Find the answer to your Linux question:
Results 1 to 7 of 7
Well, I messed up pretty hard today, I didn't notice one of my FAT32 partitions as one of the many listed to be formatted on a Linux install. Uh-oh. Worst ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Linux Newbie SagaciousKJB's Avatar
    Join Date
    Aug 2007
    Location
    Yakima, WA
    Posts
    162

    PEBKAC: Formatted first 16 megs of FAT32 partition


    Well, I messed up pretty hard today, I didn't notice one of my FAT32 partitions as one of the many listed to be formatted on a Linux install. Uh-oh. Worst of all it's not even my drive or data, it's a friend of mine.


    Well, I examined the disk under Linux using "dd" and "hd" ( hex dump ), and I've concluded that I actually only formatted the first 15 megabytes of the FAT32 partition, and the data past that is still in tact. When I run fsck.vfat, I get an error, "Logical sector size is zero," because the first drive was wiped. I found a guide that suggested I could use the sixth sector to backup the first, but the format went well-past sector 6 all the way until sector 32 where the old data is still in tact.

    I'm in the process of backing up the data to an image. I'm going to try to reformat the drive into FAT32, splice the data back into the partition at the 32nd sector, and then run a disk check hoping that the partition can then be repaired around the data. I've never done anything like this, and I'm pretty much at the mercy of whatever I can think to try. I don't know how FAT32 works, but I'm worried that by splicing in about 276 gigabytes of data into a 1 terabyte FAT32 file system, that even then the filesystem would not be reapariable or mountable.


    In any case, this is the situation in brief: I've got a FAT32 partition with the first 16 megabytes ( 32 sectors ) zeroed by a format. The rest of the data is still in tact, and I'm trying to find a way to salvage the data out of the damaged FAT32 file-system.

  2. #2
    Administrator jayd512's Avatar
    Join Date
    Feb 2008
    Location
    Kentucky
    Posts
    5,023
    I've never had to go through that myself, but have you tried something like the System Rescue CD?
    Jay

    New users, read this first.
    New Member FAQ
    Registered Linux User #463940
    I do not respond to private messages asking for Linux help. Please keep it on the public boards.

  3. #3
    Linux User
    Join Date
    Dec 2007
    Location
    Idaho USA
    Posts
    359
    Have fun. Be sure to make the same size of partition. Be sure to copy down the exact sector that you start the back up and restore it to the same sector. (do not back up the zero'd sectors).

    You deleted the volume boot record and its backup but may have deleted the first sectors of FAT1, the good news is its backup (fat2) is still good. After you restore and boot, do NOT run scandisk.. You may need a hdd hex editor program, one can find many for dos,98,xp but I do not know of any for linux. It can be done with linux useing dd and some file hex editor, but it is harder. You may luck out and have no problems.

    The first 16bytes of fat1 likey look like:

    Code:
    F8 FF FF 0F FF FF FF FF F8 FF FF 0F 04 00 00 00

  4. #4
    Linux Newbie SagaciousKJB's Avatar
    Join Date
    Aug 2007
    Location
    Yakima, WA
    Posts
    162
    Quote Originally Posted by Lostfarmer View Post
    Have fun. Be sure to make the same size of partition. Be sure to copy down the exact sector that you start the back up and restore it to the same sector. (do not back up the zero'd sectors).

    You deleted the volume boot record and its backup but may have deleted the first sectors of FAT1, the good news is its backup (fat2) is still good. After you restore and boot, do NOT run scandisk.. You may need a hdd hex editor program, one can find many for dos,98,xp but I do not know of any for linux. It can be done with linux useing dd and some file hex editor, but it is harder. You may luck out and have no problems.

    The first 16bytes of fat1 likey look like:

    Code:
    F8 FF FF 0F FF FF FF FF F8 FF FF 0F 04 00 00 00
    Thank you very much, this info should be very useful. What exactly do I need to do with the hex editor to repair the filesystem without using a scandisk utility ( like fsck or the windows scandsick)?

    I'll update this when I've tried something.

  5. #5
    Linux User
    Join Date
    Dec 2007
    Location
    Idaho USA
    Posts
    359
    The Volume Boot Record (some call it just boot record) is the first sector of the partition. It contains a boot code and very important Bios Parameter Block (BPB) and Extended BIOS Parameter Block (EBPB), it tells the OS the mount information. Read link below for it's info.
    NTFS.com Partition Boot Sector. Master Boot Record. FAT32, FAT16

    If the new partition's BPB info is not exactly the same as the original , scandisk will change files/folders to lost clusters.

    After you splice the data to new partition, I would try mounting with linux to check if all is good, only then would use MS Windows. If under linux the partition does not mount or the Directories are wrong (does not display all files/folders or junk), that is when you might need a hex editor to change BPB values.

  6. #6
    Linux Newbie SagaciousKJB's Avatar
    Join Date
    Aug 2007
    Location
    Yakima, WA
    Posts
    162
    Well, I guess I went from PEBKAC to SEBKAC ( Solution Exists Between Keyboard and Computer ), because my plan worked. At least, preliminary results seem to suggest that. I need to verify all the data; I expect to find some problems near the last sectors, but I left a lot of padding in my image to try to ensure that all the data is written far before something erroneous occurs in the filesystem.

    Now the question is how to back it all up and then reformat the drive, because I'm sure the filesystem is not in good shape with the way I got this to work.

    "F8 FF FF 0F FF FF FF"

    This was at sector 32 for me, so I reformated the drive to FAT32, and then spliced the image into the partition at sector 32. It mounted without any problems, and a good portion of the data so far is verified. Any problems that are bound to occur with this solution?

  7. #7
    Linux User
    Join Date
    Dec 2007
    Location
    Idaho USA
    Posts
    359
    Very likely if you can read the root directory correctly (be sure no entries are missing) and may be one of the other directories , I would say you are good to go with no problems. You lucked out, this time.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •