Repair - File Allocation Table (FAT Repair)

scott

  The FAT file system uses 2 File Allocation Tables (FATs or FAT Tables). The two FAT tables are supposed to remain syncronized. There are occassions when they aren't. This causes problems. Both FATs are located between the boot block(s) and the root directory structure.

Roughly; the FATs keep track of the first cluster a file is assigned to. If the file size exceeds one cluster there is a marker at the end of the first cluster that indicates the location of the next cluster that is used by the file and so on, and so on. In this way the operating system keeps track of all the files on a hard drive. If one of the sequential markers is lost then part of the file is lost. If the FATs are damaged then the operating system can't even begin to locate files. Additionally, certain corruption occurs when two markers point to the same cluster. Like ice-cubes in a tray, there can be only one ice-cube in each division and there can never be two ice-cubes in a single division. Using a hex editor one can locate a FAT by it's signature. The first few bytes of the beginning sector of a FAT begins with F8FF (hex, of course).

FAT Repair - Patching
There are times when the first FAT is corrupt, but the second FAT remains intact. If this is the case then the FAT2 can be copied over FAT1 to replace the first FAT.

First - You'll need a hard drive that is the same size or larger than the one that has failed. We'll call this the "clone drive".

Second - If the drive is exactly the same size as the one that failed you can skip this step. Set your BIOS hard drive setting to match the Cylinders, Heads and Sectors that the failed drive used. LBA mode can be set to Auto. Note: Using autodetect for the drive will not work as the capacity will be too large.

Third - Image the failing drive to the "clone drive". Then remove the original drive from the system.

Fourth - Using a hex editor locate the beginning of the first FAT and the beginning of the second FAT. The number of sectors between the first and second FAT indicate the number of sectors each FAT should occupy. Write down the number of sectors (length of the FAT).

Fifth - Using the hex editor go to the second FAT. Copy from the starting sector of the second FAT to the end (Length of FAT + Starting sector of the second FAT=Total number of Sectors to copy) to a file. Call this "FAT2file".

Sixth - Still using the hex editor go to the first sector of the first FAT. Copy the file "FAT2file" starting at the location of the first sector of the first FAT. Once the copy is complete the content of FAT1 should be identical to FAT2.

You've now manually syncronized the FAT tables. If that was the only thing wrong with the structure, you should be able to start copying data off the "clone drive" to a safe location. Once the data is copied off the "clone drive" you can then wipe the "clone drive" and re-install it normally. Using a patched drive for live data is not recommended.

More FAT Hints
There are times when both FATs can become so corrupt that they need to be completely ignored. In these cases, you need to hope that the starting sector of each file can be properly identified and rebuilt (in memory) by whatever extraction software you choose to use.

I have found that R-Studio does an outstanding job with corrupt FATs. There are times when even R-Studio has problems with excessive corruption and it's simply better to completely remove both FATs to get good results. Using a hex editor, overwriting all the sectors used by both FATs with zeros can help.

lh5399975

是啊。。。不理解
转自中国硬盘基地技术社区 http://bbs.intohard.com ,原文地址：http://bbs.intohard.com/viewthread.php?tid=16751