[gentoo-user] Corrupt USB pen drive

[gentoo-user] Corrupt USB pen drive

[Mick]

[-- Attachment #1: Type: text/plain, Size: 2126 bytes --]

Hi All,

A colleague used a USB stick on his home machine and when he brought it to 
work he can no longer access it using WinXP.  I offered to help with my 
Gentoo laptop (as one ought to rise to the challenge!) but it seems that 
Linux is also struggling to get to it:
==========================================
usb 2-1: new full speed USB device using uhci_hcd and address 2
usb 2-1: configuration #1 chosen from 1 choice
scsi0 : SCSI emulation for USB Mass Storage devices
usb-storage: device found at 2
usb-storage: waiting for device to settle before scanning
scsi 0:0:0:0: Direct-Access              USB BAR          1.89 PQ: 0 ANSI: 2
SCSI device sda: 255744 512-byte hdwr sectors (131 MB)
sda: Write Protect is off
sda: Mode Sense: 03 00 00 00
sda: assuming drive cache: write through
SCSI device sda: 255744 512-byte hdwr sectors (131 MB)
sda: Write Protect is off
sda: Mode Sense: 03 00 00 00
sda: assuming drive cache: write through
 sda: unknown partition table
sd 0:0:0:0: Attached scsi removable disk sda
sd 0:0:0:0: Attached scsi generic sg0 type 0
usb-storage: device scan complete
UDF-fs: No VRS found
Unable to identify CD-ROM format.
FAT: bogus logical sector size 65535
VFS: Can't find a valid FAT filesystem on dev sda.
NTFS-fs warning (device sda): is_boot_sector_ntfs(): Invalid boot sector 
checksum.
NTFS-fs error (device sda): read_ntfs_boot_sector(): Primary boot sector is 
invalid.
NTFS-fs error (device sda): read_ntfs_boot_sector(): Mount option 
errors=recover not used. Aborting without trying to recover.
NTFS-fs error (device sda): ntfs_fill_super(): Not an NTFS volume.
hfs: can't find a HFS filesystem on dev sda.
VFS: Can't find ext3 filesystem on dev sda.
VFS: Can't find an ext2 filesystem on dev sda.
ReiserFS: sda: warning: sh-2021: reiserfs_fill_super: can not find reiserfs on 
sda
==========================================

I tried to dd the boot sector so that I can look at it on my hard drive, but 
it cannot access /dev/sda.  Is there anything that I can do with my Gentoo to 
recover the files on this USB?
-- 
Regards,
Mick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Corrupt USB pen drive

[Elias Probst]

[-- Attachment #1: Type: text/plain, Size: 747 bytes --]

On Thursday 17 May 2007 13:36:25 Mick wrote:
> Hi All,
>
> A colleague used a USB stick on his home machine and when he brought it to
> work he can no longer access it using WinXP.  I offered to help with my
> Gentoo laptop (as one ought to rise to the challenge!) but it seems that
> Linux is also struggling to get to it:
> .................
>
> I tried to dd the boot sector so that I can look at it on my hard drive,
> but it cannot access /dev/sda.  Is there anything that I can do with my
> Gentoo to recover the files on this USB?

Try the PhotoRec tool from app-admin/testdisk
It recovers a lot of different file formats.

Regards, Elias P.

-- 
A really nice number:
"09:F9:11:02:9D:74:E3:5B:D8:41:56:C5:63:56:88:C0"

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Corrupt USB pen drive

[Mick]

[-- Attachment #1: Type: text/plain, Size: 510 bytes --]

On Thursday 17 May 2007 12:51, Elias Probst wrote:
> On Thursday 17 May 2007 13:36:25 Mick wrote:

> > I tried to dd the boot sector so that I can look at it on my hard drive,
> > but it cannot access /dev/sda.  Is there anything that I can do with my
> > Gentoo to recover the files on this USB?
>
> Try the PhotoRec tool from app-admin/testdisk
> It recovers a lot of different file formats.

Thanks Elias,

I tried photorec, but it will only see mounted partitions.  :-(

-- 
Regards,
Mick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Corrupt USB pen drive

[Dan Farrell]

On Thu, 17 May 2007 12:36:25 +0100
Mick <michaelkintzios@gmail.com> wrote:

> Hi All,
> 
> A colleague used a USB stick on his home machine and when he brought
> it to work he can no longer access it using WinXP.  I offered to help
> with my Gentoo laptop (as one ought to rise to the challenge!) but it
> seems that Linux is also struggling to get to it:
> ==========================================
> usb 2-1: new full speed USB device using uhci_hcd and address 2
> usb 2-1: configuration #1 chosen from 1 choice
> scsi0 : SCSI emulation for USB Mass Storage devices
> usb-storage: device found at 2
> usb-storage: waiting for device to settle before scanning
> scsi 0:0:0:0: Direct-Access              USB BAR          1.89 PQ: 0
> ANSI: 2 SCSI device sda: 255744 512-byte hdwr sectors (131 MB)
> sda: Write Protect is off
> sda: Mode Sense: 03 00 00 00
> sda: assuming drive cache: write through
> SCSI device sda: 255744 512-byte hdwr sectors (131 MB)
> sda: Write Protect is off
> sda: Mode Sense: 03 00 00 00
> sda: assuming drive cache: write through
>  sda: unknown partition table
> sd 0:0:0:0: Attached scsi removable disk sda
> sd 0:0:0:0: Attached scsi generic sg0 type 0
> usb-storage: device scan complete
> UDF-fs: No VRS found
> Unable to identify CD-ROM format.
> FAT: bogus logical sector size 65535
> VFS: Can't find a valid FAT filesystem on dev sda.
> NTFS-fs warning (device sda): is_boot_sector_ntfs(): Invalid boot
> sector checksum.
> NTFS-fs error (device sda): read_ntfs_boot_sector(): Primary boot
> sector is invalid.
> NTFS-fs error (device sda): read_ntfs_boot_sector(): Mount option 
> errors=recover not used. Aborting without trying to recover.
> NTFS-fs error (device sda): ntfs_fill_super(): Not an NTFS volume.
> hfs: can't find a HFS filesystem on dev sda.
> VFS: Can't find ext3 filesystem on dev sda.
> VFS: Can't find an ext2 filesystem on dev sda.
> ReiserFS: sda: warning: sh-2021: reiserfs_fill_super: can not find
> reiserfs on sda
> ==========================================
> 
> I tried to dd the boot sector so that I can look at it on my hard
> drive, but it cannot access /dev/sda.  Is there anything that I can
> do with my Gentoo to recover the files on this USB?

have you tried reading raw from the device like 
| dd if=/dev/sda of=sda.image 
?  That might do the recovery.  How to get it out of the image is the
same problem but once the backup succeeds you can plug it into a
windows xp box and reformat, and you will probably end up with the same
partition structure as originally.  Then you can try to read the right
part of the image out of the image, once you get the numbers from fdisk
on the newly formatted drive, and end up with an image of sda1.  From
there you should be able to mount sda1 and read out the data, if it
isn't corrupted.  

I also am wondering what happened to the partition table.  I bet your
coworker has a security-compromised box at home (oh, runs windows?
right...)  At any rate, if the data is recoverable, it may be possible
to rebuild the partition table if you can find out where the partition
started and ended.  People have done it before, i've read online about
it.  
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Corrupt USB pen drive

[Mick]

[-- Attachment #1: Type: text/plain, Size: 1516 bytes --]

On Thursday 17 May 2007 15:45, Dan Farrell wrote:
> On Thu, 17 May 2007 12:36:25 +0100
>
> Mick <michaelkintzios@gmail.com> wrote:

