Unable to mount exFAT after recreating partition / Partition 2 does not start on physical sector boundary.

[Kai Hendry]

Hi guys,

So I have been having issues mounting this exFAT external 1TB USB3 Seagate drive from MacOSX. Using FUSE exfat 1.1.0 I have been mounting it successfully under Archlinux and fsck.exfat has come in handy too after the Mac screws it up.

I was a bit fed up after it failing to mount on MacOSX for the umpteenth time, so I decided to inspect the partition. It should just be one large Exfat partition IIUC.

Instead I saw: http://s.natalian.org/2015-02-13/1423817739_1362x740.png

Which made me delete it and recreate a primary partition of the exfat type. I've done this numerous times with extX, for example when resizing, so I felt confident in doing this.

However after recreating the partition, I'm unable to mount the exfat.

x220:~$ sudo file -s /dev/sdc

/dev/sdc: DOS/MBR boot sector; partition 1 : ID=0x7, start-CHS (0xd,4,2), end-CHS (0x381,37,27), startsector 65535, 1953459632 sectors,

extended partition table (last)

x220:~$ sudo file -s /dev/sdc1

/dev/sdc1: data

I'm a bit of a loss how to fix the partition with fdisk (or is there another tool!?). I fear there is some alignment issue. I have run testdisk hoping that it could detect the boundaries of the exfat data which should be intact. Unfortunately testdisk reports crazy results which much be wrong.

Hope you guys can help me. I tried diskutil on MacOSX and it was hopeless. Exfat tools on Linux have been a much better UX. I don't have a Windows machine. This darn disk has 500GB of my wife's backups.

Many thanks,

[Andrew Nayenko]

Hi Kai,

Try to find the beginning of the exFAT filesystem:

sudo hexdump -C /dev/sdc | grep EXFAT

You'll get something like this:

00020000 eb 76 90 45 58 46 41 54 20 20 20 00 00 00 00 00 |.v.EXFAT .....|
00021800 eb 76 90 45 58 46 41 54 20 20 20 00 00 00 00 00 |.v.EXFAT .....|

You can press Ctrl-C after you see those lines. Here 00020000 is the
beginning of the exFAT filesystem (in hex!). Then use dd to copy the
image of your exFAT filesystem somewhere. After that you should be able
to mount this image using mount.exfat-fuse and extract data.

P.S. OS X disks usually use GUID partition table which is not supported
by fdisk.

--
Andrew Nayenko <res...@gmail.com>

[Kai Hendry]

Hi there Andrew,

I have another exfat formatted 16GB USB stick laying around and I
thought I would experiment before trying to recover the 1TB disk.

First thing that frightened me is that my 16GB USB stick does have two
EXFAT lines unlike my 1TB disk which just had one:
http://s.natalian.org/2015-02-14/1423915949_1362x740.png

So I am worried now that somehow I might have overwritten the first
few bytes of the start of the EXFAT partition on my 1TB disk.


I also managed to dd off the exfat partition of my test USB stick to
exfat-test.img. However I can't seem able to mount it!

sudo mount.exfat /mnt/sdd1/exfat-test.img /mnt/exfatmnt
FUSE exfat 1.1.0
fuse: mount failed: Block device required


If you can recommend some tools on Windows or MacOSX for
repairing/recreating the exfat partition, please let me know!

Many thanks,

[Andrew Nayenko]

> I have another exfat formatted 16GB USB stick laying around and I
> thought I would experiment before trying to recover the 1TB disk.
>
> First thing that frightened me is that my 16GB USB stick does have two
> EXFAT lines unlike my 1TB disk which just had one:
> http://s.natalian.org/2015-02-14/1423915949_1362x740.png

That's OK: exFAT keeps two copies of the superblock.

> I also managed to dd off the exfat partition of my test USB stick to
> exfat-test.img. However I can't seem able to mount it!
>
> sudo mount.exfat /mnt/sdd1/exfat-test.img /mnt/exfatmnt
> FUSE exfat 1.1.0
> fuse: mount failed: Block device required

sudo mount -o loop /mnt/sdd1/exfat-test.img /mnt/exfatmnt

--
Andrew Nayenko <res...@gmail.com>

[Kai Hendry]

Thanks again Andrew,

On Sun, 15 Feb 2015, at 09:44 PM, Andrew Nayenko wrote:
> That's OK: exFAT keeps two copies of the superblock.

