SDXC card exFAT corruption analysis and recovery from Panasonic HC-X20 camcorder

A not-for-profit organisation has a Panasonic HC-X20 camcorder. One time the SD card was formatted and recorded on the camcorder, but could not be read on the computer. The is my analysis on how to recover a corrupted exFAT file system on a SDXC card produced by Panasonic HC-X20 camcorder.

The camcorder firmware version is v1.2 when this happened. HC-X20 is a brilliant camcorder and I hope Panasonic can fix the issue, also hope other users who experienced the same issue can recover their footage.

WARNING: IF THE FOOTAGE IS IMPORTANT, CONSULT DATA RECOVERY SERVICE IF YOU ARE UNSURE.

Structure of exFAT

This section is intended to support the observation and analysis sections below. This is not comprehensive, but a detailed spec available from Microsoft. Skip this section if you already know exFAT well.

• sector 0~11 is main boot region
  • sector 0 is main boot sector
    • byte offset 100~103 is VolumeSerialNumber
    • byte offset 112 is PercentInUse
  • sector 11 is main boot checksum
• sector 12~23 is backup boot region
  • sector 12 is backup boot sector
    • byte offset 100~103 is VolumeSerialNumber
    • byte offset 112 is PercentInUse
  • sector 23 is backup boot checksum

Observation

• Sector size is 512 bytes (physical and logical) on a 128GB SDXC card.
• Partition table is normal. exFAT is the only partition.
• exFAT file system cannot be mounted.
  • Windows will not recognise the file system and ask “do you want to format it” (please select “cancel”) .
    • Windows disk management (diskmgmt.msc) will indicate it is “RAW, Healthy (Primary Partition)”
  • Linux will not be able to mount it (even with mount -o ro /dev/sdb1 /mnt).
    • Kernel message exFAT-fs (sdb1): Invalid boot checksum (boot checksum : 0x0e6e7047, checksum : 0x0e6fb747)
      The first hex is little endian presentation of 0x47706e0e from exFAT sector 11, the second hex is calculated by Linux, according to kernel source code fs/exfat/super.c

Analysis

Comparing the exFAT main boot region (sector 0~11) and backup boot region (sector 12~23) reveals the following difference:

• Byte offset 100~103 (VolumeSerialNumber) is different. This is not normal. (main 0x21e07569, backup 0x3a1c7f69)
• Byte offset 112 (PercentInUse) is different, but this is normal and can be observed on other cards from HC-X20. (main 0x62 means 98% usage, backup 0xff means information not available)

Everything else is the same (sector 1~11 is the same as sector 13~23). Checksum is 0x47706e0e on both checksum sectors (sector 11 and sector 23).

A diff of hex dump between main boot region (sector 0~11) and backup boot region (sector 12~23) below

--- main-boot-region-hex
+++ backup-boot-region-hex
@@ -4,8 +4,8 @@
 00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
 00000040: 0080 0000 0000 0000 0030 e20e 0000 0000  .........0......
 00000050: 0040 0000 0040 0000 0080 0000 b0e1 0e00  .@...@..........
-00000060: 0400 0000 21e0 7569 0001 0000 0908 0180  ....!.ui........
-00000070: 6200 0000 0000 0000 0000 0000 0000 0000  b...............
+00000060: 0400 0000 3a1c 7f69 0001 0000 0908 0180  ....:..i........
+00000070: ff00 0000 0000 0000 0000 0000 0000 0000  ................
 00000080: 0000 0000 0000 0000 0000 0000 0000 0000  ................
 00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................
 000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................

The diff above is generated by

dd if=/dev/sdb1 bs=512 skip=0 count=12 | xxd > main-boot-region-hex
dd if=/dev/sdb1 bs=512 skip=12 count=12 | xxd > backup-boot-region-hex
diff -u main-boot-region-hex backup-boot-region-hex

Options to recover the data

PLEASE CREATE A DISK IMAGE OF THE SD CARD FIRST

• One options is to read byte offset 100~103 (VolumeSerialNumber) from backup boot region (sector 12) and write it to offset 100~103 of main boot region (sector 0)
• Another option is to run fsck.exfat on Linux to generate new checksum on main boot region.

After fixing the main boot region, the exFAT file system can be mounted

$ sudo mount -o ro /dev/sdb1 /mnt
$ tree /mnt
/mnt
└── PRIVATE
    ├── AVCHD
    │   ├── AVCHDTN
    │   │   ├── THUMB.TDT
    │   │   └── THUMB.TID
    │   ├── BDMV
    │   │   ├── CLIPINF
    │   │   ├── INDEX.BDM
    │   │   ├── MOVIEOBJ.BDM
    │   │   ├── PLAYLIST
    │   │   └── STREAM
    │   └── PANA_EXT
    │       ├── BACKUP.CPI
    │       ├── BAK-SA0.PDI
    │       └── BAK-SA1.PDI
    └── PANA_GRP
        ├── 001RBQAM
        │   └── P351C001_260201_A43C.MOV
        ├── BACKUP.TMP
        └── INDEX.DAT