - 55 MB / 53 MiB - 109032 sectors (RO), sector size=512
Disk /dev/nvme0n1 - 240 GB / 223 GiB - CHS 228936 64 32, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/sdb - 1000 GB / 931 GiB - CT1000MX500SSD4
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953525167 (expected 1953525167)
hdr_lba_start=34
hdr_lba_end=1953525134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
2 P Linux filesys. data 660166656 1953523711 1293357056

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953525167 (expected 1953525167)
hdr_lba_start=34
hdr_lba_end=1953525134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
2 P Linux filesys. data 660166656 1953523711 1293357056

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
check_FAT: Bad jump in FAT partition
check_FAT: Bad number of sectors per cluster

SYSV4 Marker at 37956/138/52

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 609771885 717560551858540 717559942086656 [CjS­Þ0]
SysV4, 367390 TB / 334139 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

LVM magic value at 64813/225/1
check_FAT: Bad jump in FAT partition
check_FAT: Bad number of sectors per cluster

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
check_FAT: Bad jump in FAT partition
check_FAT: Bad number of sectors per cluster

SYSV4 Marker at 37956/138/52

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 609771885 717560551858540 717559942086656 [CjS­Þ0]
SysV4, 367390 TB / 334139 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

LVM magic value at 64813/225/1
check_FAT: Bad jump in FAT partition
check_FAT: Bad number of sectors per cluster

Results

interface_write()

No partition found or selected for recovery
simulate write!

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953525167 (expected 1953525167)
hdr_lba_start=34
hdr_lba_end=1953525134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
2 P Linux filesys. data 660166656 1953523711 1293357056

TestDisk exited normally.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
In intel/mbr mode bc why not:


Fri Sep 15 20:55:18 2023
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 6.2.0-20-generic (#20-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr 6 07:48:48 UTC 2023) x86_64
Compiler: GCC 12.2
ext2fs lib: 1.47.0, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.3
User is not root!
Hard disk list


TestDisk exited normally.
Using locale 'C.UTF-8'.


Fri Sep 15 20:55:18 2023
Command line: TestDisk /debug

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Linux, kernel 6.2.0-20-generic (#20-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr 6 07:48:48 UTC 2023) x86_64
Compiler: GCC 12.2
ext2fs lib: 1.47.0, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.3
/dev/sda: LBA, HPA, LBA48 support
/dev/sda: size 468862128 sectors
/dev/sda: user_max 468862128 sectors
/dev/sda: native_max 468862128 sectors
/dev/sdb: LBA, LBA48 support
/dev/sdb: size 1953525168 sectors
/dev/sdb: user_max 1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 240 GB / 223 GiB - CHS 29185 255 63, sector size=512 - KINGSTON SA400S37240G, S/N:50026B7783AA5D9F, FW:SBFKB1H5
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - CT1000MX500SSD4, S/N:2031E2BDCD5C, FW:M3CR023
Disk /dev/loop0 - 2372 MB / 2263 MiB - 4634632 sectors (RO), sector size=512
Disk /dev/loop1 - 369 MB / 352 MiB - 722280 sectors (RO), sector size=512
Disk /dev/loop10 - 462 KB / 452 KiB - 904 sectors (RO), sector size=512
Disk /dev/loop11 - 157 MB / 150 MiB - 307552 sectors (RO), sector size=512
Disk /dev/loop12 - 14 MB / 13 MiB - 28120 sectors (RO), sector size=512
Disk /dev/loop2 - 1015 MB / 968 MiB - 1983984 sectors (RO), sector size=512
Disk /dev/loop3 - 253 MB / 242 MiB - 495928 sectors (RO), sector size=512
Disk /dev/loop4 - 76 MB / 72 MiB - 149488 sectors (RO), sector size=512
Disk /dev/loop5 - 4096 B - 8 sectors (RO), sector size=512
Disk /dev/loop6 - 96 MB / 91 MiB - 187776 sectors (RO), sector size=512
Disk /dev/loop7 - 482 MB / 460 MiB - 943256 sectors (RO), sector size=512
Disk /dev/loop8 - 12 MB / 12 MiB - 25240 sectors (RO), sector size=512
Disk /dev/loop9 - 55 MB / 53 MiB - 109032 sectors (RO), sector size=512
Disk /dev/nvme0n1 - 240 GB / 223 GiB - CHS 228936 64 32, sector size=512