> >
> > I tried to dd the boot sector so that I can look at it on my hard
> > drive, but it cannot access /dev/sda.  Is there anything that I can
> > do with my Gentoo to recover the files on this USB?
>
> have you tried reading raw from the device like
>
> | dd if=/dev/sda of=sda.image
>
> ?  That might do the recovery.  How to get it out of the image is the
> same problem but once the backup succeeds you can plug it into a
> windows xp box and reformat, and you will probably end up with the same
> partition structure as originally.  Then you can try to read the right
> part of the image out of the image, once you get the numbers from fdisk
> on the newly formatted drive, and end up with an image of sda1.  From
> there you should be able to mount sda1 and read out the data, if it
> isn't corrupted.

Thanks Dan, as I said above I tried to extract the MBR out of it by running:

dd if=/dev/sda of=/tmp/r1 bs=512

But couldn't access it whatsoever.

> I also am wondering what happened to the partition table.  I bet your
> coworker has a security-compromised box at home (oh, runs windows?
> right...)  At any rate, if the data is recoverable, it may be possible
> to rebuild the partition table if you can find out where the partition
> started and ended.  People have done it before, i've read online about
> it.

-- 
Regards,
Mick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Corrupt USB pen drive

[Dan Farrell]

On Thu, 17 May 2007 16:38:44 +0100
Mick <michaelkintzios@gmail.com> wrote:

> On Thursday 17 May 2007 15:45, Dan Farrell wrote:
> > On Thu, 17 May 2007 12:36:25 +0100
> >
> > Mick <michaelkintzios@gmail.com> wrote:
> 
> > >
> > > I tried to dd the boot sector so that I can look at it on my hard
> > > drive, but it cannot access /dev/sda.  Is there anything that I
> > > can do with my Gentoo to recover the files on this USB?
> >
> > have you tried reading raw from the device like
> >
> > | dd if=/dev/sda of=sda.image
> >
> > ?  That might do the recovery.  How to get it out of the image is
> > the same problem but once the backup succeeds you can plug it into a
> > windows xp box and reformat, and you will probably end up with the
> > same partition structure as originally.  Then you can try to read
> > the right part of the image out of the image, once you get the
> > numbers from fdisk on the newly formatted drive, and end up with an
> > image of sda1.  From there you should be able to mount sda1 and
> > read out the data, if it isn't corrupted.
> 
> Thanks Dan, as I said above I tried to extract the MBR out of it by
> running:
> 
> dd if=/dev/sda of=/tmp/r1 bs=512
> 
> But couldn't access it whatsoever.
> 
> > I also am wondering what happened to the partition table.  I bet
> > your coworker has a security-compromised box at home (oh, runs
> > windows? right...)  At any rate, if the data is recoverable, it may
> > be possible to rebuild the partition table if you can find out
> > where the partition started and ended.  People have done it before,
> > i've read online about it.
> 
Hmm!  Perhaps its broken.
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Corrupt USB pen drive

[Tim Allingham]

On Thu, 2007-05-17 at 16:38 +0100, Mick wrote:
> On Thursday 17 May 2007 15:45, Dan Farrell wrote:
> > On Thu, 17 May 2007 12:36:25 +0100
> >
> > Mick <michaelkintzios@gmail.com> wrote:
> 
> > >
> > > I tried to dd the boot sector so that I can look at it on my hard
> > > drive, but it cannot access /dev/sda.  Is there anything that I can
> > > do with my Gentoo to recover the files on this USB?
> >
> > have you tried reading raw from the device like
> >
> > | dd if=/dev/sda of=sda.image
> >
> > ?  That might do the recovery.  How to get it out of the image is the
> > same problem but once the backup succeeds you can plug it into a
> > windows xp box and reformat, and you will probably end up with the same
> > partition structure as originally.  Then you can try to read the right
> > part of the image out of the image, once you get the numbers from fdisk
> > on the newly formatted drive, and end up with an image of sda1.  From
> > there you should be able to mount sda1 and read out the data, if it
> > isn't corrupted.
> 
> Thanks Dan, as I said above I tried to extract the MBR out of it by running:
> 
> dd if=/dev/sda of=/tmp/r1 bs=512
> 
> But couldn't access it whatsoever.
> 
> > I also am wondering what happened to the partition table.  I bet your
> > coworker has a security-compromised box at home (oh, runs windows?
> > right...)  At any rate, if the data is recoverable, it may be possible
> > to rebuild the partition table if you can find out where the partition
> > started and ended.  People have done it before, i've read online about
> > it.
> 

Have you tried examining it physically? I've had a drive behave
similarly before, and it turned out to be an issue with one of the
solder joints on the crystal only having intermittent contact ( was
almost a dry join) - resoldering solved it and let me recover the data

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Corrupt USB pen drive

[Mick]

[-- Attachment #1: Type: text/plain, Size: 1670 bytes --]

On Thursday 17 May 2007 16:38, Mick wrote:
> On Thursday 17 May 2007 15:45, Dan Farrell wrote:
> > On Thu, 17 May 2007 12:36:25 +0100
> >
> > Mick <michaelkintzios@gmail.com> wrote:
> > > I tried to dd the boot sector so that I can look at it on my hard
> > > drive, but it cannot access /dev/sda.  Is there anything that I can
> > > do with my Gentoo to recover the files on this USB?
> >
> > have you tried reading raw from the device like
> >
> > | dd if=/dev/sda of=sda.image
> >
> > ?  That might do the recovery.  How to get it out of the image is the
> > same problem but once the backup succeeds you can plug it into a
> > windows xp box and reformat, and you will probably end up with the same
> > partition structure as originally.  Then you can try to read the right
> > part of the image out of the image, once you get the numbers from fdisk
> > on the newly formatted drive, and end up with an image of sda1.  From
> > there you should be able to mount sda1 and read out the data, if it
> > isn't corrupted.
>
> Thanks Dan, as I said above I tried to extract the MBR out of it by
> running:
>
> dd if=/dev/sda of=/tmp/r1 bs=512
>
> But couldn't access it whatsoever.
>

Oops! I could access it, but of course I had to try it as root!  Right, I've 
got it on my hard drive now, but still cannot mount it:
==================================
# mount -t vfat /dev/loop2 /tmp/r1
mount: wrong fs type, bad option, bad superblock on /dev/loop2,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so
==================================
-- 
Regards,
Mick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Corrupt USB pen drive

[Dan Farrell]

On Thu, 17 May 2007 17:04:21 +0100
Mick <michaelkintzios@gmail.com> wrote:

>>Thanks Dan, as I said above I tried to extract the MBR out of it by
>>running:
>>
>>dd if=/dev/sda of=/tmp/r1 bs=512
>>
>>But couldn't access it whatsoever.

> Oops! I could access it, but of course I had to try it as root!
> Right, I've got it on my hard drive now, but still cannot mount it:
> ==================================
> # mount -t vfat /dev/loop2 /tmp/r1
> mount: wrong fs type, bad option, bad superblock on /dev/loop2,
>        missing codepage or other error
>        In some cases useful info is found in syslog - try
>        dmesg | tail  or so
> ==================================

because the _disk_ sda doesn't house a filesystem, the _partiton_
sda1 does.  You need to find out where that partition started and ended
on the disk sda.  My thought was maybe windows would format it the same
way twice, in which case you can format and then get the partitioning
information out of the device, reformat, write the part of /tmp/r1 that
coincides with the partition, cross fingers, and try mounting.  
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Corrupt USB pen drive

[Tim Allingham]

[-- Attachment #1: Type: text/plain, Size: 1848 bytes --]

On Thu, 2007-05-17 at 17:04 +0100, Mick wrote:
> On Thursday 17 May 2007 16:38, Mick wrote:
> > On Thursday 17 May 2007 15:45, Dan Farrell wrote:
> > > On Thu, 17 May 2007 12:36:25 +0100
> > >
> > > Mick <michaelkintzios@gmail.com> wrote:
> > > > I tried to dd the boot sector so that I can look at it on my hard
> > > > drive, but it cannot access /dev/sda.  Is there anything that I can
> > > > do with my Gentoo to recover the files on this USB?
> > >
> > > have you tried reading raw from the device like
> > >
> > > | dd if=/dev/sda of=sda.image
> > >
> > > ?  That might do the recovery.  How to get it out of the image is the
> > > same problem but once the backup succeeds you can plug it into a
> > > windows xp box and reformat, and you will probably end up with the same
> > > partition structure as originally.  Then you can try to read the right
> > > part of the image out of the image, once you get the numbers from fdisk
> > > on the newly formatted drive, and end up with an image of sda1.  From
> > > there you should be able to mount sda1 and read out the data, if it
> > > isn't corrupted.
> >
> > Thanks Dan, as I said above I tried to extract the MBR out of it by
> > running:
> >
> > dd if=/dev/sda of=/tmp/r1 bs=512
> >
> > But couldn't access it whatsoever.
> >
> 
> Oops! I could access it, but of course I had to try it as root!  Right, I've 
> got it on my hard drive now, but still cannot mount it:
> ==================================
> # mount -t vfat /dev/loop2 /tmp/r1
> mount: wrong fs type, bad option, bad superblock on /dev/loop2,
>        missing codepage or other error
>        In some cases useful info is found in syslog - try
>        dmesg | tail  or so
> ==================================

Have you tried mounting with just

mount -o loop /dev/loop2 /tmp/r1

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Corrupt USB pen drive

[Etaoin Shrdlu]

On Thursday 17 May 2007 18:04, Mick wrote:

> > Thanks Dan, as I said above I tried to extract the MBR out of it by
> > running:
> >
> > dd if=/dev/sda of=/tmp/r1 bs=512
> >
> > But couldn't access it whatsoever.
>
> Oops! I could access it, but of course I had to try it as root! 
> Right, I've got it on my hard drive now, but still cannot mount it:
> ==================================
> # mount -t vfat /dev/loop2 /tmp/r1
> mount: wrong fs type, bad option, bad superblock on /dev/loop2,
>        missing codepage or other error
>        In some cases useful info is found in syslog - try
>        dmesg | tail  or so
> ==================================

IIRC, that is not the right syntax for mounting a loopback filesystem.
If /tmp/r1 is the file containing the filesystem, try

mount -o loop /tmp/r1 /mnt/somewhere

and make sure you have support for loopback devices in your kernel.
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Corrupt USB pen drive

[Mick]

[-- Attachment #1: Type: text/plain, Size: 3140 bytes --]

On Thursday 17 May 2007 23:27, Etaoin Shrdlu wrote:
> On Thursday 17 May 2007 18:04, Mick wrote:
> > > Thanks Dan, as I said above I tried to extract the MBR out of it by
> > > running:
> > >
> > > dd if=/dev/sda of=/tmp/r1 bs=512
> > >
> > > But couldn't access it whatsoever.
> >
> > Oops! I could access it, but of course I had to try it as root!
> > Right, I've got it on my hard drive now, but still cannot mount it:
> > ==================================
> > # mount -t vfat /dev/loop2 /tmp/r1
> > mount: wrong fs type, bad option, bad superblock on /dev/loop2,
> >        missing codepage or other error
> >        In some cases useful info is found in syslog - try
> >        dmesg | tail  or so
> > ==================================
>
> IIRC, that is not the right syntax for mounting a loopback filesystem.
> If /tmp/r1 is the file containing the filesystem, try
>
> mount -o loop /tmp/r1 /mnt/somewhere
>
> and make sure you have support for loopback devices in your kernel.

