FAT32 External HDD - Recovering the FAT? Topic is solved

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
SteveOC
Posts: 4
Joined: 01 Oct 2013, 11:12

FAT32 External HDD - Recovering the FAT?

#1 Post by SteveOC »

Hello.

I managed to 'lose' my external HDD data by running a convert from FAT32 to NTFS (after hitting a file size limitation). The convert failed whilst in progress, despite running CHKDSK etc clean prior to starting conversion.
I immediately set the drive back to FAT32 in the hope of recovering the FAT and thus the files and directory structures with a view to relocating the files and re-running the conversion.
I don't believe that these is any hardware error in the external drive but rather that we suffered a very minor power blip or a USB issue.

I tried using Testdisk yesterday, but don't get the option to Repair FAT which is what I think I need, even after trying a number of BOOT options from the menus.
At this point, I kicked off an Image copy, as I realised I wasn't sure what I was doing and didn't want to cause any further risk to recovery, and am now running Photorec against the Image DD to secure some raw data. The recovery is 1+ hour in with about 20+ hours to go and it has recovered over 7000 files (although a lot - aside from JPGs seem to be corrupted).

When photorec has completed, what I would like to do is go back and try to recreate the FAT (and thus the filesystem and files?) if that is possible, and would appreciate guidance as to how exactly to achieve this.

Thanks and Regards
Steve O.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: FAT32 External HDD - Recovering the FAT?

#2 Post by Fiona »

It's not recommended to modify anything to a corrupted file system.
Chdsk and Repair Fat are only recommeded if someone tries to repair a file system.
Can you run a diagnose using testdisk to determine your current situation?
It means, Analyse, Quick and if no partition or data are found running Deeper Search.
Can you copy and paste the content of your testdisk.log into your next post?

Fiona

SteveOC
Posts: 4
Joined: 01 Oct 2013, 11:12

Re: FAT32 External HDD - Recovering the FAT?

#3 Post by SteveOC »

Hello Fiona - thanks for the quick response.

Photorec is still running against image.dd on my 2nd USB drive so I initiated a 2nd Testdisk window and plugged the original Seagate USB drive in as well.
Testdisk found a partition, but P to list files only listed 3 empty tmp directories from around the time of the original problem.
I am currently running Testdisk Deeper search (16% complete) and will post the log file upon completion.

Steve O.

SteveOC
Posts: 4
Joined: 01 Oct 2013, 11:12

Re: FAT32 External HDD - Recovering the FAT?

#4 Post by SteveOC »

Hello.
just got in - Tesdisk has finished - however it looks like Photorec stalled a couple of hours ago so I have just canned and resumed that session.

Here is the Tesdisk log - it is quite large but you asked me to paste it so here it is............


Tue Oct 1 13:54:54 2013
Command line: TestDisk

TestDisk 7.0-WIP, Data Recovery Utility, August 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.25
Compilation date: 2013-09-19T08:43:48
ext2fs lib: 1.42.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=128035676160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=750156374016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=320072933376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=94319411200
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=11943076864
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=320070288384
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=5558501376
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=750145503744
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512 - SAMSUNG SSD 830 Seri, S/N:0SJWENCA073599, FW:CXM0
Disk /dev/sdb - 750 GB / 698 GiB - CHS 91201 255 63, sector size=512 - WDC WD75 00BPKT-75PK4T0, S/N:3471635A11XW-DW, FW:01.0
Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63, sector size=512 - Seagate External Drive

Partition table type (auto): Intel
Disk /dev/sdc - 320 GB / 298 GiB - Seagate External Drive
Partition table type: Intel

Analyse Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63
Geometry from i386 MBR: head=255 sector=63
FAT32 at 0/1/1
Info: size boot_sector 625137282, partition 625137282
FAT1 : 32-38182
FAT2 : 38183-76333
start_rootdir : 76334 root cluster : 2
Data : 76334-625137197
sectors : 625137282
cluster_size : 128
no_of_cluster : 4883288 (2 - 4883289)
fat_length 38151 calculated 38151
set_FAT_info: name from BS used
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
1 * FAT32 0 1 1 38912 254 63 625137282 [NO NAME]

search_part()
Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63
FAT32 at 0/1/1
FAT1 : 32-38182
FAT2 : 38183-76333
start_rootdir : 76334 root cluster : 2
Data : 76334-625137197
sectors : 625137282
cluster_size : 128
no_of_cluster : 4883288 (2 - 4883289)
fat_length 38151 calculated 38151
set_FAT_info: name from BS used

