Determining data loss severity on FAT volumes

After about twenty years, I felt ZAR can no longer be updated to match the modern requirements, and I decided to retire it.

ZAR is replaced by Klennet Recovery, my new general-purpose DIY data recovery software.

If you are looking specifically for recovery of image files (like JPEG, CR2, and NEF), take a look at Klennet Carver, a separate video and photo recovery software.

This checklist should be completed when estimating failure severity after a catastrophic event caused by the undetermined reason. If the reason that caused the failure is known, it is usually possible to deduce severity without reviewing the drive itself. Running through this checklist provides preliminary estimation, which is subject to change as additional information is gathered.

All items are required unless explicitly stated otherwise.

• MS-DOS boot disk (or bootable CD)
• Norton DiskEditor

1. System must run at its rated frequency (i.e. no overclocking)
2. Check if a drive geometry and access mode (i.e. LBA) in BIOS Setup are correct.
3. Check if drive is physically OK (no enormous scratching or clicking sounds and so on). Reviewing of S.M.A.R.T. information is recommended, but not required. If some symptoms suggest a physical damage, this checklist should be aborted and drive image must be taken as soon as possible.
4. Boot (use boot floppy, do not attempt to boot from the affected hard disk). When booting from floppy disk, perform a cold restart, then enter BIOS setup and check if boot sequence setting is correct (i.e. floppy drive goes first). This is done to ensure that there was no tampering with boot sequence (some viruses are known to do that).
5. Manually inspect a partition table for correctness. If a partition table is not correct, assume the disk contained a single volume starting at absolute sector 63 (most common location for 1st volume boot sector).
6. Manually inspect boot sectors for all volumes.
7. Manually inspect first FAT for all volumes (at least five FAT sectors should be reviewed). Inspection of second FAT is recommended but not required.
8. Manually inspect root directories for all volumes. Inspection of root directory clusters numbered >2 on FAT32 is not required.

The following table should then be used to estimate severity of the failure.