Disaster Recovery, FAT 32 partition

[saturndude]

Okay, it looks like I've hurt my system. A 120 Gig IDE drive in a USB enclosure got messed up. The drive and USB board are fine. So I took this drive out of the USB enclosure and put it in the PC (slave).

I used Linux fdisk, Partition Magic 8.01, etc. to re-write the partition table (but not format any partitions).

This drive used to be one giant FAT32 partition, I think most people do this when they use USB enclosures. Now, the latest information I have on this disk is:

(1) When writing one giant FAT32 into partition table, the two copies of the FAT are not the same.

(2) The FAT might be 12 sectors or clusters longer or shorter than the length that is recorded elsewhere (does this make sense?)

Any suggestions on brute-force bulk recovery of FAT32 files and directories with long file names? I have not reformatted any partitions on this 120 GB disk, but still, I don't know if Acronis Demo or any other tool I have is going to get to the bottom of this.

BTW: the cause of this? Norton Utilities 2001 decided to mess with the partition table or boot record while it was still in the USB enclosure. I forgot to uncheck the "fix errors automatically" checkbox.

Any help, as always, is greatly appreciated.

Edited October 20, 2006 by saturndude

[DigeratiPrime]

there might be an easy fix, just run

fdisk /mbr

otherwise there is software that can recover from deleted/corrupted partitions.

we just had a big discussion about that a week ago here

http://www.msfn.org/board/index.php?showtopic=84345

[saturndude]

You say "fdisk /MBR"? I think I can do the same thing inside Linux. When I moved to the 2.6 kernel, Linux fdisk was able to tell me that partitions did not end on the cylinder boundaries. Because cylinders were no longer 512 * 63 * 256 = 8,257,536 bytes but suddenly they became 16065 * 512 = 8,225,280 bytes (yes, I lost data that time too).

And yes, I have worked on friends' Intel boxes (THEY ARE NOT BOXEN!!!!!) with 240 heads per cylinder (a couple of P-3 1200 MHz, IIRC).

Thanks for the thread. I'll surf over to the various sites on a good machine.

I am really afraid that (a) some "housekeeping" info was recorded after the partition table was reset, even if I didn't think writing was done outside the partition table or (B) there was an "offset" for DOS compatibility that was not restored correctly, and part of the first FAT copy may be gone. At one point, Linux fdisk complained of approximately "5615 unallocated sectors". Also, Norton Utils 2001 Emergency Disk programs (boot from CD-ROM) said that the FAT was 13 sectors (or clusters) longer or shorter than it was "supposed" to be.

I also found this this MSFN thread which should help me. I'll pay the $69 or whatever for commercial proggies if it's convenient.

Honestly, I like the USB enclosure drives, but I think I'm going to write the partition tables out in hex, on paper, in case this happens again. And burn to DVD-R in case the drives go bad. I don't have to worry about file permissions, I'm the only user (98 / XP / Linux). K3b (linux) is a good burning program, I've used it before, it works.

Thanks again. I've got a lot of work ahead of me.

Edited October 20, 2006 by saturndude

[LLXX]

If the partition's actual contents are intact but the partition table is corrupted, it'll be a very easy fix. I've obtained used drives that the owner had "deleted" the information from by just "deleting" the partition (removing the entry from the partition table). The entire partition can be restored in a few minutes.

Use a disk editor to search for the first occurrence of the string FAT32 over all sectors. Likely the first result you get will be the superblock for the partition. Note the sector offset. Now go back to the partition table and fill in the first entry with this sector offset, also you can get a rough calculation of the size and fill that in too. Set the partition as active and try reading from it again. (Do NOT attempt to write to it). If that doesn't work, maybe you didn't find the real superblock. Repeat the search/edit process until you do.

Reference to the format of partition table entries: http://www.datarescue.com/laboratory/partition.htm

http://en.wikipedia.org/wiki/Master_Boot_Record

[fgaifen]

Use tesdisk, a DOS tool that can recover deleted partitions

hxxp://www.cgsecurity.org/wiki/TestDisk

[saturndude]

Okay, SpinRite 6 didn't appear to do anything. I used Linux fdisk to put one giant FAT32 partition in the table (without formatting!) so SpinRite would know where to look (whole drive, duh! I could have left a blank table in there).

I suspect SpinRite is more geared toward disks with physical platters that are deteriorating magnetically. I say this because it did not rescue anything (SpinRite's level 2 rescue mode).

