On Friday 18 May 2007 15:11, Mick wrote: > On Friday 18 May 2007 13:25, Hans-Werner Hilse wrote: > > Did you try the recovery tools for the FS in question? > > I tried fsck.msdos but didn't fix it. > > Like most USB sticks I would assume that it is either FAT32 or FAT16. > Given that this is what I see when I dump the first few bytes, can you > please tell me where the fs data starts and how to dd that without inc > the initial partition table data? > ============================================== > 000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > * > 0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa > 000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff > * > 020000 01 df 02 df 03 df 04 df 05 df 06 df 07 df 08 df > >[cut] > I assume that the asterisks indicate a new file starting there?
Are you using hexdump to read the data? Does the above output come from hexdumping the actual device or the image file? The asterisks look strange. If you look carefully, you see that each asterisk does not merely replace a single line of output, but several lines. Look at the addresses of the lines before and after: for example, 000200 -> asterisk -> 020000 in your output above. So, that asterisk represents 0x020000 - 0x000210 = 0x1fdf0 bytes, ie 130544 bytes. If the dump comes from the actual device (like I suppose), it could be that these bytes are skipped because they are somehow unreadable, so it's really difficult to compare this output with one from a working device, in either HD or superfloppy mode. In particular, there is an asterisk immediately after the first 16 bytes (line 000000), and the dump continues at byte 0x0001f0 (496 decimal), and this means that the very first sector (where the interesting stuff is) is almost entirely damaged or otherwise unreadable. Also, trying to dd the device to a file as you did would almost certainly insert unpredictable garbage in the file to represent the unreadable parts of the device. Chances are it was in HD mode (ie, with a partition table), because the signature at the end of the first 512 bytes (the "55 aa" at the end of the 0001f0 line) indicates a boot sector (the MBR). Within this boot sector, the partition table is 64 bytes long and usually lives from byte 446 to byte 509 of the sector (512 bytes long, numbered from 0 to 511; bytes 510 and 511 are the signature). Since a partition table is composed of four records, each 16 bytes long, this means you have only the last 14 bytes of the fourth partition table record. But, it's very very likely that there was only a single partition, and thus the fourth record is unused and set to all zeros. What you would need is the value of the bytes from 446 to 461 (the first partition table record, which has info about the first partition), but, as I said above, all this data seems to be lost in the asterisk, like tears in the rain (cit.). Bottom line: I would not bet on data recovery from that stick. It's also true that there might be some program I'm unaware of which could try or be able to recover things, but unfortunately I have no advice for you about this. -- [EMAIL PROTECTED] mailing list
