I have a FAT32 with a missing boot sector but the root directory looks intact in a HEX editor (I can see DCIM and MISC and NCFL items in a HEX editor). It is on an old 8 GB Transcend SD card. I have no other 8 GB Transcend SD card at hand so I can not donate a boot sector from a different one.
My goal is to reconstruct the directory tree so I can get the files with the original names and date/time attributes, which file signature carving (photorec) can't recover. Which tool can do this?
I realize that fragmented files can not be fully recovered this way, but probably most files are unfragmented, especially if this card was written for the first time.
Which tools can recover the file tree from a FAT32 with missing beginning but a known cluster size and intact orphaned directories?
Details and what I've tried:
The FSInfo sector with the "RRaA" signature (normally right after the FAT32 boot sector) is strangely present in the second sector since the beginning of the block device, but I don't know whether it belongs to the original FAT32 that was present on that SD card since the beginning or if it was added later. But the first sector is all zeroes. Not even a 55AA boot sector.
The root directory looks intact and starts at offset 4194304 (which is 2^22). The cluster size must have been 32K (32768 bytes), which I found out because Nikon's NCFL folder is listed in the root directory with cluster 31778 (viewable as hexadecimal in the HEX editor at offset 26 bytes according to [url= https://www.cs.fsu.edu:443/~cop4610t/assignments/project3/spec/fatspec.pdf ]FAT specifications[/url], see DIR_FstClusLO) and the directory that lists the file inside it, "NCCONLST.LST" (8.3 format: NCCONLSTLST), is at offset 1045430272 from the beginning. 1045430272/31778 is near 32768, so that is the most probable cluster size.
I tried reconstructing a FAT32 boot sector with this:
mkfs.fat -s 64 --offset 4160 SD-2.img
"-s 64" means a cluster size of 32768. "--offset 4160" because it seems the original file system started there. Calculated with (128-((1045430272÷32768)-31778-63))*64, given that a root directory of a FAT32 made with mkfs.fat starts at cluster 63.
After that, I tried to attach the root directory from the original file system to my constrcuted file system, at offset 4194304 (8192×512):
dd if=SD.img of=SD-2.img conv=notrunc bs=512 seek=8192 skip=8192 count=10K
Result: the directories are listed but with an I/O error.
$ ls '/mnt/img1'
ls: cannot access '/mnt/img1/NCFL': Input/output error
ls: cannot access '/mnt/img1/DCIM': Input/output error
ls: cannot access '/mnt/img1/MISC': Input/output error
DCIM MISC NCFL
$ ls '/mnt/img1' -l
ls: cannot access '/mnt/img1/NCFL': Input/output error
ls: cannot access '/mnt/img1/DCIM': Input/output error
ls: cannot access '/mnt/img1/MISC': Input/output error
total 5606720
d????????? ? ? ? ? ? DCIM
d????????? ? ? ? ? ? MISC
d????????? ? ? ? ? ? NCFL
-rwxr-xr-x 1 root root 4294967295 Mar 23 04:33 x
-rwxr-xr-x 1 root root 1446309888 Mar 23 04:36 y
(x and y are test files added by me later to see if it would change anything.)
It seems the FAT bitmap would have to be reconstructed manually for this to work, which is futile.