cgsecurity.org

TestDisk & PhotoRec forum
https://forum.cgsecurity.org/phpBB3/

Restoring ExFat partition on SD from backup.

https://forum.cgsecurity.org/phpBB3/viewtopic.php?t=12954

Page 1 of 1

Restoring ExFat partition on SD from backup.

Posted: 27 Nov 2024, 03:07
by TQKez
Hi there, I'm resorting to asking here because I'm getting conflicting information from the testdisk PDF, the testdisk application, and Disk Utility in macOS.

A Sandisk Extreme 256GB microsd with some important drone footage went bad on me and I'm hoping to get at least some of it.

Disk Utility lists the partition correctly (256GB ExFAT), but wont mount it.
Image

Diskutil List, lists it incorrectly as NTFS

Code: Select all

/dev/disk5 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:     FDisk_partition_scheme                        *255.9 GB   disk5
   1:               Windows_NTFS                         255.8 GB   disk5s1
Testdisk says boot sector and backup sector bad, but I dont know if that's because it's incorrectly recognising an NTFS partition

Code: Select all

Disk /dev/disk5 - 255 GB / 238 GiB - 499744768 sectors
     Partition                  Start        End    Size in sectors
 1 P HPFS - NTFS                65536  499744767  499679232

Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.
....because when I hit Analyse -> Quick Search, it *does* appear to find the backup sector, correctly identified as ExFAT with the correct size.

Code: Select all

Disk /dev/disk5 - 255 GB / 238 GiB - 499744768 sectors
     Partition               Start        End    Size in sectors
>* HPFS - NTFS                65536  499744767  499679232


Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
exFAT found using backup sector, blocksize=262144, 255 GB / 238 GiB
Furthermore I get this message. Is this likely to be true? It sounds spinning disk related.

Code: Select all

Disk /dev/disk5 - 255 GB / 238 GiB - 499744768 sectors

Warning: the current number of heads per cylinder is 1
but the correct value may be 128.
You can use the Geometry menu to change this value.
It's something to try if
- some partitions are not found by TestDisk
- or the partition table can not be written because partitions overlap.

This message is the only thing giving me hope "exFAT found using backup sector, blocksize=262144, 255 GB / 238 GiB", how do I tell test disk to use it?

Re: Restoring ExFat partition on SD from backup.

Posted: 27 Nov 2024, 12:45
by recuperation
TQKez wrote: 27 Nov 2024, 03:07 Hi there, I'm resorting to asking here because I'm getting conflicting information from the testdisk PDF, the testdisk application, and Disk Utility in macOS.
What is the conflicting information from the manual and the TestDisk application?

A Sandisk Extreme 256GB microsd with some important drone footage went bad on me and I'm hoping to get at least some of it.

Disk Utility lists the partition correctly (256GB ExFAT), but wont mount it.
How do you know that the partition type is ExFAT?
Image

Diskutil List, lists it incorrectly as NTFS

Code: Select all

/dev/disk5 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:     FDisk_partition_scheme                        *255.9 GB   disk5
   1:               Windows_NTFS                         255.8 GB   disk5s1
Testdisk says boot sector and backup sector bad, but I dont know if that's because it's incorrectly recognising an NTFS partition

Code: Select all

Disk /dev/disk5 - 255 GB / 238 GiB - 499744768 sectors
     Partition                  Start        End    Size in sectors
 1 P HPFS - NTFS                65536  499744767  499679232

[/quote]Have you changed the partition type information? [quote]

Boot sector
Status: Bad

Backup boot sector
Status: Bad

Sectors are not identical.
....because when I hit Analyse -> Quick Search, it *does* appear to find the backup sector, correctly identified as ExFAT with the correct size.

Code: Select all

Disk /dev/disk5 - 255 GB / 238 GiB - 499744768 sectors
     Partition               Start        End    Size in sectors
>* HPFS - NTFS                65536  499744767  499679232


Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue
exFAT found using backup sector, blocksize=262144, 255 GB / 238 GiB
Have you tried the p-key to list the files?

Furthermore I get this message. Is this likely to be true? It sounds spinning disk related.

Code: Select all

Disk /dev/disk5 - 255 GB / 238 GiB - 499744768 sectors

Warning: the current number of heads per cylinder is 1
but the correct value may be 128.
You can use the Geometry menu to change this value.
It's something to try if
- some partitions are not found by TestDisk
- or the partition table can not be written because partitions overlap.
I don't know what "spinning disk related" means. Modern operating system do not use geometry information you can ignore that. Besides, that text tells you when to change geometry. Do those criteria apply in your case?

This message is the only thing giving me hope "exFAT found using backup sector, blocksize=262144, 255 GB / 238 GiB", how do I tell test disk to use it?
https://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

Please post your logfile.

Re: Restoring ExFat partition on SD from backup.

Posted: 27 Nov 2024, 23:10
by TQKez
recuperation wrote: 27 Nov 2024, 12:45 What is the conflicting information from the manual and the TestDisk application?
I guess confusing is probably more accurate than conflicting. While section 7.4 correctly describes how to enact restoration of the backup sector (which i can't proceed with due to the backup sector being shown as bad in the Adavanced menu), the application is also telling me in the Analyse section that it has found an ExFAT partition using the backup sector, but no where do i see information on what i might be able to action on it.
How do you know that the partition type is ExFAT?
Because it shows it right there in the screenshot "USB Internal Physical Volume ExFAT', and it has always been ExFAT, it has to be so both the drone and macOS can both write to it.
Have you tried the p-key to list the files?
p-key does list some files, but not the ones i need, and they're in the only folder p-key shows which is .Trashes.

Code: Select all

Directory /.Trashes/501

>-rwxr-xr-x     0     0  44002415  8-May-2024 12:33 DJI_0836.MOV
 -rwxr-xr-x     0     0 857147930  8-May-2024 12:35 DJI_0837.MOV
 -rwxr-xr-x     0     0 519008117  8-May-2024 12:51 DJI_0838.MOV
 -rwxr-xr-x     0     0 319054495  8-May-2024 12:52 DJI_0839.MOV
 -rwxr-xr-x     0     0 202506492  8-May-2024 12:53 DJI_0840.MOV
 -rwxr-xr-x     0     0 743513250  8-May-2024 12:54 DJI_0841.MOV
 -rwxr-xr-x     0     0 139051787  8-May-2024 12:55 DJI_0842.MOV
 -rwxr-xr-x     0     0 125509390  8-May-2024 12:55 DJI_0843.MOV
 -rwxr-xr-x     0     0 143002992  8-May-2024 12:55 DJI_0844.MOV
 -rwxr-xr-x     0     0 122085049  8-May-2024 12:56 DJI_0845.MOV
 -rwxr-xr-x     0     0 879509265  8-May-2024 12:57 DJI_0846.MOV
 -rwxr-xr-x     0     0 186509933  8-May-2024 12:58 DJI_0847.MOV
 -rwxr-xr-x     0     0  84829130  8-May-2024 13:00 DJI_0848.MOV
 -rwxr-xr-x     0     0 193281800  8-May-2024 13:00 DJI_0849.MOV
 -rwxr-xr-x     0     0 301736078  8-May-2024 13:01 DJI_0850.MOV
I don't know what "spinning disk related" means. Modern operating system do not use geometry information you can ignore that.

Thanks, thats what i thought, that heads and cylinders are related to spinning disks and not relevant to me.
Besides, that text tells you when to change geometry. Do those criteria apply in your case?

Code: Select all

It's something to try if
- some partitions are not found by TestDisk
Well it finds a partition, but it's not finding an ExFAT partition as I would hope. That suggests to me the possibility that my ExFAT partition may be found if I change the geometry. But i think you've explained that now.

UPDATE:

Well this time round i managed to change the partition type to ExFAT, then in Advanced it did list the backup sector as OK, so I selected BackupBS etc but it still doesnt mount.
I guess it's time to try PhotoRec and then call it a day.

Re: Restoring ExFat partition on SD from backup.

Posted: 27 Nov 2024, 23:14
by TQKez
Please post your logfile.
testdisk.log
(9.49 KiB) Downloaded 270 times

Re: Restoring ExFat partition on SD from backup.

Posted: 28 Nov 2024, 00:34
by recuperation
Thanks, thats what i thought, that heads and cylinders are related to spinning disks and not relevant to me.
No, at least they apply to SSDs as well. But adressing using CHS-Information (cylinder, head, sector) is outdated. There is a linear numbering scheme called LBA (logical block adress). That is being used.

I would have continued even using "deep search" and would have checked all results.
If that fails, try out commercial software.

PhotoRec is the tool of last resort.

Good luck!
All times are UTC+01:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited