Re: [gentoo-user] Corrupt USB pen drive
On Friday 18 May 2007 16:16, Etaoin Shrdlu wrote: On Friday 18 May 2007 15:11, Mick wrote: On Friday 18 May 2007 13:25, Hans-Werner Hilse wrote: Did you try the recovery tools for the FS in question? I tried fsck.msdos but didn't fix it. [snip... lot's of good advice] Bottom line: I would not bet on data recovery from that stick. It's also true that there might be some program I'm unaware of which could try or be able to recover things, but unfortunately I have no advice for you about this. Guys, thank you sooo much! I used fdisk to create a single partition FAT16 fs. Then I used testdisk which would not recover any partitions, but it could at least see the partition (despite the fact that I could not mount /dev/sda1 from the command line due to the previously reported errors). Then I used photorec which worked out its magic and recovered a load of files (some were corrupted) - wey hey! :) My friend is happy and so am I proving to him that Linux can save your skin - I'm no Linux evangelist, as I believe that there are horses for courses, but I suspect we may have a convert. Let's see if he starts asking for a Gentoo install CD next. Ha! Thanks again for your help. -- Regards, Mick pgpHoO7KHbqm5.pgp Description: PGP signature
Re: [gentoo-user] Corrupt USB pen drive [ot]
On Mon, 21 May 2007 10:47:03 +0100 Mick [EMAIL PROTECTED] wrote: I believe that there are horses for courses me too, linux discs are for computers, windows discs make good coasters. ; ) -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] Corrupt USB pen drive
On Thursday 17 May 2007 23:27, Etaoin Shrdlu wrote: On Thursday 17 May 2007 18:04, Mick wrote: Thanks Dan, as I said above I tried to extract the MBR out of it by running: dd if=/dev/sda of=/tmp/r1 bs=512 But couldn't access it whatsoever. Oops! I could access it, but of course I had to try it as root! Right, I've got it on my hard drive now, but still cannot mount it: == # mount -t vfat /dev/loop2 /tmp/r1 mount: wrong fs type, bad option, bad superblock on /dev/loop2, missing codepage or other error In some cases useful info is found in syslog - try dmesg | tail or so == IIRC, that is not the right syntax for mounting a loopback filesystem. If /tmp/r1 is the file containing the filesystem, try mount -o loop /tmp/r1 /mnt/somewhere and make sure you have support for loopback devices in your kernel. Thanks for all the suggestions. I tried the correct mount loopback command on /dev/loop2 and I'm getting this error that mentions /dev/loop0 (how does this work?): == # mount -t vfat -o loop /dev/loop2 /tmp/r1 mount: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or other error In some cases useful info is found in syslog - try dmesg | tail or so == Anyway, regarding a previous comment by Dan I tried accessing /dev/sda1 but it complained that the device does not exist, unlike /dev/sda which appears to be there. I have a couple of USB sticks that also have no partition table (they are like floppies) and I access these as /dev/sda. When I look at their few first bytes they look like this: == 00 eb 3c 90 4d 53 44 4f 53 35 2e 30 00 02 20 01 00 10 02 00 02 00 00 f8 f4 00 3f 00 ff 00 00 00 00 00 20 00 7a 1e 00 00 00 29 96 9d 62 60 4e 4f 20 4e 41 30 4d 45 20 20 20 20 46 41 54 31 36 20 20 20 33 c9 == On the other hand the corrupt disk looks like this: == 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa 000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff * 02 01 df 02 df 03 df 04 df 05 df 06 df 07 df 08 df 020010 09 df 0a df 0b df 0c df 0d df 0e df 0f df 10 df 020020 11 df 12 df 13 df 14 df 15 df 16 df 17 df 18 df 020030 19 df 1a df 1b df 1c df 1d df 1e df 1f df 20 df 020040 21 df 22 df 23 df 24 df 25 df 26 df 27 df 28 df 020050 29 df 2a df 2b df 2c df ff ff 2e df 2f df 30 df == which makes me think that it has different partitions on it, but the partition table is corrupted. Otherwise, I guess I would be able to access it through /dev/sda1. So, the question now is how do I recreate/reconstruct it? I'll surely need some help with it because all this hex means nothing to me. -- Regards, Mick pgp1W34frA4GB.pgp Description: PGP signature
Re: [gentoo-user] Corrupt USB pen drive
On Friday 18 May 2007 10:29, Mick wrote: On Thursday 17 May 2007 23:27, Etaoin Shrdlu wrote: IIRC, that is not the right syntax for mounting a loopback filesystem. If /tmp/r1 is the file containing the filesystem, try mount -o loop /tmp/r1 /mnt/somewhere and make sure you have support for loopback devices in your kernel. Thanks for all the suggestions. I tried the correct mount loopback command on /dev/loop2 and I'm getting this error that mentions /dev/loop0 (how does this work?): == # mount -t vfat -o loop /dev/loop2 /tmp/r1 mount: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or other error In some cases useful info is found in syslog - try dmesg | tail or so == You still seem to be missing the correct syntax. (note: this might not solve your problem, and even issuing the right command might be of no help, but since you asked for it, here it is). With every mount command, you have to specify at least two things: *what* to mount, and *where* to mount it, in this order. *Where* is usually a path to some (preferably empty) directory. *what* can be various things, depending on what you're trying to mount. For regular disk partitions, it's usually a device file (eg, /dev/sda1). For NFS, it's a string of the form remote_host:/remote/path. For loopback filesystems (ie, filesystems contained in a single file), it's the name of the container file, like your /tmp/r1. When mounting loopback filesystems, the -o loop option must be given. The -o loop option accepts some optional parameters. One of these is the specification of the loopback device that should be used. To explicitly specify a loopback device, use -o loop=/dev/loopX. If no loopback device is specificed, then mount will automatically pick an unused loopback device (probably /dev/loop0). Your command # mount -t vfat -o loop /dev/loop2 /tmp/r1 uses an incorrect syntax for the specification of the loopback device (which is optional anyway), and does not tell where to mount the filesystem. So, what you probably want is # mount -t vfat -o loop=/dev/loop2 /tmp/r1 /mnt/somewhere or just simply # mount -t vfat -o loop /tmp/r1 /mnt/somewhere -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] Corrupt USB pen drive
On Friday 18 May 2007 10:24, Etaoin Shrdlu wrote: You still seem to be missing the correct syntax. (note: this might not solve your problem, and even issuing the right command might be of no help, but since you asked for it, here it is). [snip . . . ] Thanks! Things don't always go as they should when I rush through commands - especially those I am not familiar with. It's crystal clear now. # mount -t vfat -o loop /dev/loop2 /tmp/r1 uses an incorrect syntax for the specification of the loopback device (which is optional anyway), and does not tell where to mount the filesystem. So, what you probably want is # mount -t vfat -o loop=/dev/loop2 /tmp/r1 /mnt/somewhere or just simply # mount -t vfat -o loop /tmp/r1 /mnt/somewhere I am getting the same errors as before: == # mount -t vfat -o loop /tmp/r1 /mnt/sda1 mount: wrong fs type, bad option, bad superblock on /dev/loop1, missing codepage or other error In some cases useful info is found in syslog - try dmesg | tail or so == No matter if I use vfat, msdos, or ntfs. It seems to me that I need to reconstruct the hex of the partition table - but don't know how to do this and testdisk does not see the device to recover previous partition tables. What now? -- Regards, Mick pgpqK120aljVP.pgp Description: PGP signature
Re: [gentoo-user] Corrupt USB pen drive
Hi, On Fri, 18 May 2007 12:50:07 +0100 Mick [EMAIL PROTECTED] wrote: I am getting the same errors as before: == # mount -t vfat -o loop /tmp/r1 /mnt/sda1 mount: wrong fs type, bad option, bad superblock on /dev/loop1, missing codepage or other error In some cases useful info is found in syslog - try dmesg | tail or so == No matter if I use vfat, msdos, or ntfs. It seems to me that I need to reconstruct the hex of the partition table - but don't know how to do this and testdisk does not see the device to recover previous partition tables. I'm pretty sure someone borked the first sectors of that stick. It might have contained a partition table at some point in the past, and the partition table might be gone now (HD mode). But there is also the possibility that there wasn't a partition table but just a single filesystem on the stick (superfloppy mode). My suggestion is to take a hex editor and search for the start of a partition. Most partition types are easily recognizable by some magic bytes. It would, however, help a lot if you could tell what kind of filesystem there was. If you found the start of the filesystem, just use dd again and skip the bytes until the real start of the FS. You can then mount the resulting file (w/o partitioning and such). Did you try the recovery tools for the FS in question? -hwh -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] Corrupt USB pen drive
On Friday 18 May 2007 13:25, Hans-Werner Hilse wrote: Hi, On Fri, 18 May 2007 12:50:07 +0100 Mick [EMAIL PROTECTED] wrote: No matter if I use vfat, msdos, or ntfs. It seems to me that I need to reconstruct the hex of the partition table - but don't know how to do this and testdisk does not see the device to recover previous partition tables. I'm pretty sure someone borked the first sectors of that stick. It might have contained a partition table at some point in the past, and the partition table might be gone now (HD mode). But there is also the possibility that there wasn't a partition table but just a single filesystem on the stick (superfloppy mode). My suggestion is to take a hex editor and search for the start of a partition. Most partition types are easily recognizable by some magic bytes. It would, however, help a lot if you could tell what kind of filesystem there was. If you found the start of the filesystem, just use dd again and skip the bytes until the real start of the FS. You can then mount the resulting file (w/o partitioning and such). Did you try the recovery tools for the FS in question? I tried fsck.msdos but didn't fix it. Like most USB sticks I would assume that it is either FAT32 or FAT16. Given that this is what I see when I dump the first few bytes, can you please tell me where the fs data starts and how to dd that without inc the initial partition table data? == 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa 000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff * 02 01 df 02 df 03 df 04 df 05 df 06 df 07 df 08 df 020010 09 df 0a df 0b df 0c df 0d df 0e df 0f df 10 df 020020 11 df 12 df 13 df 14 df 15 df 16 df 17 df 18 df 020030 19 df 1a df 1b df 1c df 1d df 1e df 1f df 20 df 020040 21 df 22 df 23 df 24 df 25 df 26 df 27 df 28 df 020050 29 df 2a df 2b df 2c df ff ff 2e df 2f df 30 df 020060 31 df 32 df 33 df 34 df 35 df 36 df 37 df 38 df 020070 39 df 3a df 3b df 3c df 3d df 3e df 3f df 40 df 020080 41 df 42 df 43 df 44 df 45 df 46 df 47 df 48 df 020090 49 df 4a df 4b df 4c df 4d df 4e df 4f df 50 df 0200a0 51 df 52 df 53 df 54 df 55 df 56 df 57 df 58 df 0200b0 59 df 5a df 5b df 5c df 5d df 5e df 5f df 60 df 0200c0 61 df 62 df 63 df 64 df 65 df 66 df 67 df 68 df 0200d0 69 df 6a df 6b df 6c df 6d df 6e df 6f df 70 df [snip] 0202a0 51 e0 52 e0 53 e0 54 e0 55 e0 56 e0 57 e0 58 e0 0202b0 59 e0 5a e0 5b e0 5c e0 5d e0 5e e0 5f e0 60 e0 0202c0 61 e0 62 e0 63 e0 64 e0 65 e0 66 e0 4f 93 00 00 0202d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 020360 00 00 00 00 00 00 00 00 00 00 00 00 b7 e0 b8 e0 020370 b9 e0 ba e0 bb e0 bc e0 bd e0 be e0 bf e0 c0 e0 020380 c1 e0 c2 e0 c3 e0 c4 e0 c5 e0 c6 e0 c7 e0 c8 e0 020390 c9 e0 ca e0 cb e0 cc e0 cd e0 ce e0 cf e0 d0 e0 0203a0 d1 e0 d2 e0 d3 e0 d4 e0 d5 e0 d6 e0 d7 e0 d8 e0 [snip] 021ab0 59 ec 5a ec 5b ec 5c ec 5d ec 5e ec 5f ec 60 ec 021ac0 61 ec ff ff 63 ec 64 ec 65 ec 66 ec 67 ec 68 ec 021ad0 69 ec 6a ec 6b ec 6c ec 6d ec 6e ec 6f ec 70 ec 021ae0 71 ec ff ff 00 00 00 00 00 00 00 00 00 00 00 00 021af0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 022720 00 00 00 00 00 00 00 00 00 00 96 f2 97 f2 98 f2 022730 99 f2 9a f2 9b f2 9c f2 9d f2 9e f2 9f f2 a0 f2 022740 a1 f2 a2 f2 a3 f2 a4 f2 a5 f2 a6 f2 a7 f2 a8 f2 022750 a9 f2 aa f2 ab f2 ac f2 ad f2 ae f2 af f2 b0 f2 == I assume that the asterisks indicate a new file starting there? Thanks for all your help. :) -- Regards, Mick pgpdJiyKVVsug.pgp Description: PGP signature
Re: [gentoo-user] Corrupt USB pen drive
On Fri, 18 May 2007 14:11:14 +0100 Mick [EMAIL PROTECTED] wrote: On Friday 18 May 2007 13:25, Hans-Werner Hilse wrote: Hi, On Fri, 18 May 2007 12:50:07 +0100 Mick [EMAIL PROTECTED] wrote: No matter if I use vfat, msdos, or ntfs. It seems to me that I need to reconstruct the hex of the partition table - but don't know how to do this and testdisk does not see the device to recover previous partition tables. I agree that you probalby need to get the partition table, or at least information about the partition in question. Althought it is possibe that the disk is all one filesystem, I have never seen windows do it that way for a usb stick. I assume it's all one big partition, formatted vfat, just like all the others I've seen. I'm pretty sure someone borked the first sectors of that stick. It might have contained a partition table at some point in the past, and the partition table might be gone now (HD mode). I agree, this eems to be the case. But there is also the possibility that there wasn't a partition table but just a single filesystem on the stick (superfloppy mode). My suggestion is to take a hex editor and search for the start of a partition. Most partition types are easily recognizable by some magic bytes. It would, however, help a lot if you could tell what kind of filesystem there