# Fat32 Boot Sector , file system recovery



## toveornottove (Dec 27, 2011)

Hi All,

I have a Seagate 1 TB external hard disk.

While trying to erase a 1GB pendrive with Startup Disk Creator (on Linux Mint 11), i wrongly selected my external hard disk.Immediately after starting the erase operation, i recognised my mistake and pulled the power cable to the external hard disk.

I have lost access to loads of important data ( more than 800 GB) due to my stupidity.

Now, i can see that my external hard-disk is recognised by Disk Utility ,and is shown as a "Unknown 1.0 TB" volume with Partition Type:W95 FAT32 (LBA) (0x0c).

When i used testdisk's 'Analysis' menu to search - it was unable to find a valid partition.
(Why does testdisk show this status - when disk utility shows the partition type?)

Then, i started to recover the boot sector using testdisk and got the below output:

****************************************************************************
*TestDisk 6.11, Data Recovery Utility, April 2009
*Christophe GRENIER <[email protected]>
*Main Page - CGSecurity
*
*Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
* Partition Start End Size in sectors
* 1 * FAT32 LBA 0 1 1 121600 254 63 1953520002
*
*Boot sector
*Bad
*
*Backup boot sector
*Bad
*
*Sectors are identical.
*
*A valid FAT Boot sector must be present in order to access
*any data; even if the partition is not bootable.
****************************************************************************

I selected the option : "Dump" and got the below output:
(I understand that both my boot sector and its backup are lost)

****************************************************************************
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
1 * FAT32 LBA 0 1 1 121600 254 63 1953520002
Boot sector Backup boot sector
0000 00000000 00000000 ........ 00000000 00000000 ........
0008 00000000 00000000 ........ 00000000 00000000 ........
0010 00000000 00000000 ........ 00000000 00000000 ........
0018 00000000 00000000 ........ 00000000 00000000 ........
0020 00000000 00000000 ........ 00000000 00000000 ........
0028 00000000 00000000 ........ 00000000 00000000 ........
0030 00000000 00000000 ........ 00000000 00000000 ........
0038 00000000 00000000 ........ 00000000 00000000 ........
0040 00000000 00000000 ........ 00000000 00000000 ........
0048 00000000 00000000 ........ 00000000 00000000 ........
0050 00000000 00000000 ........ 00000000 00000000 ........
0058 00000000 00000000 ........ 00000000 00000000 ........
0060 00000000 00000000 ........ 00000000 00000000 ........
0068 00000000 00000000 ........ 00000000 00000000 ........
0070 00000000 00000000 ........ 00000000 00000000 ........
0078 00000000 00000000 ........ 00000000 00000000 ........
0080 00000000 00000000 ........ 00000000 00000000 ........
0088 00000000 00000000 ........ 00000000 00000000 ........
0090 00000000 00000000 ........ 00000000 00000000 ........
0098 00000000 00000000 ........ 00000000 00000000 ........
00A0 00000000 00000000 ........ 00000000 00000000 ........
00A8 00000000 00000000 ........ 00000000 00000000 ........
00B0 00000000 00000000 ........ 00000000 00000000 ........
00B8 00000000 00000000 ........ 00000000 00000000 ........
00C0 00000000 00000000 ........ 00000000 00000000 ........
00C8 00000000 00000000 ........ 00000000 00000000 ........
00D0 00000000 00000000 ........ 00000000 00000000 ........
****************************************************************************

So, i tried the option: "Rebuild Boot Sector" and got the following output:

****************************************************************************
1 * FAT32 LBA 0 1 1 121600 254 63 1953520002
Cluster 79999, Directory / found ?
Answer Y(es), N(o) or A(bort interactive mode). N or A if not sure.

-rwxr-xr-x 0 0 10632 7-Dec-2000 00:00 ~A)
-rwxr-xr-x 0 0 10640 15-Dec-2000 00:00 ~I)
-rwxr-xr-x 0 0 10648 23-Dec-2000 00:00 ~Q)
-rwxr-xr-x 0 0 10656 31-Dec-2000 00:00 ~Y)
-rwxr-xr-x 0 0 10664 8-Jan-2000 00:00 M-!)
-rwxr-xr-x 0 0 10672 16-Jan-2000 00:00 M-))
-rwxr-xr-x 0 0 10680 24-Jan-2000 00:00 M-1)
-rwxr-xr-x 0 0 10688 1-Feb-2000 00:00 M-9)
-rwxr-xr-x 0 0 10696 8-Jan-2000 00:00 M-A)
-rwxr-xr-x 0 0 10704 16-Jan-2000 00:00
-rwxr-xr-x 0 0 10712 24-Jan-2000 00:00
-rwxr-xr-x 0 0 10720 1-Feb-2000 00:00
-rwxr-xr-x 0 0 10728 8-Jan-2000 00:00
-rwxr-xr-x 0 0 10736 16-Jan-2000 00:00
-rwxr-xr-x 0 0 10744 24-Jan-2000 00:00
-rwxr-xr-x 0 0 10752 1-Feb-2000 00:00
****************************************************************************