Partition table type (auto): EFI GPT
Disk /dev/sdb - 1000 GB / 931 GiB - CT1000MX500SSD4
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
1 P EFI GPT 0 0 2 121601 80 63 1953525167

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 121601 80 63 1953525167

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=256 sector=63
check_part_i386 1 type EE: no test
Current partition structure:
1 P EFI GPT 0 0 2 121601 80 63 1953525167

Warning: Bad ending head (CHS and LBA don't match)
No partition is bootable

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Partition table type (auto): EFI GPT
Disk /dev/sdb - 1000 GB / 931 GiB - CT1000MX500SSD4
Partition table type: EFI GPT

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953525167 (expected 1953525167)
hdr_lba_start=34
hdr_lba_end=1953525134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
2 P Linux filesys. data 660166656 1953523711 1293357056
search_superblock

2 P Linux filesys. data 660166656 1953523711 1293357056
Support for this filesystem wasn't enabled during compilation.

2 P Linux filesys. data 660166656 1953523711 1293357056
Support for this filesystem wasn't enabled during compilation.
gpt_change_part_type
Change partition type:
2 P Linux filesys. data 660166656 1953523711 1293357056
Change partition type:
2 P ext4 660166656 1953523711 1293357056
New options :
Dump : No
Align partition: Yes
Expert mode : Yes

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953525167 (expected 1953525167)
hdr_lba_start=34
hdr_lba_end=1953525134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
2 P Linux filesys. data 660166656 1953523711 1293357056

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
check_FAT: Bad jump in FAT partition
check_FAT: Bad number of sectors per cluster

SYSV4 Marker at 37956/138/52

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 609771885 717560551858540 717559942086656 [CjS­Þ0]
SysV4, 367390 TB / 334139 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

LVM magic value at 64813/225/1
check_FAT: Bad jump in FAT partition
check_FAT: Bad number of sectors per cluster

Results
Can't open backup.log file: No such file or directory
interface_load
0 0000 0000 00 00 00 00 00 00 00 00

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
check_FAT: Bad jump in FAT partition
check_FAT: Bad number of sectors per cluster

SYSV4 Marker at 37956/138/52

recover_sysv4
0 0000 0000 00 00 00 00 00 00 00 00
Unknown 609771885 717560551858540 717559942086656 [CjS­Þ0]
SysV4, 367390 TB / 334139 TiB
0 0000 0000 00 00 00 00 00 00 00 00
Partition not added.

LVM magic value at 64813/225/1
check_FAT: Bad jump in FAT partition
check_FAT: Bad number of sectors per cluster

Results
0 0000 0000 00 00 00 00 00 00 00 00

interface_write()

No partition found or selected for recovery
simulate write!

Interface Advanced
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953525167 (expected 1953525167)
hdr_lba_start=34
hdr_lba_end=1953525134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
2 P Linux filesys. data 660166656 1953523711 1293357056
search_superblock

2 P Linux filesys. data 660166656 1953523711 1293357056
Support for this filesystem wasn't enabled during compilation.
New options :
Dump : No
Align partition: No
Expert mode : Yes

Analyse Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
hdr_size=92
hdr_lba_self=1
hdr_lba_alt=1953525167 (expected 1953525167)
hdr_lba_start=34
hdr_lba_end=1953525134
hdr_lba_table=2
hdr_entries=128
hdr_entsz=128
Current partition structure:
2 P Linux filesys. data 660166656 1953523711 1293357056

search_part()
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery

Any help appreciated! The filesystem/file names are the most important part of the data i have on this drive so using tools like Photorec really won't help - the only way is to restore the partition if possible.
Top
Locked

Return to “Filesystem repair”