recover data from damaged msdos fat32 partition

[Fbsd1]

I know i can mount fat32 partition using mount_msdos command. But my
msdos fat32 partition is a bad disk with corrupted fat table.

Question is can i use freebsd to recover data from this msdos fAT32 disk????

What tools do you suggest to use?

[Jeff Laine]

Post by Fbsd1
I know i can mount fat32 partition using mount_msdos command. But my
msdos fat32 partition is a bad disk with corrupted fat table.
Question is can i use freebsd to recover data from this msdos fAT32 disk????
What tools do you suggest to use?

I believe it's a job for fsck_msdosfs(8)

[michael]

Post by Jeff Laine

Post by Fbsd1
I know i can mount fat32 partition using mount_msdos command. But my
msdos fat32 partition is a bad disk with corrupted fat table.
Question is can i use freebsd to recover data from this msdos fAT32 disk????
What tools do you suggest to use?

I believe it's a job for fsck_msdosfs(8)

google "foremost"

[Polytropon]

Post by Fbsd1
I know i can mount fat32 partition using mount_msdos command. But my
msdos fat32 partition is a bad disk with corrupted fat table.
Question is can i use freebsd to recover data from this msdos fAT32 disk????

Oh yes, you can! As a side product of my attempt to restore data
from an UFS partition with orphaned inodes, I found some good
utilities that might be helpful fo you.

Post by Fbsd1
What tools do you suggest to use?

Check 'em out!

System:
dd
fsck_ffs
clri
fsdb
fetch -rR <device>
recoverdisk

Ports:
ddrescue
dd_rescue
ffs2recov
magicrescue
testdisk
The Sleuth Kit:
fls
dls
ils
autopsy
scan_ffs
recoverjpeg
fatback

Especially magicrescue can do wonders. If everything fails,
The Sleuth Kit is a good tool.

Don't forget to try mtools.

[Fbsd1]

Post by Polytropon

Post by Fbsd1
I know i can mount fat32 partition using mount_msdos command. But my
msdos fat32 partition is a bad disk with corrupted fat table.
Question is can i use freebsd to recover data from this msdos fAT32 disk????

Oh yes, you can! As a side product of my attempt to restore data
from an UFS partition with orphaned inodes, I found some good
utilities that might be helpful fo you.

Post by Fbsd1
What tools do you suggest to use?

Check 'em out!
dd
fsck_ffs
clri
fsdb
fetch -rR <device>
recoverdisk
ddrescue
dd_rescue
ffs2recov
magicrescue
testdisk
fls
dls
ils
autopsy
scan_ffs
recoverjpeg
fatback
Especially magicrescue can do wonders. If everything fails,
The Sleuth Kit is a good tool.
Don't forget to try mtools.

I have installed these ports

autopsy
dd_rescue
ddrescue
fatback
formost
sleuthkit

If my understanding of reading their documentation is correct, they all
need a empty disk to copy the bad disk sectors to in sequence.
Is this a correct understanding?

msdos fat32 file system has a backup fat table as stated in the docs. Do
any of the sectors rescue programs read the backup fat table?

Not interested in the XP system or programs directors. Just want user
data files created by adobe pagemaker. Dont know what the file extension
is for sure or if there are any way to ID the file from internal
content. Best guess I have on file extension is .cv5 Do not have a file
to examen.

What are the general steps I need to do to recover data from this msdos
FAT32 disk with corrupted fat table and maybe corrupted data?

[Polytropon]

Post by Fbsd1
I have installed these ports
autopsy
dd_rescue
ddrescue
fatback
formost
sleuthkit
If my understanding of reading their documentation is correct, they all
need a empty disk to copy the bad disk sectors to in sequence.
Is this a correct understanding?

It is. These tools work in a non-destructive way, this means
their (eventually failing) attempts to recover data do not do
any damage to the original (defective) disk. The defective
disk isn't repaired, that would be too dangerous to try.

I would even mention to first make a 1:1 dd copy of the defective
FAT partition and using those tools with the copy, not with the
original.

Post by Fbsd1
msdos fat32 file system has a backup fat table as stated in the docs. Do
any of the sectors rescue programs read the backup fat table?

dd_rescue - No, does simply copy the partition 1:1.
ddrescue - The same.
sleuthkit - Usually work on a lower level.
formost - Works on a lower level and extracts data files by magic.
autopsy - Offers a "server" for forensic browsing.
fatback - Kind of "undelete tool", no.

The TSK's tools dls, fls and ils don't seem to offer the option
in question.

I read about using alternate superblocks, but that refers to the
UFS file system and not the 2nd FAT. Maybe it's possible to
exactly locate and extract this backup FAT first and then replace
the defective FAT with this copy, using tools like dd?

Post by Fbsd1
Not interested in the XP system or programs directors. Just want user
data files created by adobe pagemaker. Dont know what the file extension
is for sure or if there are any way to ID the file from internal
content. Best guess I have on file extension is .cv5 Do not have a file
to examen.

The recovery utilities that act by magic aren't interested in the
file name extension. From the manuals of the programs listed above
that mention such a functionality, there's no word about "Adobe
Pagemaker". Would it have been generic files (such as JPG files
for images, TeX / text files for text), or some kind of ODF archive,
it would be much easier.

Post by Fbsd1
What are the general steps I need to do to recover data from this msdos
FAT32 disk with corrupted fat table and maybe corrupted data?

First, copy the partition:

% ddrescue /dev/ad0s2 fat.dd

I'm not sure how the msdosfs formatted disk / the FAT partition
will show up as device file in FreeBSD. In the result, you can
unplug the disk / remove it and only work with the copy.

Then, you can start extracting data from it, for example with

% mkdir retrieve
% foremost -i fat.dd -v -o retrieve -t all

The manpage of foremost has some examples, too.

The manpage of fatback isn't great, "info fatback" has more
details.

For TSK, use something like this:

% dls -t raw -f fat -v fat.dd

I've got no FAT partitions (defective or intact) at hand so I
cannot check if this really works as I think it should. :-)