Selecting 'N' prompts tesdisk to search through root clusters, i eventually start seeing the file names (such as shown below) and also some directories.But even after a lot of searching i havent seen any files/directories that i had on my disk.

****************************************************************************
1 * FAT32 LBA 0 1 1 121600 254 63 1953520002
Cluster 109491, Directory / found ?
Answer Y(es), N(o) or A(bort interactive mode). N or A if not sure.

-rwxr-xr-x 0 0 10732 27-Feb-2011 14:49 NETTPSMP.PNF
-rwxr-xr-x 0 0 4004 27-Feb-2011 14:49 NETUPNP.PNF
-rwxr-xr-x 0 0  3652 27-Feb-2011 14:49 NETBEAC.PNF
-rwxr-xr-x 0 0 6216 27-Feb-2011 14:49 NETIPRIP.PNF
-rwxr-xr-x 0 0 10412 27-Feb-2011 14:49 NETLPD.PNF
-rwxr-xr-x 0 0 308136 27-Feb-2011 14:49 DEFLTWK.PNF
-rwxr-xr-x 0 0 44908 27-Feb-2011 14:49 WDMA_INT.PNF
-rwxr-xr-x 0 0 30376 27-Feb-2011 14:49 NVTS.PNF
-rwxr-xr-x 0 0 45912 27-Feb-2011 14:49 NVDM.PNF
-rwxr-xr-x 0 0 30244 27-Feb-2011 14:49 NVCT.PNF
-rwxr-xr-x 0 0 32612 27-Feb-2011 14:49 NV4_DISP.PNF
-rwxr-xr-x 0 0 19408 27-Feb-2011 14:49 NETWV48.PNF
-rwxr-xr-x 0 0 14740 27-Feb-2011 14:49 NETWLAN2.PNF
-rwxr-xr-x 0 0 27880 27-Feb-2011 14:49 NETWLAN.PNF
-rwxr-xr-x 0 0 19836 27-Feb-2011 14:49 NETRTSNT.PNF
****************************************************************************

Is my filesystem recoverable ?

How do i do it with testdisk ?

The document i referred (http://www.cgsecurity.org/wiki/Advanced_FAT_Repair)says just the following:
*****************************************************************************
If FAT32:

It finds the root cluster;
Creates a boot sector with this information;
Asks the user if he wants to write this new boot sector or not. 

The user can also list the files of the FAT partition. 
*****************************************************************************

I would be greateful for any help/advice.

Thanks & Regards


----------



## hal8000 (Dec 23, 2006)

We've all made similar mistakes at some time or other.
This is not looking good as your partition table is full of zero's now.

Do you by chance have a backup of your partition table, or know its starting and end sectors or cylinders?
I always keep a libre office spreadsheet of my drives geometry including starting and end sectors, partition types etc.

You possibly dont but if your external hard drive was a single partition type fat32 you can try and recreate the partition. Just create a single partition using all drive space and re-run through test disk again.

You can also try photorec (also on mint) to look through your drive contents, its will search without a partition table thopugh not as thorough as testdisk.
Let us know how you get on.

Altering a partition is not fatal if you have a backup of the drives geometry, a format can sometimes be undone, but removing the power is not good,
I've once ran rm -rf * late at night in my tmp directory. Of course I wasnt in tmp but in / and wiped out all mounted drives as well. After that I never do any disk operations late at night and created my first drive spreadsheet.

Let us know how you get on.


----------



## Eddie.Dean.19 (Dec 15, 2011)

I would also throw in you should make an image with dd or the like of ur disk..when attempting to repair and drive it is eat to have a complete image since you can easily make things work.

Worst case scenario you will have an image file u can restore back to

Also check out scalpel for last ditch file recovery attempts.


----------



## toveornottove (Dec 27, 2011)

Hi Hal8000,

Thanks for the reply.

Yes, i have been running a photorec backup from yesterday and have been able to getback some photos, but most of the .mpg and .avi files that have been recovered until now are corrupted.