Thanks for all the suggestions.  I tried the correct mount loopback command 
on /dev/loop2 and I'm getting this error that mentions /dev/loop0 (how does 
this work?):
======================================
# mount -t vfat -o loop /dev/loop2 /tmp/r1
mount: wrong fs type, bad option, bad superblock on /dev/loop0,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so
======================================

Anyway, regarding a previous comment by Dan I tried accessing /dev/sda1 but it 
complained that the device does not exist, unlike /dev/sda which appears to 
be there.  I have a couple of USB sticks that also have no partition table 
(they are like floppies) and I access these as /dev/sda.  When I look at 
their few first bytes they look like this:
======================================
000000 eb 3c 90 4d 53 44 4f 53 35 2e 30 00 02 20 01 00
000010 02 00 02 00 00 f8 f4 00 3f 00 ff 00 00 00 00 00
000020 00 7a 1e 00 00 00 29 96 9d 62 60 4e 4f 20 4e 41
000030 4d 45 20 20 20 20 46 41 54 31 36 20 20 20 33 c9
======================================

On the other hand the corrupt disk looks like this:
======================================
000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
*
020000 01 df 02 df 03 df 04 df 05 df 06 df 07 df 08 df
020010 09 df 0a df 0b df 0c df 0d df 0e df 0f df 10 df
020020 11 df 12 df 13 df 14 df 15 df 16 df 17 df 18 df
020030 19 df 1a df 1b df 1c df 1d df 1e df 1f df 20 df
020040 21 df 22 df 23 df 24 df 25 df 26 df 27 df 28 df
020050 29 df 2a df 2b df 2c df ff ff 2e df 2f df 30 df
======================================
which makes me think that it has different partitions on it, but the partition 
table is corrupted.  Otherwise, I guess I would be able to access it 
through /dev/sda1.  So, the question now is how do I recreate/reconstruct it?  
I'll surely need some help with it because all this hex means nothing to me.

-- 
Regards,
Mick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Corrupt USB pen drive

[Etaoin Shrdlu]

On Friday 18 May 2007 10:29, Mick wrote:

> On Thursday 17 May 2007 23:27, Etaoin Shrdlu wrote:
> > IIRC, that is not the right syntax for mounting a loopback
> > filesystem. If /tmp/r1 is the file containing the filesystem, try
> >
> > mount -o loop /tmp/r1 /mnt/somewhere
> >
> > and make sure you have support for loopback devices in your kernel.
>
> Thanks for all the suggestions.  I tried the correct mount loopback
> command on /dev/loop2 and I'm getting this error that mentions
> /dev/loop0 (how does this work?):
> ======================================
> # mount -t vfat -o loop /dev/loop2 /tmp/r1
> mount: wrong fs type, bad option, bad superblock on /dev/loop0,
>        missing codepage or other error
>        In some cases useful info is found in syslog - try
>        dmesg | tail  or so
> ======================================

You still seem to be missing the correct syntax. (note: this might not 
solve your problem, and even issuing the right command might be of no 
help, but since you asked for it, here it is).

With every mount command, you have to specify at least two things: *what* 
to mount, and *where* to mount it, in this order. *Where* is usually a 
path to some (preferably empty) directory. *what* can be various things, 
depending on what you're trying to mount. For regular disk partitions, 
it's usually a device file (eg, /dev/sda1). For NFS, it's a string of 
the form remote_host:/remote/path. For loopback filesystems (ie, 
filesystems contained in a single file), it's the name of the container 
file, like your /tmp/r1. When mounting loopback filesystems, the "-o 
loop" option must be given. The "-o loop" option accepts some optional 
parameters. One of these is the specification of the loopback device 
that should be used.
To explicitly specify a loopback device, use "-o loop=/dev/loopX". If no 
loopback device is specificed, then mount will automatically pick an 
unused loopback device (probably /dev/loop0). Your command 

# mount -t vfat -o loop /dev/loop2 /tmp/r1

uses an incorrect syntax for the specification of the loopback device 
(which is optional anyway), and does not tell where to mount the 
filesystem. So, what you probably want is

