Login or Register to Ask a Question and Join Our Community


Hardware

SATA drive FAT recover

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Special Forums Hardware SATA drive FAT recover
# 8  
Old 02-21-2011
You've rendered your system unbootable, you need some sort of boot CD. Gentoo, Knoppix, DSL, it doesn't matter so much what but you have to boot something because your boot sector was wiped hence cannot boot.
Last edited by Corona688; 02-21-2011 at 10:14 PM..
# 9  
Old 03-16-2011
Thank you for all your information.

Today I have time to generate KNOPPIX usb flash based linux system. I boot the system using the flash based KNOPPIX linux. I use the command to scan the whole disk (160G) for backup.img file:

grep -i -a -B10 -a100 'backup.img' /dev/sda > sdc1/myRecovertFile.txt

I am now waiting for the result. If I am luck, I may find the backup.img file and recover the FAT for /dev/sda... Crossing my finger...

After several minutes, the command stop with info:

grep: /dev/sda: Cannot allocate memory

and generate binary file myRecoveryFile.txt with size 500303...
Last edited by sinnud; 03-16-2011 at 02:32 AM..
# 10  
Old 03-16-2011
That's not how grep works... or how FAT works, for that matter... The name and the contents are never in the same place.

You'd be better off looking for the string "FAT16" or "FAT32" in the drive with a hex editor. That'll help you find where the FAT partition begins.

---------- Post updated at 11:36 PM ---------- Previous update was at 11:30 PM ----------

Here's what my FAT32 USB drive looks like:

Code:
$ sudo dd if=/dev/sdc | hexdump -C | head -n 40
00000000  fa be 00 7c bf 00 7a b9  00 01 fc 0e 1f 0e 07 f3  |...|..z.........|
00000010  a5 ea 16 7a 00 00 bb be  7b 33 c9 80 3f 80 75 06  |...z....{3..?.u.|
00000020  fe c5 8b f3 eb 07 80 3f  00 75 02 fe c1 83 c3 10  |.......?.u......|
00000030  81 fb fe 7b 72 e5 83 f9  04 74 0b 81 f9 03 01 74  |...{r....t.....t|
00000040  0a bb a5 7a eb 2c bb 87  7a eb 27 8b 4c 02 8b 14  |...z.,..z.'.L...|
00000050  b8 01 02 bb 00 7c cd 13  73 05 bb bc 7a eb 13 2e  |.....|..s...z...|
00000060  a1 fe 7d 3d 55 aa 74 05  bb bc 7a eb 05 ea 00 7c  |..}=U.t...z....||
00000070  00 00 2e 8a 07 3c 00 74  0c 53 bb 07 00 b4 0e cd  |.....<.t.S......|
00000080  10 5b 43 eb ed eb fe 4e  6f 20 62 6f 6f 74 61 62  |.[C....No bootab|
00000090  6c 65 20 70 61 72 74 69  74 6f 6e 20 69 6e 20 74  |le partiton in t|
000000a0  61 62 6c 65 00 49 6e 76  61 6c 69 64 20 50 61 72  |able.Invalid Par|
000000b0  74 69 74 6f 6e 20 74 61  62 6c 65 00 49 6e 76 61  |titon table.Inva|
000000c0  6c 69 64 20 6f 72 20 64  61 6d 61 67 65 64 20 42  |lid or damaged B|
000000d0  6f 6f 74 61 62 6c 65 20  70 61 72 74 69 74 69 6f  |ootable partitio|
000000e0  6e 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |n...............|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001b0  00 00 00 00 00 00 00 00  f4 f1 10 f0 00 00 00 01  |................|
000001c0  0c 0f 0c 04 e0 a0 80 1f  00 00 80 40 ef 00 00 00  |...........@....|
000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa  |..............U.|
00000200  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000210  55 53 42 20 54 65 73 74  65 72 20 32 30 30 38 2d  |USB Tester 2008-|
00000220  31 30 2d 33 30 20 31 2e  30 30 20 35 62 00 00 00  |10-30 1.00 5b...|
00000230  32 30 30 38 2f 31 31 2f  32 35 00 00 00 00 00 00  |2008/11/25......|
00000240  31 32 3a 33 33 3a 34 37  00 00 00 00 00 00 00 00  |12:33:47........|
00000250  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
003f0000  eb 58 90 29 5e 76 56 4b  49 48 43 00 02 08 90 08  |.X.)^vVKIHC.....|
003f0010  02 00 00 00 00 f8 00 00  20 00 10 00 80 1f 00 00  |........ .......|
003f0020  80 40 ef 00 b8 3b 00 00  00 00 00 00 02 00 00 00  |.@...;..........|
003f0030  01 00 08 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
003f0040  00 01 29 53 6a af d5 20  20 20 20 20 20 20 20 20  |..)Sj..         |
003f0050  20 20 46 41 54 33 32 20  20 20 fa 33 c9 8e d1 bc  |  FAT32   .3....|
003f0060  f8 7b 8e c1 bd 78 00 c5  76 00 1e 56 16 55 bf 22  |.{...x..v..V.U."|
003f0070  05 89 7e 00 89 4e 02 b1  0b fc f3 a4 8e d9 bd 00  |..~..N..........|
003f0080  7c c6 45 fe 0f 8b 46 18  88 45 f9 38 4e 40 7d 25  ||.E...F..E.8N@}%|
003f0090  8b c1 99 bb 00 07 e8 97  00 72 1a 83 eb 3a 66 a1  |.........r...:f.|
003f00a0  1c 7c 66 3b 07 8a 57 fc  75 06 80 ca 02 88 56 02  |.|f;..W.u.....V.|
$ sudo dd if=/dev/sdc1 | hexdump -C | head
00000000  eb 58 90 29 5e 76 56 4b  49 48 43 00 02 08 90 08  |.X.)^vVKIHC.....|
00000010  02 00 00 00 00 f8 00 00  20 00 10 00 80 1f 00 00  |........ .......|
00000020  80 40 ef 00 b8 3b 00 00  00 00 00 00 02 00 00 00  |.@...;..........|
00000030  01 00 08 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 01 29 53 6a af d5 20  20 20 20 20 20 20 20 20  |..)Sj..         |
00000050  20 20 46 41 54 33 32 20  20 20 fa 33 c9 8e d1 bc  |  FAT32   .3....|
00000060  f8 7b 8e c1 bd 78 00 c5  76 00 1e 56 16 55 bf 22  |.{...x..v..V.U."|
00000070  05 89 7e 00 89 4e 02 b1  0b fc f3 a4 8e d9 bd 00  |..~..N..........|
00000080  7c c6 45 fe 0f 8b 46 18  88 45 f9 38 4e 40 7d 25  ||.E...F..E.8N@}%|
00000090  8b c1 99 bb 00 07 e8 97  00 72 1a 83 eb 3a 66 a1  |.........r...:f.|