Also, what i observed with photorec is that the filenames are lost - this must be due to the raw disk read that it performs i guess? I am thinking how to sift through 800+ GB of files with altered names since, there were a lot of text and .mp3 files.

Unfortunately i don't have a backup of my partition table or its details. But, as you rightly inferred, this was a single fat32 partition.

Now, if i recreate the partition - will it also not create a new FAT and overwrite the older one ? 

Or, are you saying that there is no better alternative ?

Thanks & Regards


----------



## toveornottove (Dec 27, 2011)

Hi Eddie Dean.19,

Would like to do it , but i dont have so much disk space 

Will take a look at scalpel.

Thanks for the reply.

Regards


----------



## Eddie.Dean.19 (Dec 15, 2011)

Best of luck! I know how it feels to lose data.. no matter how it happens it sucks all around.
Scalpel has always been best to me..it's fast, light , thorough and fully extendable compare to other apps.

It takes input from a Conf file that you can add entries to yourself if u know the header and file of the file type

Here is a very extensive .conf file
https://github.com/int0x80/anti-forensics/blob/master/scalpel.conf

Mount your drive to somewhere in your os and make your working directory on a different drive that will have enough room to store your recovered files

Then with your .conf file in your cutter directory do

Scalpel -c ./scalpel.conf /dev/your/mount/point

Any questions feel free to ask


----------



## hal8000 (Dec 23, 2006)

Eddie.Dean.19 said:


> Best of luck! I know how it feels to lose data.. no matter how it happens it sucks all around.
> Scalpel has always been best to me..it's fast, light , thorough and fully extendable compare to other apps.
> 
> It takes input from a Conf file that you can add entries to yourself if u know the header and file of the file type
> ...



Thanks for posting this!
Until now I never heard of Scalpel. This will be a program I will also be looking at as well.


----------



## toveornottove (Dec 27, 2011)

Hi,

I was waiting for the photorec to complete. It was able to retreive most of my photos, but almost every video file retreived is corrupted.

After this - i recreated a new FAT32 parition and tried scalpel wasn't able to retreive any files.

After 3 weeks of waiting and experimenting i had enough of this and copied back whatever i was able to retreive .Now i have a single NTFS partition.

Thanks a lot for your help/advise.

Now, i have learnt my lesson 

Could you please tell me what all details do you record regarding your partition and file system ?


----------



## hal8000 (Dec 23, 2006)

toveornottove said:


> Hi,
> 
> Could you please tell me what all details do you record regarding your partition and file system ?



What I do is run fdisk -l as root. This prints out the starting and end sectors
of each partition as shown below:

Disk /dev/sdb: 500.1 GB, 500107862016 bytes
255 heads, 63 sectors/track, 60801 cylinders, total 976773168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x000eef1d

Device Boot Start End Blocks Id System
/dev/sdb1 63 39070079 19535008+ 83 Linux
/dev/sdb2 39070080 87891614 24410767+ 83 Linux
/dev/sdb3 * 87891615 126961694 19535040 af HFS / HFS+
/dev/sdb4 126961756 371117564 122077904+ 5 Extended
/dev/sdb5 126961758 156264254 14651248+ 83 Linux
/dev/sdb6 156264318 195334334 19535008+ 83 Linux
/dev/sdb7 195334398 234404414 19535008+ 83 Linux
/dev/sdb8 234404478 283225949 24410736 83 Linux
/dev/sdb9 283226013 322296029 19535008+ 83 Linux
/dev/sdb10 322296093 371117564 24410736 83 Linux


Then I create a new spreadsheet in Libre Office and also add filesystem type
and add some colour, then I print it out. Any partition changes, then you must make
a new spreadsheet and print out again.

Below is a sample line from my spreadsheet (cant copy and paste as formatting
is lost)

Disk /dev/sdb: 500.1 GB, 500107862016 bytes 
255 heads, 63 sectors/track, 60801 cylinders 
Units = cylinders of 16065 * 512 = 8225280 bytes 
Disk identifier: 0x16a716a6 


Name	Flags	Filesystem	Start	End Size	Label	Partition
--snip--
sda5 Btrfs	126961758	156264254	15G	Fedora 15	5

In addition to start and end sectors I add filesystem type, name of distribution
and approximate size (not important as start and end sectors are specified).
Hope that helps.


----------



## dglp (Feb 21, 2012)

Just flagging this for reference - having a problem with a thumb drive FAT, looking for repair utility.


----------