# mount -t vfat -o loop=/dev/loop2 /tmp/r1 /mnt/somewhere

or just simply

# mount -t vfat -o loop /tmp/r1 /mnt/somewhere
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Corrupt USB pen drive

[Mick]

[-- Attachment #1: Type: text/plain, Size: 1418 bytes --]

On Friday 18 May 2007 10:24, Etaoin Shrdlu wrote:

> You still seem to be missing the correct syntax. (note: this might not
> solve your problem, and even issuing the right command might be of no
> help, but since you asked for it, here it is).
[snip . . . ]

Thanks!  Things don't always go as they should when I rush through commands - 
especially those I am not familiar with.  It's crystal clear now.

> # mount -t vfat -o loop /dev/loop2 /tmp/r1
>
> uses an incorrect syntax for the specification of the loopback device
> (which is optional anyway), and does not tell where to mount the
> filesystem. So, what you probably want is
>
> # mount -t vfat -o loop=/dev/loop2 /tmp/r1 /mnt/somewhere
>
> or just simply
>
> # mount -t vfat -o loop /tmp/r1 /mnt/somewhere

I am getting the same errors as before:
==========================================
# mount -t vfat -o loop /tmp/r1 /mnt/sda1
mount: wrong fs type, bad option, bad superblock on /dev/loop1,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so
==========================================

No matter if I use vfat, msdos, or ntfs.  It seems to me that I need to 
reconstruct the hex of the partition table - but don't know how to do this 
and testdisk does not see the device to recover previous partition tables.

What now?
-- 
Regards,
Mick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Corrupt USB pen drive

[Hans-Werner Hilse]

Hi,

On Fri, 18 May 2007 12:50:07 +0100 Mick <michaelkintzios@gmail.com>
wrote:

> I am getting the same errors as before:
> ==========================================
> # mount -t vfat -o loop /tmp/r1 /mnt/sda1
> mount: wrong fs type, bad option, bad superblock on /dev/loop1,
>        missing codepage or other error
>        In some cases useful info is found in syslog - try
>        dmesg | tail  or so
> ==========================================
> 
> No matter if I use vfat, msdos, or ntfs.  It seems to me that I need
> to reconstruct the hex of the partition table - but don't know how to
> do this and testdisk does not see the device to recover previous
> partition tables.

I'm pretty sure someone borked the first sectors of that stick. It
might have contained a partition table at some point in the past, and
the partition table might be gone now (HD mode). But there is also the
possibility that there wasn't a partition table but just a single
filesystem on the stick (superfloppy mode).

My suggestion is to take a hex editor and search for the start of a
partition. Most partition types are easily recognizable by some magic
bytes. It would, however, help a lot if you could tell what kind of
filesystem there was. If you found the start of the filesystem, just
use dd again and skip the bytes until the real start of the FS. You can
then mount the resulting file (w/o partitioning and such).

Did you try the recovery tools for the FS in question?

-hwh
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Corrupt USB pen drive

[Mick]

[-- Attachment #1: Type: text/plain, Size: 3720 bytes --]

On Friday 18 May 2007 13:25, Hans-Werner Hilse wrote:
> Hi,
>
> On Fri, 18 May 2007 12:50:07 +0100 Mick <michaelkintzios@gmail.com>
> wrote:

> > No matter if I use vfat, msdos, or ntfs.  It seems to me that I need
> > to reconstruct the hex of the partition table - but don't know how to
> > do this and testdisk does not see the device to recover previous
> > partition tables.
>
> I'm pretty sure someone borked the first sectors of that stick. It
> might have contained a partition table at some point in the past, and
> the partition table might be gone now (HD mode). But there is also the
> possibility that there wasn't a partition table but just a single
> filesystem on the stick (superfloppy mode).
>
> My suggestion is to take a hex editor and search for the start of a
> partition. Most partition types are easily recognizable by some magic
> bytes. It would, however, help a lot if you could tell what kind of
> filesystem there was. If you found the start of the filesystem, just
> use dd again and skip the bytes until the real start of the FS. You can
> then mount the resulting file (w/o partitioning and such).
>
> Did you try the recovery tools for the FS in question?