was. If you found the start of the filesystem, just use dd again and skip the bytes until the real start of the FS. You can then mount the resulting file (w/o partitioning and such). I agree. I've been reading about vfat filesystems a little and I think this article http://en.wikipedia.org/wiki/VFAT seems to have all the information we need. However, == 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 If there are zeroes all through here... 0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa 000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff and FF's all through here, I'm not sure there's enough left over to recover filesystem information. -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] Corrupt USB pen drive
On Friday 18 May 2007 15:11, Mick wrote: On Friday 18 May 2007 13:25, Hans-Werner Hilse wrote: Did you try the recovery tools for the FS in question? I tried fsck.msdos but didn't fix it. Like most USB sticks I would assume that it is either FAT32 or FAT16. Given that this is what I see when I dump the first few bytes, can you please tell me where the fs data starts and how to dd that without inc the initial partition table data? == 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa 000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff * 02 01 df 02 df 03 df 04 df 05 df 06 df 07 df 08 df [cut] I assume that the asterisks indicate a new file starting there? Are you using hexdump to read the data? Does the above output come from hexdumping the actual device or the image file? The asterisks look strange. If you look carefully, you see that each asterisk does not merely replace a single line of output, but several lines. Look at the addresses of the lines before and after: for example, 000200 - asterisk - 02 in your output above. So, that asterisk represents 0x02 - 0x000210 = 0x1fdf0 bytes, ie 130544 bytes. If the dump comes from the actual device (like I suppose), it could be that these bytes are skipped because they are somehow unreadable, so it's really difficult to compare this output with one from a working device, in either HD or superfloppy mode. In particular, there is an asterisk immediately after the first 16 bytes (line 00), and the dump continues at byte 0x0001f0 (496 decimal), and this means that the very first sector (where the interesting stuff is) is almost entirely damaged or otherwise unreadable. Also, trying to dd the device to a file as you did would almost certainly insert unpredictable garbage in the file to represent the unreadable parts of the device. Chances are it was in HD mode (ie, with a partition table), because the signature at the end of the first 512 bytes (the 55 aa at the end of the 0001f0 line) indicates a boot sector (the MBR). Within this boot sector, the partition table is 64 bytes long and usually lives from byte 446 to byte 509 of the sector (512 bytes long, numbered from 0 to 511; bytes 510 and 511 are the signature). Since a partition table is composed of four records, each 16 bytes long, this means you have only the last 14 bytes of the fourth partition table record. But, it's very very likely that there was only a single partition, and thus the fourth record is unused and set to all zeros. What you would need is the value of the bytes from 446 to 461 (the first partition table record, which has info about the first partition), but, as I said above, all this data seems to be lost in the asterisk, like tears in the rain (cit.). Bottom line: I would not bet on data recovery from that stick. It's also true that there might be some program I'm unaware of which could try or be able to recover things, but unfortunately I have no advice for you about this. -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] Corrupt USB pen drive
Hi, On Fri, 18 May 2007 14:11:14 +0100 Mick [EMAIL PROTECTED] wrote: Did you try the recovery tools for the FS in question? I tried fsck.msdos but didn't fix it. Doesn't make me wonder, as I'll explain below, there's no file system starting at offset 0 in that image of your stick... Like most USB sticks I would assume that it is either FAT32 or FAT16. I would have guessed that too. However: FAT file systems even carry FAT as verbatim chars at the start of the partition... So it's quite easy to spot the start of a FAT partition... Given that this is what I see when I dump the first few bytes, can you please tell me where the fs data starts and how to dd that without inc the initial partition table data? == 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa I'll answer another question first: The asterisk indicates consecutive lines w/ the same data. So here, we have a full block (512 bytes, 0x000-0x1ff) containing almost only zeros. It stops with a valid master boot record magic number (0x55aa). This MBR doesn't contain anything, so there's no partition table, either. It also might be a part of a FAT file system's boot sector (the end-of-sector marker bytes). 