Recovering vfat file system
 

Does anyone have any tips on recovering a vfat filesystem? The problem is with a 32MB usb device. Windows says it hasn't been formatted so my guess is a corrupt FAT table.

I plugged the device into my linux box and executed the following command:
#dd if=/dev/sda of=backup

I now have a 32MB file but not sure what the next course of action is I should take to recover the data.

I guess you can't mount the file (since it's corrupt)?

mount -o loop -t vfat filename somedir/

Regards
Martin

I didn't compile loop support into my kernel:(

Hi again

Haven't tried this myself, just a hint at a direction...
man dosfsck
Since you have made a backup file I suppose that you could try this directly on /dev/sda

Please, let me know if that command really helps.

Good luck!
Martin

I have tried to mount /dev/sda with no success.

On attempting to use dosfsck I got an I/O error on the device - The question is I have managed to copy the entire device file to my local filesystem and it has clearly retireved some data as I did a hexdump of it, but how do I get it back?

Ok. Sorry for this late response. I've been playing around a little with fat file systems and dosfsck. This is (in short) what I did:

o I created a 1MB (1024 blocks) vfat file system as a file:
~> /sbin/mkdosfs -C fatfile 1024

o Then I could mount this in the file system:
~> mount -o loop -t vfat fatfile fatsys/

o Then I could copy some small text files in to the file system. After unmounting I had a 1MB file containing some text files.

o In an attempt to break stuff, I opened the file in an emacs hex-buffer, located the file system table and entered a few random characters ;)

o I could still mount and umount the file system (as above) but the file sizes and names were now corrupted.

o The trick was to run dosfsck on the file and answer the questions correctly:
~> /sbin/dosfsck -r fatfile
Note here that I ran dosfsck on the file, not the mounted file system.

I hope that this helps. Make a few backup copies of your file before running dosfsck on it, since dosfsck asks you questions about how to repair that are non-trivial.

Good luck!
Martin