cgsecurity.org

Posted: **02 Jan 2017, 13:38**

Hello.
After running fsck.ext4 [/ b] on my exFat disk i lost exFat partition and my partition began mounting as ext4 disk. After this i'm found exFat partition via testdisk utility and wrote new one, also i'm rebuild BS and MBR. Now i can explore files on exFat disk throw testdisk and partition table look nice in testdisk output (third disk on testdisk output):

Code: Select all

Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63

     Partition                  Start        End    Size in sectors
  1 P HPFS - NTFS              0   1  1 26132 254 63  419826582
  2 P Linux                26133   0  1 26255 254 63    1975995 [OPT]
> 3 * HPFS - NTFS          26256   0  1 60800 254 63  554965425

But any os does not see my exFat disk. Windows offer me to format this disk. When i open any of partition manager applications, they show this third disk as ext4 disk. I tried opened this harddrive in WinHex on start sector of exFat partition (421 802 640) and its looks ok, but when i'm jump to next 2 sector (421 802 642), i found here Ext4 superblock from previously ext4 partition. WinHex also showing my third disk as Ext4 partition (look at screenshot)

: 123b.jpg (115.98 KiB) Viewed 6177 times

How can i fixed this and make exFat disk for visible to any os, may be i cat just erase ext4 boot sector 421 802 642?

Posted: **04 Jan 2017, 17:43**

You can erase the ext4 signature by overwritting the value "53 EF" (0x438 bytes from the beginning of the partition). It may help to identify the partition as an exfat.

Posted: **05 Jan 2017, 00:49**

i'm already tried this solution (by rewriting "53 EF" on "00 00"), now winhex showing partition as exFat, but any os still can't recognize filesystem of partition.

Posted: **05 Jan 2017, 06:32**

Did you try a fsck.exfat ?

Posted: **05 Jan 2017, 11:04**

thanks for advice, but

Code: Select all

~$ sudo fsck.exfat /dev/sdb3
exfatfsck 1.0.1
ERROR: invalid VBR checksum 0x180000 (expected 0xb2efab44).

also i tried run os x fsck_exfat utility:

Code: Select all

~$ sudo fsck_exfat -d /dev/rdisk3s3 
Password:
Opening /dev/rdisk3s3
** Checking volume.
** Checking main boot region.
fsck_exfat: Invalid boot region checksum
   Main boot region is invalid.  Trying alternate boot region.
** Checking alternate boot region.
fsck_exfat: Invalid boot region checksum
   Alternate boot region is invalid.
** The volume  could not be verified completely.

Posted: **07 Jan 2017, 00:01**

today i'm fix wrong Boot Checksum (11 sector) by filling this sector of repeating values of needed checksum. after this when i run fsck.exfat or mount disk on ubuntu i get one same message:

Code: Select all

 Unknown entry type 0xa0

But on mac os x i have success mounting this disk. And data (files and directories) is very well reading! But some files i can't find...

When i several times try to mount this disk on virtualbox Windows, i getting kernel panic of main host.

I already made backup of needed data and i think from this point i will delete partition and create new one, because i think fsck.ext4 made to many changes on exfat partition and find/fix all is to very hard.

cgsecurity.org

lost exFat partition

lost exFat partition

Re: lost exFat partition

Re: lost exFat partition

Re: lost exFat partition

Re: lost exFat partition

Re: lost exFat partition