exFAT VBR broken

[Spin]

Hi there,

One of my external HD's is formatted to exFAT (it's a WD, 2.5'' 1 TB) because I move files around a lot between Ubuntu, Mac and Windows. It seemed a good choice at the time.

However, apparently Macs 'eat' exFAT bootsectors for breakfast and this recently also happened to mine. By using CGSecurity's fantastic tool Testdisk (http://www.cgsecurity.org/wiki/TestDisk) I was able to find out that the Volume Boot Record has been overwritten with zeroes As always, the files on this HD are important and I have been too lazy to backup everything

Question: Is there a tool (for linux) that can repair exFAT VBR's ? I could obviously download and install the similar fsck_exfat on a Mac, but I was wondering if Ubuntu could fix this for me. I just happen to like Linux better

Thanks, esteemed panel

[fzabkar]

AFAICT, sectors 0 - 11 constitute the Primary VBR while sectors 12 - 23 are the Backup VBR. I have no experience with exFAT, but perhaps the solution may be as simple as using a disc editor to copy the backup sector(s) over the primary ones. Perhaps TestDisk can do this? BTW, it would be advisable to clone your drive first.

Here is one document I found useful:
http://www.sans.org/reading-room/whitep ... stem-33274

[HaQue]

That's a good article, I read it.. well as much as I could, last year. I advise also to checkout the references at the end of the doc and get even more great papers. In fact I do this on most things I read.

Thanks Franc

[Spin]

Thanks fzabkar for your reply ! Truly appreciated

I did as you were told: copied backup over main superblock. Still couldn't acces the drive (not in Linux, nor Mac, nor Win)

I let TestDisk run it again and all of a sudden I could acces the filelist again. I'm now copying everything over to a different external HD and will format this WD afterwards. To another filesystem. No more exFAT for me as long as I have to use Mac...

Thanks again !!

[SOLVED]

[neokao]

Sorry to dig out this old thread. I have a situation similar to this.
I have an external storage with 2 x 2TB ( Stardom 2Bay, JBOD mode ) that was working nicely with my Macmini .

Somehow since last week the disk is not readable anymore. I got the message that " The disk you inserted was not readable by this computer " and it asked to "Initialize", "Ignore" or "" Eject".

OS is the newest El Capitan (10.11.5) and I've tried other enclosure and docking station and all saw the same message.

I also tried multiple computers (MBAs, MB, PC Win 7) and got the same issue.

I then started trying to repair it on OSX Terminal: "diskutil list" showed me the disk is now disk3 without partition.

So I did this first: sudo diskutil verifyVolume /dev/disk3 and I got the error message: " Error starting file system verification for disk3: Unrecognized file system (-69846)" .

Then I used "sudo fsck_exfat -d /dev/disk3".

Now I got the message:

"Opening /dev/rdisk3 ** Checking volume. ** Checking main boot region. fsck_exfat: Invalid jump or signature Main boot region is invalid. Trying alternate boot region. ** Checking alternate boot region. fsck_exfat: Invalid jump or signature Alternate boot region is invalid. ** The volume could not be verified completely."

I then looked into TestDisk in Linux.

http://imgur.com/a/HoWrJ
The picture was taken around 15% but I did complete the analysis.
But it seems like not recoverable.

I am trying to scan it with R-studio for data recovery now and found that the label is 00000000000000000000. The scan is still ongoing since it is doing slowly. But I think this might be related to your post regarding the broken VBR. However I don't understand how you exactly fixed the VBR.

Thanks for your suggestions.