recuperation wrote: ↑16 Jan 2022, 10:20
Testdisk has a function to rebuild the boot sector. Could you try this function using your test image partitions?
(tl;dr skip to the bottom.)
Do you mean [Rebuild BS]? Putting it in a Boot menu isn't very discoverable (I've only used Analyse and Advanced -> Undelete before, not Advanced -> Boot), and the documentation confused me when I initially read it.
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step advises you to use "Analyse", which doesn't work in my case (as I describe below).
https://www.cgsecurity.org/wiki/Advanced_FAT_Repair: All the way at the top, it says "In the Advanced menu, select the partition you want to modify and choose Boot", but I didn't fully read this part prior to the first heading. However, "Repair a FAT boot sector" shows the screen if you select the Advanced menu and *don't* choose Boot. I skipped down to "Rebuild a valid FAT boot sector" which shows a screen from 2005, and didn't explain how to get there.
After writing this post, I found
viewtopic.php?t=9690 which explains "advanced tab->boot->rebuild bs". I had opened the Advanced tab before, but didn't look in "Boot" because I wasn't trying to fix an OS boot process (the filesystem isn't bootable), but fix a filesystem's metadata.
Earlier, prior to discovering "Boot":
When analyzing photorec-stuck-fat32.img, I can't get testdisk to show a [Rebuild BS] button. When I enter the main menu and select [ Analyse ], it shows:
Code: Select all
Disk photorec-stuck-fat32.img - 41 MB / 40 MiB - CHS 6 255 63
Current partition structure:
Partition Start End Size in sectors
Invalid FAT boot sector
1 P FAT32 LBA 0 0 2 5 25 20 81919
1 P FAT32 LBA 0 0 2 5 25 20 81919
Warning: Bad ending cylinder (CHS and LBA don't match)
No partition is bootable
When I perform a [Quick Search] or [Deeper Search], no partitions are found.
In simulated corruption (intact backup BS), Backup BS works and Rebuild BS mostly works
I took an old physical 512MB flash drive, recreated the MBR partition table, created a FAT32 partition formatted as FAT32, and erased the filesystem boot sector's jump instruction. I left the backup boot sector intact. Note that this was *not* the case in the original corruption produced by libparted, where both boot sectors were identically corrupted (fsck found that the only difference between them was the dirty bit).
Here, "Quick Search" doesn't find anything, but "Deeper Search" still finds the intact backup boot sector and allows me to edit the partition. But how do I rebuild the boot sector?
The wiki page at
https://www.cgsecurity.org/wiki/Advance ... oot_sector shows a screen from 2005 and didn't explain *how* to reach the [Rebuild BS] screen. I had to look around further (search testdisk "Rebuild BS") to find a questionable tutorial at
https://us.informatiweb.net/tutorials/i ... ition.html, which told me to select [ Write ] in order to choose between [Backup BS] or [Rebuild BS].
Code: Select all
Disk /dev/sda - 512 MB / 488 MiB - CHS 1009 16 62
Partition Start End Size in sectors
1 * FAT32 2 1 3 1003 5 42 993280 [NO_LABEL]
Boot sector
Bad
Backup boot sector
OK
First sectors (boot code and partition information) are not identical.
A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.
[Backup BS] fixes the issue.
On an empty filesystem, [Rebuild BS] was slow. If you cancel it immediately, it writes a FAT16 boot sector onto a FAT32 partition. If you let it run, it asks whether to include a cluster filled with gibberish filenames (I aborted interactive mode), and ends up generating a bad boot sector:
Code: Select all
Disk /dev/sda - 512 MB / 488 MiB - CHS 1009 16 62
Partition Start End Size in sectors
1 * FAT32 2 1 3 1003 5 42 993280 [NO_LABEL]
FAT : 32
cluster_size 8 8
reserved 32 32
total_sect 993280 993240
fat32_length 976 976
root_cluster 0 2
free_count uninitialised 123906
next_free uninitialised 2
Extrapolated boot sector and current boot sector are different.
Warning: Extrapolated boot sector have incorrect values.
Code: Select all
Disk /dev/sda - 512 MB / 488 MiB - CHS 1009 16 62
Partition Start End Size in sectors
1 * FAT32 2 1 3 1003 5 42 993280 [NO_LABEL]
Boot sector
Bad root_cluster
Bad
Backup boot sector
Bad root_cluster
Bad
Sectors are identical.
On non-empty FAT32 filesystems, "Rebuild BS" is nearly instant and produces better results. I recreated and reformatted the partition, added some files, corrupted the boot sector, retried "Rebuild BS", and this time "Rebuild BS" seems to work better, and my files are accessible on Linux (didn't test Windows). (fsck still complains that the boot sector volume label is empty though.)
Code: Select all
Disk /dev/sda - 512 MB / 488 MiB - CHS 1009 16 62
Partition Start End Size in sectors
1 * FAT32 2 1 3 1003 5 42 993280 [NO_LABEL]
FAT : 32
cluster_size 8 8
reserved 32 32
total_sect 993280 993240
fat32_length 976 976
root_cluster 2 2
free_count uninitialised 94099
next_free uninitialised 29809
Extrapolated boot sector and current boot sector are different.
In actual corruption, Analyse doesn't work and Advanced -> Boot mostly works
My original corrupted disk had identically corrupted normal and backup boot partitions; fsck verified that they were identical except for the dirty bit. To reproduce this, I corrupt the regular boot sector, then use fsck to copy the corruption over the backup boot sector as well (fsck /dev/sda1, 1, 1). When I run TestDisk, Analyse shows:
Code: Select all
Disk /dev/sda - 512 MB / 488 MiB - CHS 1009 16 62
Current partition structure:
Partition Start End Size in sectors
Invalid FAT boot sector
1 * FAT32 2 1 3 1003 5 42 993280
1 * FAT32 2 1 3 1003 5 42 993280
Neither Quick Search nor Deeper Search can identify the FAT32 partition and filesystem, even though it's perfectly intact except for 6 missing bytes.
If I use the Advanced -> Boot menu instead, [Rebuild BS] behaves as described above (though I performed less testing here).
Can you manually type in the partition position? (no)
Prior to learning that Advanced->Boot is used for filesystem header recovery (rather than boot device management), I discovered that I can open the main menu and click "Analyse", write down the partition printout (above), then start and abort Quick Search, then press A to add a partition, then retype the information from *before* it tried to search for partitions (2 1 3 1003 5 42, find FAT32 in the list, type 0B, make a typo, I can't press Backspace to retype it, I get a list of partition types, I pick FAT32, but TestDisk says Unknown anyway so I activate [ Type ] a second time and type 0B correctly this time). If you instead type 0B instead correctly the first time, the next screen shows ">Unknown" but pressing Enter shows FAT32 anyway. Now TestDisk somehow thinks it's an extended partition which it isn't:
Code: Select all
Disk /dev/sda - 512 MB / 488 MiB - CHS 1009 16 62
Partition Start End Size in sectors
1 E extended 2 1 2 1003 15 62 993921
5 L FAT32 2 1 3 1003 5 42 993280
At this point, I have to "Write partition table, confirm ? (Y/N)". And now I'm back in the main menu, having had no opportunity to [Rebuild BS].
Oddly when I restart testdisk, it thinks it's a primary partition again.
tl;dr
Testdisk has a function to rebuild the boot sector.
On disks corrupted by libparted, [Rebuild BS] is inaccessible through the Analyse menu, but accessible through Advanced -> partition -> Boot. It's heuristic-based (even though filesystems corrupted by libparted can be deterministically repaired), and using Rebuild BS causes further unnecessary changes to the boot sector, which could cause problems ranging from cosmetic (missing volume label) to possibly corruption (total_sect).
I'm confused by the UI and what "total_sect 993280 993240" means. If I run Rebuild BS a second time, it prints "total_sect 993280" instead. Does that mean that the first Rebuild BS wrote 993280 replacing 993240?