cgsecurity.org

Hi all,

I am having a small problem with my exFAT partition (using Windows 10). After a BSOD, the exFAT boot sector and its backup sector are no longer identical:
However, they are both being listed as "OK". Looking at the dump, it is also not immediately clear which one I should overwrite with the other (the highlighted small differences are the only ones, even when scrolling through the rest of the dumps):
Due to this insecurity, I was wondering if there is a possibillity to store the boot sector dumps for later recovery to files (other than generating an entire dd image of this 8TB partition). That way, I could just make a guess on whether to continue with "Org. BS", "Backup BS" or "Rebuild BS" option in Testdisk and restore if I run into any issues.

Can Testdisk export the dumps somehow? Can it restore them later on? If not: Do you know of any (preferably Windows) tool to create such a backup? I guess I could also use a RAW Hex Editor on the partition, but I would not know how to find the correct region, let alone safely restore it later.

P.S.: Luckily, my files on that partition are still accessible, although I have not tested them all.

Chris1337 wrote: 30 Mar 2022, 23:24 Hi all,

I am having a small problem with my exFAT partition (using Windows 10). After a BSOD, the exFAT boot sector and its backup sector are no longer identical:

screenshot1.jpg

However, they are both being listed as "OK". Looking at the dump, it is also not immediately clear which one I should overwrite with the other (the highlighted small differences are the only ones, even when scrolling through the rest of the dumps):

How come you are using Testdisk when you have no noticeable error with your installation?

If your files are still accessible, copy them to a backup location.
You can format your partition then which will delete the files but will ensure that your file system is clean and without errors.
Then copy the files from your backup location to the freshly formated partition.

screenshot2.jpg

Due to this insecurity, I was wondering if there is a possibillity to store the boot sector dumps for later recovery to files (other than generating an entire dd image of this 8TB partition). That way, I could just make a guess on whether to continue with "Org. BS", "Backup BS" or "Rebuild BS" option in Testdisk and restore if I run into any issues.

Can Testdisk export the dumps somehow?

I am not aware of such a possibility.

Can it restore them later on? If not: Do you know of any (preferably Windows) tool to create such a backup? I guess I could also use a RAW Hex Editor on the partition, but I would not know how to find the correct region, let alone safely restore it later.

P.S.: Luckily, my files on that partition are still accessible, although I have not tested them all.

As the boot sector is the first sector of a partition any hex editor that allows you to open up a partition will be able to guide you to the right location. HxD is such an example.

If you don't need to exchange the content of your 8TB drive with somebody else I would consider using NTFS instead of EXFAT.

Thank you for taking the time to reply!

recuperation wrote: 31 Mar 2022, 08:47 How come you are using Testdisk when you have no noticeable error with your installation?

After the BSOD, chkdsk refused to even scan the drive, giving the obscure error message "corruption was found while examining the boot region", so I thought I'd look at the boot sectors using testdisk to get chkdsk to be able to proceed normally. When testdisk then indeed found a difference between the primary and the backup boot sector, I was hoping that fixing this would do the trick to persuade chkdsk.

recuperation wrote: 31 Mar 2022, 08:47 As the boot sector is the first sector of a partition any hex editor that allows you to open up a partition will be able to guide you to the right location. HxD is such an example.

Thank you. I used HxD to compare the boot sector and backup boot sector of the affected drive with a cleanly formatted exFAT drive and determined that the region in question should look more like the backup sector, so I used that to replace the main sector. Unfortunately, this did not fix the chkdsk error mentioned above. Still, would have been nice to be able to store and restore the boot sectors with testdisk before taking any action. I also tried rebuilding the boot sector, without an effect on chkdsk.

recuperation wrote: 31 Mar 2022, 08:47 If your files are still accessible, copy them to a backup location. You can format your partition then which will delete the files but will ensure that your file system is clean and without errors. Then copy the files from your backup location to the freshly formated partition.

I was hoping to get around moving several TB of data back and forth just because of one little BSOD. But yes, indeed I eventually did exactly this.

Thank you again for putting time and thought into this! Much appreciated!