...so you can see my FAT32 partition begins at offset 003f0000. The partition table this translates to:
Code:
$ sudo /sbin/fdisk -ul /dev/sdc

Disk /dev/sdc: 8032 MB, 8032092160 bytes
5 heads, 32 sectors/track, 98048 cylinders, total 15687680 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xf010f1f4

   Device Boot      Start         End      Blocks   Id  System
/dev/sdc1            8064    15687679     7839808    c  W95 FAT32 (LBA)
$

---------- Post updated at 11:37 PM ---------- Previous update was at 11:36 PM ----------

That start number is related:

Code:
$ printf "%x\n" $((8064*512))
3f0000
$ echo "$((0x3f0000/512))
8064
$

---------- Post updated at 11:49 PM ---------- Previous update was at 11:37 PM ----------

Then, if you know the offset of your vfat partition you can (as a special -o loop trick) mount part of a disk, letting you get at it without altering your partition table!

Code:
$ mount -t vfat -o loop,ro,offset=$((0x3f0000)) /dev/sdc /mnt/gentoo
ls /mnt/gentoo
BOOTEX.LOG                                montg.iaf
...
$

# 11  
Old 03-16-2011
Thank you for your example. It looks there exist chance that I can find the backup.img file content if I understand the file storage methodology...

The file was stored in ext3 partition of /dev/sda. Even the FAT lost, I remember that, the first primary partition is ACER hidden recovery partition, the second primary partition is the C: drive, about 20G. The third partition is extention partition with several logical partitions. I remember I have NTFS data drive about 80G, NTFS paging partition about 10G, linux root partition about 10G, swap about 1G, one data partition for vmware, and one data partition for my personal data. The backup.img file should be under the root partition...

---------- Post updated at 11:01 PM ---------- Previous update was at 10:50 PM ----------

First, the output of
Code:
fdisk -l /dev/sda

is
Code:
Disk /dev/sda: 160.0 GB, 160041885696 bytes
255 heads, 63 sectors/track, 19457 cylinders
Units = cylinders of 16065 * 512  = 8225280 bytes

Disk /dev/sda doesn't contain a valid partition table

The last line is what I expect...
# 12  
Old 03-16-2011
Gnnngh, that makes it a lot harder. There's no easy string to hunt for for ext3. I've compared dumps of three ext3 partitions and they have nearly nothing in common.