000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff * 02 [...] OK, so from 0x00200-0x1 it contains only consecutive 0xff bytes, i.e. (0x2 / 0x200) = 0x100 = 256 (dec) blocks (à 0x200=512 bytes). That's nearly 128 kBytes of 0xff. I wonder how it got there. I think all this indicates that there might have been some tool which overwrote the first 128k of this stick with some default data or similar. At least, the first 128k are modified and can't work this way, since there's neither a valid MBR, nor a valid partition table nor a valid file system at offset 0. What's following next? I think it might be the tail of a FAT16 (the FAT itself). This means there is no boot sector anymore. The boot sector is not redundant for FAT file systems, so it would have to be recreated. The FAT itself, however, is usually present a second time (see http://en.wikipedia.org/wiki/File_Allocation_Table for details). It clearly looks like FAT, since this we have a end-of-file indication: 02 01 df 02 df 03 df 04 df 05 df 06 df 07 df 08 df 020010 09 df 0a df 0b df 0c df 0d df 0e df 0f df 10 df 020020 11 df 12 df 13 df 14 df 15 df 16 df 17 df 18 df 020030 19 df 1a df 1b df 1c df 1d df 1e df 1f df 20 df 020040 21 df 22 df 23 df 24 df 25 df 26 df 27 df 28 df 020050 29 df 2a df 2b df 2c df ff ff 2e df 2f df 30 df - 020060 31 df 32 df 33 df 34 df 35 df 36 df 37 df 38 df [...] All the rest of data you've quoted doesn't mean a lot, I think it's all from the FAT. I would suggest you find out whether there's a full copy of the FAT intact after the data you quoted. Just search for some of the byte sequences you quoted here and if you're lucky, there's an intact FAT later on. After the FATs, there will most probably be the directory table. You should be able to look up the file names there verbatim. OK, but how to continue? You probably need a new boot sector and a clean FAT. You can manually create one, but it's a tedious process. Look at the FAT documentation and try to figure out cluster size (probably Stick size / 65536) and so on. OTOH, you can try to create a new FAT16 fs on media with the same size as the stick (e.g. dd if=/dev/zero) and then try to implant the backup copy of your FAT (two times, once as new primary FAT, once as a secondary FAT) and directory table and of course the data into that new FAT16. Unfortunately, by default it seems that the backup copy of the FAT itself for a 255744 sector Stick defaults to start at 0x1f600. So a considerable amount even of the backup FAT would be destroyed if the original layout resembles this geometry. So at that point, there's not a lot you can do, aside from tools like the mentioned Photorec and its commercial brothers, which can do a neat job when you're back to heuristically determining start/stop of files (which mustn't be too fragmented, of course) in a data stream. -hwh -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] Corrupt USB pen drive
On Friday 18 May 2007 16:48, Hans-Werner Hilse wrote: I'll answer another question first: The asterisk indicates consecutive lines w/ the same data. So here, we have a full block (512 bytes, 0x000-0x1ff) containing almost only zeros. It stops with a valid master boot record magic number (0x55aa). This MBR doesn't contain anything, so there's no partition table, either. It also might be a part of a FAT file system's boot sector (the end-of-sector marker bytes). [cut] I did not know about the meaning of the asterisk...so your explanation does make more sense than mine. Thanks for clearing up things. -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] Corrupt USB pen drive
On Thursday 17 May 2007 13:36:25 Mick wrote: Hi All, A colleague used a USB stick on his home machine and when he brought it to work he can no longer access it using WinXP. I offered to help with my Gentoo laptop (as one ought to rise to the challenge!) but it seems that Linux is also struggling to get to it: . I tried to dd the boot sector so that I can look at it on my hard drive, but it cannot access /dev/sda. Is there anything that I can do with my Gentoo to recover the files on this USB? Try the PhotoRec tool from app-admin/testdisk It recovers a lot of different file formats. Regards, Elias P. -- A really nice number: 09:F9:11:02:9D:74:E3:5B:D8:41:56:C5:63:56:88:C0 signature.asc Description: This is a digitally signed message part.
