Advanced FAT Repair

From CGSecurity

If the FAT boot sector is damaged, data can not be accessed. Windows will prompt The drive is not formatted, do you want to format it now? Linux mount will display wrong fs type, bad option, bad superblock

TestDisk let you manipulate the boot sector of FAT partitions. In the Advanced menu, select the partition you want to modify and choose Boot. 

TestDisk 6.2-WIP, Data Recovery Utility, November 2005
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63

     Partition                  Start        End    Size in sectors
 1 * FAT32                    0   1  1  1010 254 63   16241652 [NO NAME]
 2 P Linux                 1011   0  1  1023 254 63     208845 [/boot]
 3 E extended LBA          1024   0  1 14592 254 63  217985985
 5 L Linux RAID            1024   1  1  3573 254 63   40965687 [md0]
   X extended              3574   0  1  4210 254 63   10233405
 6 L Linux RAID            3574   1  1  4210 254 63   10233342 [md1]
   X extended              4211   0  1 14592 254 63  166786830
 7 L Linux                 4211   1  1 14592 254 63  166786767








[  Type  ]  [  Boot  ]  [  Quit  ]
                              Boot sector recovery

If the boot sector and backup boot sector mismatches (FAT32), you can copy overwrite the backup boot sector with the boot sector or vice versa. You can also rebuild FAT boot sector, dump its content or repair FAT. 

TestDisk 6.2-WIP, Data Recovery Utility, November 2005
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63
     Partition                  Start        End    Size in sectors
 1 * FAT32                    0   1  1  1010 254 63   16241652 [NO NAME]
Boot sector
OK
Backup boot sector
OK
Sectors are identical.










[  Quit  ]  [Rebuild BS][  Dump  ]  [Repair FAT]

                            Return to Advanced menu


To rebuild a FAT boot sector, TestDisk assumes that

  • filesystem size is equal to partition size
  • fragmentation is low


The steps are

  • select which FAT type are compatible with the filesystem size
  • identify the sectors where begin the two FAT (number of reserved sector, fat length) and the FAT type (FAT12/16/32)
  • If only one FAT is found:

If FAT12 or FAT16 is found, assumes there is only one reserved sector. If it's the second FAT, deduce the the fat length. If beginning of FAT32 first fat is found at sector 32 or 33, deduce the number of reserved sectors.

  • If two or more FAT sector beginning has been found:

assumes the first two are the two copies of the FAT. Deduce the number of reserved sectors and fat length.

  • If number of reserved sector or fat length hasn't been found,

use inode of . directory entries to get the cluster size and deduce where the first cluster begin. From the number of cluster, deduce if it's a FAT12, FAT16 or FAT32. If FAT12 or FAT16, assume there is only one reserved sector. Try to find the number of directories entree (512 by default). Deduce the FAT length.

  • If FAT12 or FAT16, find the root directory size
  • Find the cluster size
  • If FAT32, find the root cluster
  • Create a boot sector with this information
  • ask the user if he want to write this new boot sector or not,

the user can also list the files of the FAT partition

To repair FAT, TestDisk compares the two FAT copies. If FAT mismatches (sector by sector check) or contains errors, it uses the FAT copy with less errors and remove the obvious errors. This function must only be used on FAT filesystem with correct values in the boot sector. It has been used with success when scandisk, chkdsk or fsck.vfat refused to repair the filesystem or crashes.

Back to Running the TestDisk Program

Data Recovery