VFAT FileSystem corrupted by CIH!!! Help ( Expert Only )

VFAT FileSystem corrupted by CIH!!! Help ( Expert Only )

Post by Joachim Feis » Wed, 28 Apr 1999 04:00:00

>  My company PC with M$ OS was infected by CIH virus on 26th, I still trying
>  to recover all those harddisk which lossing partition.

First, you have to expect this when running Windoze.


>  I successfully recover a harddisk which 3 partitions with using fdisk (
> linux )  & ndd ( norton ) and get back the 3 partitions. but problem was
> happen on the  first partition which have been recovered, I can see the
> directories and files  inside this partition, and I try to copy all this
> files to other partition or  floppy, I will get the all the files with
> 32,768k in size ( all the files with  less than 32,768k was fine ), I did try
> using linux to copy ( cp ), the error  " input/output error " appear.

>  Firstly, I recover partition 2 & 3 with ndd or ndd /rebuild, and that time I
>  couldn't get the first partition until I using linux fdisk to force created
>  and new "dos >=32M" partition then I managed to recover it by using ndd to
>  corrected the partition, but then the problem I mension above happen.

>  Anybody, know how can it be recover ? because it really important for us.

Second, if you got to the point where ndd does not help anymore, you probably
have to inspect each file with the disk editor and determine which files belong
together. You get the 32k file size because that is the cluster size on your FAT

Third, if your data is really important, you should probably contact one of the
data recovery houses. They are very expensive, but sometimes the data is worth
it. Your call.

Fourth, if your data is important, you should have made backups.

Fifth, run a virus checker in the background, if you need to run Windoze at all.

Sixth, this is a Linux news group.

Joachim Feise         Ph.D. Student, Information & Computer Science

As a computer, I find your faith in technology amusing.


1. Copy of large file from ext2 to vfat corrupts vfat filesystem.


I don't know if I this is the right group for this but ..., please
point me in the right direction if not.

After I copied a large file (52223944 bytes) from my ext2 filesystem
to my vfat filesystem I noticed the vfat filesystem was trashed.
A ls -l in the toplevel of the vfat filesystem returned mostly
strange characters. I booted DOS, used fdisk to make 2 partions on
the disk (I'm using a separate disk for DOS/Windows95) and formatted
them. Then I booted linux and copied the file to the second DOS
partition (d:) and the first partition (c:) was trashed again.

I'm using slackware 3.1 with 2.1.17, ncr53c810 driver ported from BSD
with tagged command queuing enabled (my linux disk support this).


Just using DOS/Windows95 for playing games.

2. /dev/cuaa2

3. HELP-Corrupt Filesystem-HELP

4. USR28.8, Cyclades16Ye, spd_hi and spd_vhi problems

5. Help! VFAT filesystem - write permission problems.

6. 2.5.59-mm1

7. HELP! Corrupt filesystem

8. what library is to be linked when using Socket api ??

9. Filesystem Corrupted HELP needed pls

10. Pls help: force mount corrupted filesystem (XENIX)

11. E2fsck Filesystem Corrupt, HELP

12. HELP: New kernels corrupt filesystem

13. Help needed - Corrupt filesystem / external devices