Re: [gentoo-user] Corrupt USB pen drive
On Thursday 17 May 2007 12:51, Elias Probst wrote: On Thursday 17 May 2007 13:36:25 Mick wrote: I tried to dd the boot sector so that I can look at it on my hard drive, but it cannot access /dev/sda. Is there anything that I can do with my Gentoo to recover the files on this USB? Try the PhotoRec tool from app-admin/testdisk It recovers a lot of different file formats. Thanks Elias, I tried photorec, but it will only see mounted partitions. :-( -- Regards, Mick pgpcDKQsf8TkH.pgp Description: PGP signature
Re: [gentoo-user] Corrupt USB pen drive
On Thu, 17 May 2007 12:36:25 +0100 Mick [EMAIL PROTECTED] wrote: Hi All, A colleague used a USB stick on his home machine and when he brought it to work he can no longer access it using WinXP. I offered to help with my Gentoo laptop (as one ought to rise to the challenge!) but it seems that Linux is also struggling to get to it: == usb 2-1: new full speed USB device using uhci_hcd and address 2 usb 2-1: configuration #1 chosen from 1 choice scsi0 : SCSI emulation for USB Mass Storage devices usb-storage: device found at 2 usb-storage: waiting for device to settle before scanning scsi 0:0:0:0: Direct-Access USB BAR 1.89 PQ: 0 ANSI: 2 SCSI device sda: 255744 512-byte hdwr sectors (131 MB) sda: Write Protect is off sda: Mode Sense: 03 00 00 00 sda: assuming drive cache: write through SCSI device sda: 255744 512-byte hdwr sectors (131 MB) sda: Write Protect is off sda: Mode Sense: 03 00 00 00 sda: assuming drive cache: write through sda: unknown partition table sd 0:0:0:0: Attached scsi removable disk sda sd 0:0:0:0: Attached scsi generic sg0 type 0 usb-storage: device scan complete UDF-fs: No VRS found Unable to identify CD-ROM format. FAT: bogus logical sector size 65535 VFS: Can't find a valid FAT filesystem on dev sda. NTFS-fs warning (device sda): is_boot_sector_ntfs(): Invalid boot sector checksum. NTFS-fs error (device sda): read_ntfs_boot_sector(): Primary boot sector is invalid. NTFS-fs error (device sda): read_ntfs_boot_sector(): Mount option errors=recover not used. Aborting without trying to recover. NTFS-fs error (device sda): ntfs_fill_super(): Not an NTFS volume. hfs: can't find a HFS filesystem on dev sda. VFS: Can't find ext3 filesystem on dev sda. VFS: Can't find an ext2 filesystem on dev sda. ReiserFS: sda: warning: sh-2021: reiserfs_fill_super: can not find reiserfs on sda == I tried to dd the boot sector so that I can look at it on my hard drive, but it cannot access /dev/sda. Is there anything that I can do with my Gentoo to recover the files on this USB? have you tried reading raw from the device like | dd if=/dev/sda of=sda.image ? That might do the recovery. How to get it out of the image is the same problem but once the backup succeeds you can plug it into a windows xp box and reformat, and you will probably end up with the same partition structure as originally. Then you can try to read the right part of the image out of the image, once you get the numbers from fdisk on the newly formatted drive, and end up with an image of sda1. From there you should be able to mount sda1 and read out the data, if it isn't corrupted. I also am wondering what happened to the partition table. I bet your coworker has a security-compromised box at home (oh, runs windows? right...) At any rate, if the data is recoverable, it may be possible to rebuild the partition table if you can find out where the partition started and ended. People have done it before, i've read online about it. -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] Corrupt USB pen drive
On Thursday 17 May 2007 15:45, Dan Farrell wrote: On Thu, 17 May 2007 12:36:25 +0100 Mick [EMAIL PROTECTED] wrote: I tried to dd the boot sector so that I can look at it on my hard drive, but it cannot access /dev/sda. Is there anything that I can do with my Gentoo to recover the files on this USB? have you tried reading raw from the device like | dd if=/dev/sda of=sda.image ? That might do the recovery. How to get it out of the image is the same problem but once the backup succeeds you can plug it into a windows xp box and reformat, and you will probably end up with the same partition structure as originally. Then you can try to read the right part of the image out of the image, once you get the numbers from fdisk on the newly formatted drive, and end up with an image of sda1. From there you should be able to mount sda1 and read out the data, if it isn't corrupted. Thanks Dan, as I said above I tried to extract the MBR out of it by running: dd if=/dev/sda of=/tmp/r1 bs=512 But couldn't access it whatsoever. I also am wondering what happened to the partition table. I bet your coworker has a security-compromised box at home (oh, runs windows? right...) At any rate, if the data is recoverable, it may be possible to rebuild the partition table if you can find out where the partition started and ended. People have done it before, i've read online about it. -- Regards, Mick pgpPBaqnYFVgN.pgp Description: PGP signature