FAT32 at 0/1/1
FAT32 LBA 0 1 1 38912 254 63 625137282 [NO NAME]
FAT32, blocksize=65536, 320 GB / 298 GiB
file_pread(6,2,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(6,1,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(6,8,buffer,625142463(38913/81/16)) lseek err Invalid argument
file_pread(6,1,buffer,625142463(38913/81/16)) lseek err Invalid argument
file_pread(6,8,buffer,625142591(38913/83/18)) lseek err Invalid argument
file_pread(6,8,buffer,625142719(38913/85/20)) lseek err Invalid argument
file_pread(6,8,buffer,625142847(38913/87/22)) lseek err Invalid argument
file_pread(6,8,buffer,625142975(38913/89/24)) lseek err Invalid argument
file_pread(6,8,buffer,625143103(38913/91/26)) lseek err Invalid argument
file_pread(6,8,buffer,625143231(38913/93/28)) lseek err Invalid argument
file_pread(6,8,buffer,625143359(38913/95/30)) lseek err Invalid argument
file_pread(6,8,buffer,625143487(38913/97/32)) lseek err Invalid argument
file_pread(6,8,buffer,625143615(38913/99/34)) lseek err Invalid argument
file_pread(6,8,buffer,625143743(38913/101/36)) lseek err Invalid argument
file_pread(6,1,buffer,625143807(38913/102/37)) lseek err Invalid argument
file_pread(6,1,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(6,14,buffer,625143809(38913/102/39)) lseek err Invalid argument
file_pread(6,3,buffer,625143823(38913/102/53)) lseek err Invalid argument
file_pread(6,3,buffer,625143870(38913/103/37)) lseek err Invalid argument
file_pread(6,8,buffer,625143886(38913/103/53)) lseek err Invalid argument
file_pread(6,11,buffer,625143933(38913/104/37)) lseek err Invalid argument
file_pread(6,2,buffer,625145855(38913/135/6)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2

Results
* FAT32 LBA 0 1 1 38912 254 63 625137282 [NO NAME]
FAT32, blocksize=65536, 320 GB / 298 GiB


dir_partition inode=0
* FAT32 LBA 0 1 1 38912 254 63 625137282 [NO NAME]
FAT32, blocksize=65536, 320 GB / 298 GiB
FAT: cluster=2(0x2), pos=76397
Directory /
3 drwxr-xr-x 0 0 0 12-Aug-2013 21:45 $RECYCLE.BIN
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:47 MSIbc8b4.tmp
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:48 MSIbc8bd.tmp
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:48 MSIbc8c5.tmp

dir_partition inode=5
* FAT32 LBA 0 1 1 38912 254 63 625137282 [NO NAME]
FAT32, blocksize=65536, 320 GB / 298 GiB
FAT: cluster=5(0x5), pos=76781
Directory /MSIbc8b4.tmp
5 drwxr-xr-x 0 0 0 12-Aug-2013 22:48 .
0 drwxr-xr-x 0 0 0 12-Aug-2013 22:48 ..
FAT: cluster=2(0x2), pos=76397
Directory /
3 drwxr-xr-x 0 0 0 12-Aug-2013 21:45 $RECYCLE.BIN
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:47 MSIbc8b4.tmp
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:48 MSIbc8bd.tmp
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:48 MSIbc8c5.tmp

dir_partition inode=5
* FAT32 LBA 0 1 1 38912 254 63 625137282 [NO NAME]
FAT32, blocksize=65536, 320 GB / 298 GiB
FAT: cluster=5(0x5), pos=76781
Directory /MSIbc8bd.tmp
5 drwxr-xr-x 0 0 0 12-Aug-2013 22:48 .
0 drwxr-xr-x 0 0 0 12-Aug-2013 22:48 ..
FAT: cluster=2(0x2), pos=76397
Directory /
3 drwxr-xr-x 0 0 0 12-Aug-2013 21:45 $RECYCLE.BIN
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:47 MSIbc8b4.tmp
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:48 MSIbc8bd.tmp
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:48 MSIbc8c5.tmp