I could re-run SpinRite with a blank partition table, but I don't think it's going to do anything.

I tried putting in one giant FAT 32 partition with Mandrake 8.0 disk 1. That was the last Linux fdisk that can only knows how to write the "old school" partition table entries (one cylinder = 8,257,536). The 120 GB drive is old enough that the "old school" partition table might have been used at original set-up. No. I'm still looking at about 5165 unallocated sectors. Forgot to check whether partitions ended on cylinder boundaries with "old school" though. Sorry guys.

Acronis Disk Director Demo said there were 5 or 6 possible partitions that could be recovered, some linux and some Windows, anywhere from 650 MB to 2 GB, and one possibly as large as 10 GB. So it's quite possible that both original FATs got overwritten, and maybe some files as well.

Next I am leaning toward using the "GetDataBack" product.

If not, I'll likely have to try Ontrack. They were expensive last time (10 years ago, $1,500, 2.5 Gig Seagate, head crash). If the GetDataBack cannot handle it, I'll do the Ontrack software, and send it in if necessary I guess. I don't like it. I really don't. I'm in-between jobs (seems like 70 percent of my life!) and I just bought a nice camera (Canon S3, no less). Don't worry. I've got a little money coming in.

Perhaps I'll take several unaffected drives and burn documents, spreadsheets, photos, etc. onto DVD-Rs RIGHT NOW (K3B for Linux = just as nice as NeroLinux, IMNSHO -- I've got both). Just like my old Travan-4, backup only works if you use it.

Thank you. I'll keep everybody posted.

P.S. Early this morning, before I resumed work on the 120 Gig, I accidentally blew away partition table entries on a 160 Gigger. Thanks LLXX! After I fix the 120, I can do the 160. If Acronis Demo doesn't help me much, your tutorials will (they're a little overwhelming when my brain is tired from this work).

Edited October 21, 2006 by saturndude

[LLXX]

I used Linux fdisk to put one giant FAT32 partition in the table (without formatting!) so SpinRite would know where to look (whole drive, duh! I could have left a blank table in there).

...

I tried putting in one giant FAT 32 partition with Mandrake 8.0 disk 1. That was the last Linux fdisk that can only knows how to write the "old school" partition table entries (one cylinder = 8,257,536). The 120 GB drive is old enough that the "old school" partition table might have been used at original set-up. No. I'm still looking at about 5165 unallocated sectors. Forgot to check whether partitions ended on cylinder boundaries with "old school" though. Sorry guys.

As I mentioned before, if you don't get the starting sector right you'll get nothing.

Have you managed to locate the partition's superblock with a disk editor?

[DigeratiPrime]

if your going to try software try R-STUDIO

http://www.data-recovery-software.net/

[saturndude]

Thanks for the suggestion of R-studio. I went to their web site, they looked like more of a service-oriented company. Also I did not see this software easily (I know, 'lazy American'. I admit it). Website gave me the impression that the software would be difficult to use (I know, Linux user since July 1998, I should be used to obtuse commands and fetching documentation myself).

I tried the GetDataBack. I'm not sure how many Gigs were lost, but I got 12.4 GB back. I'm satisfied. Everything I remember, including some web pages I saved (newspaper -- man cleared by DNA, etc. -- my heart goes out to those guys) was even saved! Worth the money! (backing up would have been smarter -- I will, believe me).

I got an e-mail from Gibson Research. Yes, they are more geared toward platters that are going bad. I'll ask for a refund in a couple of days (website says 30).

Concerning the other disk (the 160 where I over-wrote the partition table but nothing else was done to it) I have pretty good confidence in the Acronis product. If the demo shows the boundaries but won't restore unless I pay, I'll use GetDataBack. The 160 had some multimedia files (convert VHS --> digital, ATI All In Wonder 9200), where I just want a big, big partition, doesn't exactly matter what size.

You might say "If the election were held today, I'd vote GET DATA BACK".

If anything bad happens, I'll post again. THANKS GUYS !!!

Saturndude

Edited October 22, 2006 by saturndude

[saturndude]

Something I learned about the Acronis Disk Director demo:

If you choose the primary slave drive to "recover partitions" from, it will also search the unused space of the primary master. The partitions between 650 MB and 2 Gigs, and the one possibly up to 10 Gigs that I found earlier were on my primary master. Acronis didn't find anything on that 120 gig USB that was taken out of the enclosure and made into an IDE.

Still more work to do.....

saturndude