15 replies to this topic

[CodeCat]

For some reason one of the partitions on my drive has suddenly become inaccessible. Neither Windows nor Linux can access it, and Windows says it's not formatted. Realising that there's probably nothing wrong with the partition other than some problem in the boot record/partition table or whatever, I wisely decided not to format. The drive itself is fine as Linux booted from another partition on the same drive without problems.

However, now the question remains on how to get my data back. I really can't do without the data as it has all my music, photos, and documents on it. I know there are some good programs out there that can restore file systems, but I don't know which so I need some advice.

I also need to stress here that any attempt HAS to either work, or have no effect. I don't want things to get any worse than they are!

Edited by CodeCat, 23 May 2009 - 20:35.

[jnengland77]

I recommend booting into Linux and using fsck on it. Be sure to install the dosfstools packages (most distributions name it this) if you don't already have it installed. Then do a dosfsck (or fsck.vfat) on the partition. You'll have to no where the partition is yourself. If you don't know there may be hints in /etc/fstab look for a vfat entry.

Looking at the man page for dosfsck. You'll want to add the '-a' parameter.

	   -a	 Automatically repair the file system. No  user  intervention  is
			  necessary.   Whenever  there  is more than one method to solve a
			  problem, the least destructive approach is used.

You can see what it'll attempt to repair if you look in the man page. Although I doubt you care since you don't know exactly what's wrong.

So the code you'll want to run is: fsck.vfat -a /dev/path/to/partition
Make sure it's NOT mounted. I know you said you couldn't mount, but just be warned don't do any fsck with the partition mounted.

[CodeCat]

If this doesn't work, what effect does it have? Will it mess things up even further?

[jnengland77]

I seriously doubt it'll do anything destructive. Run without the '-a' and see what's wrong with it. Then read through the man page and see if it can repair it. Oh and upon rereading the man page I would also add the verbosity flag (-v) to both just to get more output. Fscks are common unix tools so they're generally safe and used to check file systems on bootup. Unless the file system is totally screwed up or the hard drive is dying (such as bad sectors) it should have a very good chance of repairing it.

Edited by jnengland77, 23 May 2009 - 18:04.

[CodeCat]

I tried that and it gave me the following message:

Quote

Currently, only 1 or 2 FATs are supported, not 52.

Any ideas?

[jnengland77]

Sounds like you're fsck'ing the wrong partition of a different type. Could you post the last bit of dmesg. Just run dmesg from a terminal after running dosfsck.

[CodeCat]

dmesg just gives me screens full of stuff about networking. However fdisk -s confirms that it's the right drive because it's the proper size. So it seems that this error message is part of whatever went wrong.

[jnengland77]

Could you give the exact command you used dosfsck? From looking up that error it seems that you're trying to use the whole drive and not the partition (Just a guess).

If not I found a guide to use dd which will create an exact copy of the partition.

Found another tool, too. Called testdisk can be ran from under Linux. Never used it though.
link

Edited by jnengland77, 23 May 2009 - 18:46.

[CodeCat]

Ok I think I'm getting a little further now. To understand why this error occurred, I opened /dev/hdb1 in a hex editor, to see what the boot record looked like. And to my surprise, what I found at the start of the disc was not the boot record but some other random gibberish. At offset 0x10, where a byte indicating the number of FATs is located according to the FAT32 specs, the number 0x34 (52 dec) is located. So at least that part fits.

However, now the interesting part. I *did* find what looks like a FAT32 boot record at offset 0xC00! So it seems to me that somehow the MBR of the drive is reporting the starting sector of the partition incorrectly, so it mis-reads the boot record and things start going weird. At least now I know a bit more, but I still don't know what to do.

[jnengland77]

Look up I edited my post. Sounds like testdisk could solve your problems. After you use that I would double check it with a fsck.

[BeefJeRKy]

Code any idea what could have done this?

[CodeCat]

I have no idea... but it seems I can restore the original boot record from the backed-up one. Let's hope it works.

[Rade]

I had a similar problem, but that was like 10 years ago and it was some virus that would delete partition on the hard drive, the only way to fix this was to run fdisk, format and then reinstall everything.

[CodeCat]

I'm back up and running, problem fixed! jnengland pointed me to a nifty little Linux utility that can do a variety of operations on partitions and file systems called 'testdisk'. As I had already discovered (previous posts) the backup of the boot sector was still intact. And it turns out the boot sector was the only thing that got mangled. So I restored the boot sector from the backup, and it was fixed.

My heroes for today are me (for not giving up and formatting the whole thing), jnengland (for all the help and advice), whoever thought of putting a backup boot sector into the FAT32 specs, and of course the Linux operating system!

Edited by CodeCat, 23 May 2009 - 20:35.

[BeefJeRKy]

Debian Linux is win This would be helpful in case it happens to anyone else.

[jnengland77]

Google and Linux are awesome. Arch Linux ftw!

Edited by jnengland77, 23 May 2009 - 21:29.