dir_partition inode=5
* FAT32 LBA 0 1 1 38912 254 63 625137282 [NO NAME]
FAT32, blocksize=65536, 320 GB / 298 GiB
FAT: cluster=5(0x5), pos=76781
Directory /MSIbc8c5.tmp
5 drwxr-xr-x 0 0 0 12-Aug-2013 22:48 .
0 drwxr-xr-x 0 0 0 12-Aug-2013 22:48 ..
FAT: cluster=2(0x2), pos=76397
Directory /
3 drwxr-xr-x 0 0 0 12-Aug-2013 21:45 $RECYCLE.BIN
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:47 MSIbc8b4.tmp
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:48 MSIbc8bd.tmp
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:48 MSIbc8c5.tmp


dir_partition inode=0
* FAT32 LBA 0 1 1 38912 254 63 625137282 [NO NAME]
FAT32, blocksize=65536, 320 GB / 298 GiB
FAT: cluster=2(0x2), pos=76397
Directory /
3 drwxr-xr-x 0 0 0 12-Aug-2013 21:45 $RECYCLE.BIN
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:47 MSIbc8b4.tmp
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:48 MSIbc8bd.tmp
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:48 MSIbc8c5.tmp

interface_write()
1 * FAT32 LBA 0 1 1 38912 254 63 625137282 [NO NAME]

search_part()
Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63
FAT32 at 0/1/1
FAT1 : 32-38182
FAT2 : 38183-76333
start_rootdir : 76334 root cluster : 2
Data : 76334-625137197
sectors : 625137282
cluster_size : 128
no_of_cluster : 4883288 (2 - 4883289)
fat_length 38151 calculated 38151
set_FAT_info: name from BS used

FAT32 at 0/1/1
FAT32 LBA 0 1 1 38912 254 63 625137282 [NO NAME]
FAT32, blocksize=65536, 320 GB / 298 GiB
FAT32 at 0/1/7
FAT1 : 32-38182
FAT2 : 38183-76333
start_rootdir : 76334 root cluster : 2
Data : 76334-625137197
sectors : 625137282
cluster_size : 128
no_of_cluster : 4883288 (2 - 4883289)
fat_length 38151 calculated 38151
set_FAT_info: name from BS used

FAT32 at 0/1/7
FAT32 LBA 0 1 1 38912 254 63 625137282 [NO NAME]
FAT32, blocksize=65536, 320 GB / 298 GiB
NTFS at 38912/254/63
filesystem size 625137282
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 38912 254 63 625137282
NTFS found using backup sector, blocksize=4096, 320 GB / 298 GiB
NTFS at 38912/254/63
filesystem size 625137282
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
file_pread(6,1024,buffer,631431872(39304/208/9)) lseek err Invalid argument
file_pread(6,1,buffer,631431872(39304/208/9)) lseek err Invalid argument
NTFS: Can't read MFT
HPFS - NTFS 38912 254 63 77825 253 62 625137282
NTFS, blocksize=4096, 320 GB / 298 GiB
This partition ends after the disk limits. (start=625137344, size=625137282, end=1250274625, disk end=625142448)
file_pread(6,2,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(6,1,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(6,8,buffer,625142463(38913/81/16)) lseek err Invalid argument
file_pread(6,1,buffer,625142463(38913/81/16)) lseek err Invalid argument
file_pread(6,8,buffer,625142591(38913/83/18)) lseek err Invalid argument
file_pread(6,8,buffer,625142719(38913/85/20)) lseek err Invalid argument
file_pread(6,8,buffer,625142847(38913/87/22)) lseek err Invalid argument
file_pread(6,8,buffer,625142975(38913/89/24)) lseek err Invalid argument
file_pread(6,8,buffer,625143103(38913/91/26)) lseek err Invalid argument
file_pread(6,8,buffer,625143231(38913/93/28)) lseek err Invalid argument
file_pread(6,8,buffer,625143359(38913/95/30)) lseek err Invalid argument
file_pread(6,8,buffer,625143487(38913/97/32)) lseek err Invalid argument
file_pread(6,8,buffer,625143615(38913/99/34)) lseek err Invalid argument
file_pread(6,8,buffer,625143743(38913/101/36)) lseek err Invalid argument
file_pread(6,1,buffer,625143807(38913/102/37)) lseek err Invalid argument
file_pread(6,1,buffer,625143808(38913/102/38)) lseek err Invalid argument
file_pread(6,14,buffer,625143809(38913/102/39)) lseek err Invalid argument
file_pread(6,3,buffer,625143823(38913/102/53)) lseek err Invalid argument
file_pread(6,3,buffer,625143870(38913/103/37)) lseek err Invalid argument
file_pread(6,8,buffer,625143886(38913/103/53)) lseek err Invalid argument
file_pread(6,11,buffer,625143933(38913/104/37)) lseek err Invalid argument
file_pread(6,2,buffer,625145855(38913/135/6)) lseek err Invalid argument
Disk /dev/sdc - 320 GB / 298 GiB - CHS 38913 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (320 GB / 298 GiB) seems too small! (< 640 GB / 596 GiB)
The following partition can't be recovered:
HPFS - NTFS 38912 254 63 77825 253 62 625137282
NTFS, blocksize=4096, 320 GB / 298 GiB
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=4