Re: [gentoo-user] Corrupt USB pen drive
On Thu, 17 May 2007 16:38:44 +0100 Mick [EMAIL PROTECTED] wrote: On Thursday 17 May 2007 15:45, Dan Farrell wrote: On Thu, 17 May 2007 12:36:25 +0100 Mick [EMAIL PROTECTED] wrote: I tried to dd the boot sector so that I can look at it on my hard drive, but it cannot access /dev/sda. Is there anything that I can do with my Gentoo to recover the files on this USB? have you tried reading raw from the device like | dd if=/dev/sda of=sda.image ? That might do the recovery. How to get it out of the image is the same problem but once the backup succeeds you can plug it into a windows xp box and reformat, and you will probably end up with the same partition structure as originally. Then you can try to read the right part of the image out of the image, once you get the numbers from fdisk on the newly formatted drive, and end up with an image of sda1. From there you should be able to mount sda1 and read out the data, if it isn't corrupted. Thanks Dan, as I said above I tried to extract the MBR out of it by running: dd if=/dev/sda of=/tmp/r1 bs=512 But couldn't access it whatsoever. I also am wondering what happened to the partition table. I bet your coworker has a security-compromised box at home (oh, runs windows? right...) At any rate, if the data is recoverable, it may be possible to rebuild the partition table if you can find out where the partition started and ended. People have done it before, i've read online about it. Hmm! Perhaps its broken. -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] Corrupt USB pen drive
On Thu, 2007-05-17 at 16:38 +0100, Mick wrote: On Thursday 17 May 2007 15:45, Dan Farrell wrote: On Thu, 17 May 2007 12:36:25 +0100 Mick [EMAIL PROTECTED] wrote: I tried to dd the boot sector so that I can look at it on my hard drive, but it cannot access /dev/sda. Is there anything that I can do with my Gentoo to recover the files on this USB? have you tried reading raw from the device like | dd if=/dev/sda of=sda.image ? That might do the recovery. How to get it out of the image is the same problem but once the backup succeeds you can plug it into a windows xp box and reformat, and you will probably end up with the same partition structure as originally. Then you can try to read the right part of the image out of the image, once you get the numbers from fdisk on the newly formatted drive, and end up with an image of sda1. From there you should be able to mount sda1 and read out the data, if it isn't corrupted. Thanks Dan, as I said above I tried to extract the MBR out of it by running: dd if=/dev/sda of=/tmp/r1 bs=512 But couldn't access it whatsoever. I also am wondering what happened to the partition table. I bet your coworker has a security-compromised box at home (oh, runs windows? right...) At any rate, if the data is recoverable, it may be possible to rebuild the partition table if you can find out where the partition started and ended. People have done it before, i've read online about it. Have you tried examining it physically? I've had a drive behave similarly before, and it turned out to be an issue with one of the solder joints on the crystal only having intermittent contact ( was almost a dry join) - resoldering solved it and let me recover the data -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] Corrupt USB pen drive
On Thursday 17 May 2007 16:38, Mick wrote: On Thursday 17 May 2007 15:45, Dan Farrell wrote: On Thu, 17 May 2007 12:36:25 +0100 Mick [EMAIL PROTECTED] wrote: I tried to dd the boot sector so that I can look at it on my hard drive, but it cannot access /dev/sda. Is there anything that I can do with my Gentoo to recover the files on this USB? have you tried reading raw from the device like | dd if=/dev/sda of=sda.image ? That might do the recovery. How to get it out of the image is the same problem but once the backup succeeds you can plug it into a windows xp box and reformat, and you will probably end up with the same partition structure as originally. Then you can try to read the right part of the image out of the image, once you get the numbers from fdisk on the newly formatted drive, and end up with an image of sda1. From there you should be able to mount sda1 and read out the data, if it isn't corrupted. Thanks Dan, as I said above I tried to extract the MBR out of it by running: dd if=/dev/sda of=/tmp/r1 bs=512 But couldn't access it whatsoever. Oops! I could access it, but of course I had to try it as root! Right, I've got it on my hard drive now, but still cannot mount it: == # mount -t vfat /dev/loop2 /tmp/r1 mount: wrong fs type, bad option, bad superblock on /dev/loop2, missing codepage or other error In some cases useful info is found in syslog - try dmesg | tail or so == -- Regards, Mick pgp4EeXLXnhkJ.pgp Description: PGP signature
