File system lost or corrupted [solved]

[jboy]

Suddenly, an FAT16 file system has got lost or corrupted. The partition table is ok, the partition data shows correctly in fdisk and qparted, but the file system now shows as "unknown" and cannot be mounted. Strangely, fdisk still shows the file system as FAT16 but dmesg shows a "can't find a valid FAT filesystem" error when I try to mount it. The file system ID also shows correctly in fdisk, as type 6, an FAT16 file system.

 

I was able to recover some files off it using magicrescue (a great little utility). Magicrescue apparently reads the device in raw mode and can find and recover some common file types.

 

But can anyone suggest how to recover the FAT16 file system itself?

 

Fdisk and gparted can't be used for this purpose. Obviously the data is still there, but something has got borked where the file system is no longer recognizable for mounting.

 

 

[moved from Software by spinynorman]

Edited November 28, 2006 by jboy

[tyme]

You're pretty well screwed if you can't mount it - because fat isn't journalized - so let's see if we can get it mounted. What type of hard drive is it? Try going to their website, most of them have a diagnostic tool that can check for bad sectors and things of that sort. Try running that as identifying bad sectors may help it become mountable again...

[jboy]

It's an old Quantum Fireball (now supported by Maxtor) that I'm trying to recover for a friend. It passed all the Maxtor PowerMax diagnostic tests, so apparently the problem is not due to a bad sector. Windows can't access it either (Windows says it's unformatted).

 

I also get the following error message when trying to mount it: "FAT : invalid media value ( 0x00 )". Does this mean anything to anybody? A google search didn't turn up anything useful.

[pmpatrick]

How big is the partition? If you have the room on your hard drive you can use the dd command to create an image file of the partition in linux:

 

# dd if=/dev/hd** of=fat16.img

 

where "hd**" corresponds to the device file for the relevant partition. This will create a file in your current directory called "fat16.img" that is the image of your damaged fat16 partition. dd works at a very low level and will give a sector by sector copy of the partition even if the filesystem is corrupted. You can then try and mount fat16.img using the loop device method:

 

# mkdir /mnt/test

# mount -o loop fat16.img /mnt/test

 

See if the command goes without error(unlikely). If it does, you should be able to read the contents of the image file at the mount point, /mnt/test. If not, you have a good backup of your original partition and can be a little freer in trying to recover your data.

[jboy]

Standard 2gb FAT16 partition. I created the .img file with the dd command, but I get the same error messages when trying to mount it using the loop device method.

 

I'll be trying some more magicrescue runs to see if it can extract some additional file types and when I get more time, I'll poke around the .img file with a hex editor to see if I can spot anything amiss (file allocation table?, etc). This could be a nice little lab exercise in trying out various data rescue techniques as I learn about them.

 

EDIT: a dosfsck on the partition gives this message: "Logical sector size (590 bytes) is not a multiple of the physical sector size." So something has changed the logical sector size (a virus?). I'll do some further research on this to see if I can somehow edit the logical sector size value to see if that is causing the problem.

Edited November 28, 2006 by jboy

[pmpatrick]

I think you are better off using windows tools to try and repair a corrupted FAT16 partition or recover your data. Did you try running chkdsk on the partition:

 

http://en.wikipedia.org/wiki/CHKDSK

 

Here are two free file recovery programs:

 

http://www.pcinspector.de/download.asp?lan...1#file_recovery

 

http://www.recovermyfiles.com/

 

I've used PC Inspector in the past with some success.

[jboy]

I couldn't run chkdsk on the partition because Windows thinks it's unformatted. Both PCInspector and RecoverMyFiles found and could recover some files (zip, jpg, text, office and a few others), though about the same as magicrescue could do. RecoverMyFiles did better than PCInspector but you have to buy it in order to save the files and since I'm doing this as a favor to a friend, I'm not gonna pay for the privilege. :D

 

This is a great learning experience on file recovery, though! Although I wasn't able to restore the file system intact (yet), I was able to get a lot of files off the unrecognized partition.

 

Thanks to pmpatrick and tyme (two of the many great good guys of MUB) for their helpful suggestions.

[pmpatrick]

Just saw this article today mentioning a couple open source file recovery tools you might want to try, TestDisk and PhotoRec:

 

http://www.serverwatch.com/tutorials/article.php/3645886

 

Apparently their included in knoppix. You may want to give them a try.