Results
HPFS - NTFS 0 1 1 38912 254 63 625137282
NTFS found using backup sector, blocksize=4096, 320 GB / 298 GiB
FAT32 LBA 0 1 1 38912 254 63 625137282 [NO NAME]
FAT32, blocksize=65536, 320 GB / 298 GiB


dir_partition inode=0
FAT32 LBA 0 1 1 38912 254 63 625137282 [NO NAME]
FAT32, blocksize=65536, 320 GB / 298 GiB
FAT: cluster=2(0x2), pos=76397
Directory /
3 drwxr-xr-x 0 0 0 12-Aug-2013 21:45 $RECYCLE.BIN
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:47 MSIbc8b4.tmp
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:48 MSIbc8bd.tmp
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:48 MSIbc8c5.tmp

dir_partition inode=3
FAT32 LBA 0 1 1 38912 254 63 625137282 [NO NAME]
FAT32, blocksize=65536, 320 GB / 298 GiB
FAT: cluster=3(0x3), pos=76525
Directory /$RECYCLE.BIN
3 drwxr-xr-x 0 0 0 12-Aug-2013 21:45 .
0 drwxr-xr-x 0 0 0 12-Aug-2013 21:45 ..
4 -rwxr-xr-x 0 0 129 12-Aug-2013 21:45 DESKTOP.INI
FAT: cluster=2(0x2), pos=76397
Directory /
3 drwxr-xr-x 0 0 0 12-Aug-2013 21:45 $RECYCLE.BIN
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:47 MSIbc8b4.tmp
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:48 MSIbc8bd.tmp
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:48 MSIbc8c5.tmp

dir_partition inode=3
FAT32 LBA 0 1 1 38912 254 63 625137282 [NO NAME]
FAT32, blocksize=65536, 320 GB / 298 GiB
FAT: cluster=3(0x3), pos=76525
Directory /$RECYCLE.BIN
3 drwxr-xr-x 0 0 0 12-Aug-2013 21:45 .
0 drwxr-xr-x 0 0 0 12-Aug-2013 21:45 ..
4 -rwxr-xr-x 0 0 129 12-Aug-2013 21:45 DESKTOP.INI
FAT: cluster=2(0x2), pos=76397
Directory /
3 drwxr-xr-x 0 0 0 12-Aug-2013 21:45 $RECYCLE.BIN
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:47 MSIbc8b4.tmp
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:48 MSIbc8bd.tmp
X 5 drwxr-xr-x 0 0 65536 12-Aug-2013 22:48 MSIbc8c5.tmp
NTFS filesystem need to be repaired.


dir_partition inode=5
HPFS - NTFS 0 1 1 38912 254 63 625137282
NTFS found using backup sector, blocksize=4096, 320 GB / 298 GiB
ntfs_readdir failed for cluster 5
Directory /
5 dr-xr-xr-x 0 0 0 12-Aug-2013 21:28 .
5 dr-xr-xr-x 0 0 0 12-Aug-2013 21:28 ..

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

Steve O.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: FAT32 External HDD - Recovering the FAT?

#5 Post by cgrenier »

It looks like the corruption is too severe for TestDisk. Try PhotoRec instead.

SteveOC
Posts: 4
Joined: 01 Oct 2013, 11:12

Re: FAT32 External HDD - Recovering the FAT?

#6 Post by SteveOC »

Hello again.

Thanks for trying anyway.

My attempts with photorec (see above where I was running recoveries in parallel - one using Testdisk on the drive and the other using photorec on an image.dd of the drive) kept hanging up.
I was eventually able, using the Resume function in photorec,to save every minute or so, to get to a point where it hangs immediately.

Of the files recovered by photorec, there are a lot of 'good' jpegs - so I guess it is good at doing what it was designed for. However most of the AVI and DOC files, and a lot of the PDF files are corrupted and none of the executables seem to be executable and they have lost their original names.

The good news is that some success has been had using a commercial product - it seems to have recovered the files, with original names, along with the original directory structures.

Steve O.

Locked