Re: [gentoo-user] Corrupt USB pen drive
On Thu, 17 May 2007 17:04:21 +0100 Mick [EMAIL PROTECTED] wrote: Thanks Dan, as I said above I tried to extract the MBR out of it by running: dd if=/dev/sda of=/tmp/r1 bs=512 But couldn't access it whatsoever. Oops! I could access it, but of course I had to try it as root! Right, I've got it on my hard drive now, but still cannot mount it: == # mount -t vfat /dev/loop2 /tmp/r1 mount: wrong fs type, bad option, bad superblock on /dev/loop2, missing codepage or other error In some cases useful info is found in syslog - try dmesg | tail or so == because the _disk_ sda doesn't house a filesystem, the _partiton_ sda1 does. You need to find out where that partition started and ended on the disk sda. My thought was maybe windows would format it the same way twice, in which case you can format and then get the partitioning information out of the device, reformat, write the part of /tmp/r1 that coincides with the partition, cross fingers, and try mounting. -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] Corrupt USB pen drive
On Thu, 2007-05-17 at 17:04 +0100, Mick wrote: On Thursday 17 May 2007 16:38, Mick wrote: On Thursday 17 May 2007 15:45, Dan Farrell wrote: On Thu, 17 May 2007 12:36:25 +0100 Mick [EMAIL PROTECTED] wrote: I tried to dd the boot sector so that I can look at it on my hard drive, but it cannot access /dev/sda. Is there anything that I can do with my Gentoo to recover the files on this USB? have you tried reading raw from the device like | dd if=/dev/sda of=sda.image ? That might do the recovery. How to get it out of the image is the same problem but once the backup succeeds you can plug it into a windows xp box and reformat, and you will probably end up with the same partition structure as originally. Then you can try to read the right part of the image out of the image, once you get the numbers from fdisk on the newly formatted drive, and end up with an image of sda1. From there you should be able to mount sda1 and read out the data, if it isn't corrupted. Thanks Dan, as I said above I tried to extract the MBR out of it by running: dd if=/dev/sda of=/tmp/r1 bs=512 But couldn't access it whatsoever. Oops! I could access it, but of course I had to try it as root! Right, I've got it on my hard drive now, but still cannot mount it: == # mount -t vfat /dev/loop2 /tmp/r1 mount: wrong fs type, bad option, bad superblock on /dev/loop2, missing codepage or other error In some cases useful info is found in syslog - try dmesg | tail or so == Have you tried mounting with just mount -o loop /dev/loop2 /tmp/r1 signature.asc Description: This is a digitally signed message part
Re: [gentoo-user] Corrupt USB pen drive
On Thursday 17 May 2007 13:36, Mick wrote: A colleague used a USB stick on his home machine and when he brought it to work he can no longer access it using WinXP. I offered to help with my Gentoo laptop (as one ought to rise to the challenge!) but it seems that Linux is also struggling to get to it: [cut] sda: assuming drive cache: write through sda: unknown partition table Might not help you in this case, but I seem to remember that, for some USB pens at least, if you format the drive using the windows utility that comes with the device, it screws up the partition table and uses the whole /dev/sda device to create a single fat32 filesystem. I'm fairly sure I saw one of two of these in the past. So, have you tried mounting it using just mount -t vfat /dev/sda /mnt/somewhere ? -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] Corrupt USB pen drive
On Thursday 17 May 2007 18:04, Mick wrote: Thanks Dan, as I said above I tried to extract the MBR out of it by running: dd if=/dev/sda of=/tmp/r1 bs=512 But couldn't access it whatsoever. Oops! I could access it, but of course I had to try it as root! Right, I've got it on my hard drive now, but still cannot mount it: == # mount -t vfat /dev/loop2 /tmp/r1 mount: wrong fs type, bad option, bad superblock on /dev/loop2, missing codepage or other error In some cases useful info is found in syslog - try dmesg | tail or so == IIRC, that is not the right syntax for mounting a loopback filesystem. If /tmp/r1 is the file containing the filesystem, try mount -o loop /tmp/r1 /mnt/somewhere and make sure you have support for loopback devices in your kernel. -- [EMAIL PROTECTED] mailing list
