Testdisk Quit List Rebuild Bs Repair Mft Dump

If the FAT boot sector is damaged, data can not be accessed. Windows will prompt The drive is not formatted, do you want to format it now? A Linux mount will display wrong fs type, bad option, bad superblock

TestDisk let you manipulate the boot sector of FAT partitions. In the Advanced menu, select the partition you want to modify and choose Boot.

Repair a FAT boot sector

TestDisk 6.2-WIP, Data Recovery Utility, November 2005 Christophe GRENIER <grenier@cgsecurity.org> https://www.cgsecurity.org  Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63       Partition                  Start        End    Size in sectors  1 * FAT32                    0   1  1  1010 254 63   16241652 [NO NAME]  2 P Linux                 1011   0  1  1023 254 63     208845 [/boot]  3 E extended LBA          1024   0  1 14592 254 63  217985985  5 L Linux RAID            1024   1  1  3573 254 63   40965687 [md0]    X extended              3574   0  1  4210 254 63   10233405  6 L Linux RAID            3574   1  1  4210 254 63   10233342 [md1]    X extended              4211   0  1 14592 254 63  166786830  7 L Linux                 4211   1  1 14592 254 63  166786767         [  Type  ]  [  Boot  ]  [  Quit  ]                               Boot sector recovery        

Recover a FAT32 boot sector

TestDisk can fix corrupted FAT32 boot sectors. The quickest way is to restore the FAT32 boot sector from its backup. TestDisk checks the boot sector and the backup boot sector. If the boot sector and backup boot sector mismatch, you can:

• restore the boot sector from the FAT32 backup boot sector if it's valid (Backup BS);
• update the backup boot sector with the current FAT32 boot sector if it's valid (Org. BS).

Dump can used to display the sector content in both hexadecimal and ASCII.

If the boot sector has been overwritten, it's often the case for its backup also as they are very close to each other:

• the primary boot sector is sector zero of the filesystem;
• the backup FAT32 boot sector is usually located at sector 6.

Fortunately TestDisk can deal with this problem by creating a new boot sector from scratch.

Rebuild a valid FAT boot sector

There is no backup boot sector for FAT12 and FAT16, so if the boot sector is damaged, it has to be recreated. The same thing applies for FAT32 if both the boot sector and its backup are corrupted. TestDisk can rebuild a FAT boot sector. Choose RebuildBS in the menu - it's safe and doesn't modify the disk. Use List to check the result and Write if you have been able to list your files.

TestDisk 6.2-WIP, Data Recovery Utility, November 2005 Christophe GRENIER <grenier@cgsecurity.org> https://www.cgsecurity.org  Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63      Partition                  Start        End    Size in sectors  1 * FAT32                    0   1  1  1010 254 63   16241652 [NO NAME] Boot sector OK Backup boot sector OK Sectors are identical.           [  Quit  ]  [Rebuild BS][  Dump  ]  [Repair FAT]                              Return to Advanced menu        

Technical information about FAT boot sector rebuild

To rebuild a FAT boot sector, TestDisk assumes that

• Filesystem size is equal to partition size;
• Fragmentation is low.

The steps are:

• Select which FAT type is compatible with the filesystem size;
• Identify the sectors where the two FAT (number of reserved sectors, FAT length) and the FAT type (FAT12/16/32) begin.

If only one FAT copy is found:

• If the FAT type is FAT12 or FAT16, TestDisk assumes there is only one reserved sector, so the first FAT copy is at sector 1. If the location of the FAT that has been found isn't sector 1, TestDisk has found the second FAT and it deduces the FAT length from the FAT location.
• If the FAT type is FAT32, if the FAT has been found at sector 32 or 33, it's the first copy of the FAT and the number of reserved sectors is equal to this location, otherwise it's the second copy.

If two or more FAT sector beginnings have been found:

• It assumes the first two are the two copies of the FAT;
• Deduces the number of reserved sectors and FAT length.

If the number of reserved sectors or FAT length hasn't been found, TestDisk searches for directory structure. The first two entries of a directory are . (current directory) and .. (parent directory). Using the inode number of two or more . directory entries, TestDisk get the cluster size and deduces where the first cluster begins.

• From the number of clusters, it deduces if it's a FAT12, FAT16 or FAT32;
• If FAT12 or FAT16, it assumes there is only one reserved sector;
• Tries to find the number of directories entries (512 by default);
• Deduces the FAT length.

If FAT12 or FAT16:

• It finds the root directory size;
• Finds the cluster size.

If FAT32:

• It finds the root cluster;
• Creates a boot sector with this information;
• Asks the user if he wants to write this new boot sector or not.

The user can also list the files of the FAT partition.

Repair FAT tables

File Allocation Tables are maps of the data region, indicating which clusters are used by files and directories. To repair the FAT, the menu Repair FAT will have TestDisk compare the two FAT copies. If the FATs mismatch (sector by sector check) or contains errors, TestDisk uses the FAT copy with less errors and removes the obvious errors. This function must only be used on FAT filesystems with correct values in the boot sector. It has been used with success when scandisk, chkdsk or fsck.vfat crashed or refused to repair the filesystem.

Back to Running the TestDisk Program

Testdisk Quit List Rebuild Bs Repair Mft Dump

Source: https://www.cgsecurity.org/wiki/Advanced_FAT_Repair

Share this post