Hmm, I was trying to experiment with exfat-test.img with shaving off the
first EXFAT superblock with vim, but vim seems to want to load the
ENTIRE file in memory. Argh!

What tools do I use to edit out the first line, i.e. upto 00001800?

$ hexdump -C /mnt/m3/exfat-test.img | grep EXFAT
00000000 eb 76 90 45 58 46 41 54 20 20 20 00 00 00 00 00 |.v.EXFAT
.....|
00001800 eb 76 90 45 58 46 41 54 20 20 20 00 00 00 00 00 |.v.EXFAT
.....|
^C

> > I also managed to dd off the exfat partition of my test USB stick to
> > exfat-test.img. However I can't seem able to mount it!
> > sudo mount.exfat /mnt/sdd1/exfat-test.img /mnt/exfatmnt
> > FUSE exfat 1.1.0
> > fuse: mount failed: Block device required
> sudo mount -o loop /mnt/sdd1/exfat-test.img /mnt/exfatmnt

Great, that indeed works. =)


But I still struggling to understand how I dd the 1TB from the hex
00001c00. What dd invocation do I use to start at 00001c00?

$ sudo hexdump -C /dev/sdd | grep EXFAT
00001c00 eb 76 90 45 58 46 41 54 20 20 20 00 00 00 00 00 |.v.EXFAT
.....|
^C


I want to try make sure this works with a small USB 16GB stick before I
try recover the 500+GB. I think this will take a VERY long time since I
only have one USB3 port on my X220. Not to mention I worryingly got a
Buffer I/O error on device sdc1, sdc1 being my new M3 drive:
http://ix.io/gkJ

I guess dd is too dumb to be able to resume if something happens. I
can't reproduce the above issue, but my general feeling that I/O on my
USB ports are a tad unstable and CPU intensive. :/

Thanks very much in advance for the tips!

[Andrew Nayenko]

Hi Kai,

I've made a patch to fuse-exfat that can help you save a lot of time.
See https://code.google.com/p/exfat/wiki/HOWTO on how to build fuse-exfat.
Before running scons you'll need to apply the attached patch:
patch -p0 < path/to/exfat-scan.patch
This patch adds "scan" option that will make fuse-exfat search for the
superblock and try to mount the file system according to the detected
offset:
sudo fuse/mount.fuse-exfat -o ro,scan=2048 /dev/sdd /mnt/exfatmnt
Note that you should specify the whole device (in this example sdd,
not sdd1). Read-only mode is strongly recommended since I didn't test
the patch much.

--
Andrew Nayenko <res...@gmail.com>

[Kai Hendry]

Thank you for your patch Andrew!

I tested it on my test 16GB exfat USB stick. That was fine. :)

But the USB3 1TB disk that I'm trying to recover failed with:

$ sudo /usr/bin/mount.exfat-fuse -o ro,scan=2048 /dev/sdc /mnt/exfatmnt
FUSE exfat 1.1.0
WARN: found exFAT file system at 0x1c00.
ERROR: file system is larger than underlying device: 1000204884480 >
1000204878336.



I am hoping the error is a result of the partition being a bit screwed
and it should be ignored? But how?

Many many thanks!

[Andrew Nayenko]

I think this means that the 1st copy of the superblock has been
overwritten while fuse-exfat managed to find the 2nd copy. Please try
the updated patch. Revert the previous one (svn revert -R .) before
applying the new patch.

--
Andrew Nayenko <res...@gmail.com>

[Kai Hendry]

Yess!!! It works. Now I need to move 500GB over to a more reliable EXT
disk. Maybe. :)
https://bbs.archlinux.org/viewtopic.php?pid=1503189

I'm a bit confused by partition types. I wonder how it got b0rked to
begin with. My tact is to avoid dealing with MacOSX and it's limited
filesystem support from now on.

Thank you!!