---------- Post updated at 12:55 AM ---------- Previous update was at 12:16 AM ----------

There's still the shotgun approach though. Try every possible partition starting location (cylinder). There's only a few thousand. But I can't figure out how to translate cylinders into sectors; there seems to be no rational pattern. It certainly doesn't seem to follow the 16065 units it illustrates when you list with fdisk -ul so I don't know how to generate them in a loop to try with that mount command. Maybe someone here does?
This User Gave Thanks to Corona688 For This Post:
sinnud
# 13  
Old 03-17-2011
I just found that, the GNU software TestDisk may help me to find partitions. And it was said belong to KNOPPIX linux distribution. I will try it tonight...

---------- Post updated at 10:41 PM ---------- Previous update was at 03:39 PM ----------

Log of using testdisk

1. reboot system using KNOPPIX.
2. link NTFS lib:
Code:
ln -s /usr/lib/libntfs.so.10.0.0 /usr/lib/libntfs.so.9

3. run testdisk
Code:
testdisk /dev/sda

4. Choose the disk, [Proceed]
5. Choose [Intel ]
6. Choose [Analyse ]
Code:
Partition sector doesn't have the endmark 0xAA55

which is expected...
7. choose [Proceed ]
8. Less than 3 second, TestDisk found my all partitions (not include extended partition, but include all logical partition). Hit ENTER.
9. Choose [Write ]
10. Hit [Y].
11. Choose [OK].
12. Choose [Quit ], and [Quit ].
13. reboot system.
Last edited by sinnud; 03-17-2011 at 01:40 PM..
# 14  
Old 03-17-2011
Smilie

I'll have to remember that tool.
Login or Register to Ask a Question

Previous Thread | Next Thread

8 More Discussions You Might Find Interesting

1. Hardware

Hitachi SATA hard disk drive password locked

Hi everyone (see attachments) I bought an HP Elitebook 8460p on eBay and it came with a password-locked Hitachi hard drive which I was told is the original hard drive. I don't know the password for the drive and running the diagnostics tools I see the hard drive is healthy. I tried booting... (9 Replies)
Discussion started by: milhan
9 Replies

2. UNIX for Dummies Questions & Answers

Reading QNX created FAT ZIP drive in WIndows 7

Hi All, One of our clients has an old QNX server system that writes history backups on ZIP disks. They then wish to take these back up ZIP disks, plug them into a Win7 box with an external ZIP drive and copy them across to an external Hard Drive. The files can be seen on the Win7 box but wont... (3 Replies)
Discussion started by: Beldanan
3 Replies

3. UNIX for Advanced & Expert Users

Strange FAT filesystem

My Garmin GPS device has a slot for an SD card. I'm using a 32 GB SD card which holds 22 GB data currently. If I attach my device to a USB port it shows two devices, the internal memory and the SD card. I have no problems with the internal memory which holds only 2 GB of data. I can mount... (2 Replies)
Discussion started by: HJarausch
2 Replies

4. Hardware

Question on SATA 300 vs SATA 600

I have an upgrade path in mind for a new computer that will be stocked with a 2TB SATA 300 hard disk. This is a choice based on information that SATA 300 is not necessarily faster than SATA 600. The upgrade path in a year time or so would then involve the purchase of an SSD that would contain the... (4 Replies)
Discussion started by: figaro
4 Replies

5. Solaris

Cannot recover OS hard drive from a set of snapshots

I have installed Solaris 11 Express on my computer and set up a script to make daily snapshots of all filesystems and send them to a backup disc. Now I'm trying to replace the system disc using a set of captured snapshots. I have found an article on that topic on the internet and have been... (6 Replies)
Discussion started by: RychnD
6 Replies

6. Hardware

Connect SATA Laptop HardDrive to Desktop SATA Slots

Hello everybody, I need to connect a laptop 2.5 SATA hard drive to a Desktop board (which uses 3.5' SATA hard drives). I've tried the connectors and they fit excellent in the 2.5 SATA connectors. The problem is that the laptop hard drive uses 5v and the PC's power source sends 12v. So, my... (4 Replies)
Discussion started by: Zykl0n-B
4 Replies

7. UNIX for Advanced & Expert Users

trying to setup a sata drive using a sata to scsi adaptor

trying to setup a sata drive using a sata to scsi adaptor I have a sata 1TB Deskstar that I had setup before and during shipment from a facilty to another, the disk failed. The handling was not great, lots of throwing boxes, etc. I have a new disk from Hitachi (thankyou Hitachi) anyway, I don't... (1 Reply)
Discussion started by: mndavies
1 Replies

8. Filesystems, Disks and Memory

The best partitioning schem for a 250GB Sata hard drive & a 75GB SCSI hard drive

Hi I have 2 75GB SCSI hard drives and 2 250GB SATA hard drives which are using RAID Level 1 respectively. I wana have both FTP and Apache installed on them as services. I'm wondering what's the best partitioning schem? I wana use FC3 as my OS, so, I thought I can use the 75GB hard drive as the /... (0 Replies)
Discussion started by: sirbijan
0 Replies
Login or Register to Ask a Question