PDA

View Full Version : Lost FAT



theutmost
12-08-2002, 10:18 PM
Hi all.
Anyone with ideas on how to get back a lost FAT?
I exited from a WIN2K setup (on a Win98 drive) , and when I came out - the FAT was gone.
FDISK /mbr was suggested, but that didn't help.
Under FDISK, the partition is displayed as "unkown" file system.
ANyone know of useful utilities for recreating a FAT?
WHat do forensics do?

Cheers,
TU

robsonde
12-08-2002, 10:47 PM
a friend had same problem and used "lost and found"

worked well cost lots :-)

njonez
12-08-2002, 10:55 PM
lost+found you always try a trail prog if they have one(do they???)

godfather
12-08-2002, 11:00 PM
Lost & Found is now a discontinued product.

I really think that you are in for an expensive time to recover the data, any FAT recreation is going to be complex, examining all files on the drive, deciding start and end locations and assigning a "name" that will not bear any resemblence to the original filename (as that was lost in the FAT) in my understanding....but I hope I am wrong.
I can see a format and re-install looming.

njonez
12-08-2002, 11:16 PM
well my experience with FAT is not good at all i've lost the fat and now i have linux but i still have 10 GB in that dreaded FAT and i've had to do complete formating+reinstall of Win98 a couple of times cos it wouldn't boot up. if FAT comes back i reacokon that's the end of Microsoft(lol).

All i can say while your at it(formating etc)might be good idea to lose the FAT completely and get NTFS(can't access through standard DOS)


godfather - dosn't the filename prob only happen if the allocation table is mucked up???

godfather
12-08-2002, 11:20 PM
Yes

FAT = File Allocation Table

Thats what I thought was "mucked up" here

godfather
12-08-2002, 11:24 PM
And windows 98 does not read NTFS and cannot boot from NTFS

Heather P
12-08-2002, 11:25 PM
It probably won't work but...

Go to work and create a system disk for Win 2K. Bring it home and boot with that. Also try scandisk off a floppy.

If that doesn't work my next (probably non-working) suggestion would be to try installing Win 2K again and install it into a new directory such as "win2k"

njonez
12-08-2002, 11:32 PM
opps! sorry forgot to add windows to my comment that's what i actully meant. you could buy partion magic(couple of hundred+) or go back to win 2000 :(

theutmost
13-08-2002, 11:16 AM
Thanks folks for your help :)

Godfather - Yeah, a format/reinstall is looking likely. I wanted some of the files off the drive first though... The FAT is not so much mucked up here as "missing". There is no valid FAT of ANY type. FAT32 or NTFS.

Njonez - yeah, I may well go to WIn2K, but I wanted to first:
1) Recover a few files.
2) Format the HDD to remove the messy WIn98 registry (I like to do it once every 6 months or so)
3) THEN reinstall WIndows - possibly 2K.

Heather P - I don't think the Win2K sys disk will be able to help me. Since there is no valid FAT of any type, I need a low level tool that can recreate it. I think the first thing the Win2K installer will do if I run it again, is tell me that there is no valid file system, and merrily go and format my HDD. Then my files really WILL be gone.

I have found a couple of tools on the web which I will try.
I will let you guys know how I get on after tonight.
Cheers,

tU

Heather P
13-08-2002, 11:32 AM
Have you tried scandisk off a floppy?

Graham L
13-08-2002, 12:03 PM
Nothing you can do will save/recreate the FAT. The very expensive data recovery companies charge a lot because what they do is very difficult.

File Allocation Table. That describes what it does. It is a table which has an entry for every cluster on the "disk" (partition or whole disk). When a file is written, a temporary entry is made in the disk directory, and the file is written to the first free cluster. In the FAT each free cluster entry is a pointer to the next free cluster. At the end of file, a marker is written to indicate EOF in the FAT, and the directory entry is tidied up, and size etc put in. There is an entry for the first cluster of the file. That is your only hope.


Nortons Utility *might* be able to get some files. If the directories are still intact, you *might* be able to do "absolute" sector addressing and pick out files, using the starting cluster and size as guides. If the files aren't fragmented, and you are very lucky ...

Another method with NU is to search for known strings in files ...

Or, with the disk installed on a Linux system, you could use dd to do this picking off.

But a lost FAT is Very Bad News. MS put two copies of the FAT on the disk, but they never got it right --- if one copy was corrupted, the other one was corrupted too, and if you lose one ...

Terry Porritt
13-08-2002, 12:21 PM
Unfortunately as Graham said it's now too late to recover the FAT.

There is a utility however, Save the Boot, Fat, Partition, a 3 in one package, that would probably have enabled you to have restored the FAT if you had previously 'Saved the Fat'.

I havent used it for yonks but it was a piece of insurance at the time, maybe I will resurrect it.
You can get it at:
http://www.simtel.net/pub/pd/28434.html

Terry Porritt
13-08-2002, 01:08 PM
Hmm... I think the reason I laid the above utility to rest was that it doesnt work with FAT32 :(
So that's no use either.

Terry Porritt
13-08-2002, 03:07 PM
Ok then, after a bit of digging here is a utility package for saving FAT32, Bootsector and MBR.

It's too late now for you 'theutmost', sorry about that, but it could be useful for those who like to play, or are just living in fear of losing their fat :)

The package is SRCTools and was written to replace the STFBP dos fat16 utility mentioned above.

You can get it from:
http://dos.li5.org/downloads/rec.htm

I have tested out the save switches in each of the 3 utils on Win98 OS, and they appear to work ok. I was too chicken to test the Restore switches, but after all you would only use these if in dire straits.

The bootsector and mbr files will fit on a floppy, but the fat32 file is much too big and would need to be saved to another hard drive.

Have fun.

antmannz
13-08-2002, 04:33 PM
Try using Drive Rescue (http://home.arcor.de/christian_grau/rescue/). I can't say that I've used it to recover a FAT (although that is one of it's features),but it's mighty handy for recovering deleted files.

Merlin
13-08-2002, 06:39 PM
Recovery from an accidently deleted FAT 32 drive is covered in the knowledgebase of MS

Failing that, data recovery is the next option following by repartitioning, formating and installation.

The cause of the problem is less likely to be a problem caused by the setup of 2k and more likey to be a problem with either a physical drive defect or a corrupt boot record (either 1st or 2nd FAT). Other contributing factors could be references to earlier boot managers or a boot sector virus.
In any case checking of the drive for physical defects followed by a check of the first 120 - 150 sectors would be advisable.

All of the above should be done after data recovery.



Btw - NTFS does not use FAT and dynamic disk indexes are different to basic disk indexes.