I tried fsck.msdos but didn't fix it.

Like most USB sticks I would assume that it is either FAT32 or FAT16.  Given 
that this is what I see when I dump the first few bytes, can you please tell 
me where the fs data starts and how to dd that without inc the initial 
partition table data?
==============================================
000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
*
020000 01 df 02 df 03 df 04 df 05 df 06 df 07 df 08 df
020010 09 df 0a df 0b df 0c df 0d df 0e df 0f df 10 df
020020 11 df 12 df 13 df 14 df 15 df 16 df 17 df 18 df
020030 19 df 1a df 1b df 1c df 1d df 1e df 1f df 20 df
020040 21 df 22 df 23 df 24 df 25 df 26 df 27 df 28 df
020050 29 df 2a df 2b df 2c df ff ff 2e df 2f df 30 df
020060 31 df 32 df 33 df 34 df 35 df 36 df 37 df 38 df
020070 39 df 3a df 3b df 3c df 3d df 3e df 3f df 40 df
020080 41 df 42 df 43 df 44 df 45 df 46 df 47 df 48 df
020090 49 df 4a df 4b df 4c df 4d df 4e df 4f df 50 df
0200a0 51 df 52 df 53 df 54 df 55 df 56 df 57 df 58 df
0200b0 59 df 5a df 5b df 5c df 5d df 5e df 5f df 60 df
0200c0 61 df 62 df 63 df 64 df 65 df 66 df 67 df 68 df
0200d0 69 df 6a df 6b df 6c df 6d df 6e df 6f df 70 df
[snip]

0202a0 51 e0 52 e0 53 e0 54 e0 55 e0 56 e0 57 e0 58 e0
0202b0 59 e0 5a e0 5b e0 5c e0 5d e0 5e e0 5f e0 60 e0
0202c0 61 e0 62 e0 63 e0 64 e0 65 e0 66 e0 4f 93 00 00
0202d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
020360 00 00 00 00 00 00 00 00 00 00 00 00 b7 e0 b8 e0
020370 b9 e0 ba e0 bb e0 bc e0 bd e0 be e0 bf e0 c0 e0
020380 c1 e0 c2 e0 c3 e0 c4 e0 c5 e0 c6 e0 c7 e0 c8 e0
020390 c9 e0 ca e0 cb e0 cc e0 cd e0 ce e0 cf e0 d0 e0
0203a0 d1 e0 d2 e0 d3 e0 d4 e0 d5 e0 d6 e0 d7 e0 d8 e0
[snip]

021ab0 59 ec 5a ec 5b ec 5c ec 5d ec 5e ec 5f ec 60 ec
021ac0 61 ec ff ff 63 ec 64 ec 65 ec 66 ec 67 ec 68 ec
021ad0 69 ec 6a ec 6b ec 6c ec 6d ec 6e ec 6f ec 70 ec
021ae0 71 ec ff ff 00 00 00 00 00 00 00 00 00 00 00 00
021af0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
022720 00 00 00 00 00 00 00 00 00 00 96 f2 97 f2 98 f2
022730 99 f2 9a f2 9b f2 9c f2 9d f2 9e f2 9f f2 a0 f2
022740 a1 f2 a2 f2 a3 f2 a4 f2 a5 f2 a6 f2 a7 f2 a8 f2
022750 a9 f2 aa f2 ab f2 ac f2 ad f2 ae f2 af f2 b0 f2
==============================================

I assume that the asterisks indicate a new file starting there?

Thanks for all your help.  :)
-- 
Regards,
Mick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Corrupt USB pen drive

[Dan Farrell]

On Fri, 18 May 2007 14:11:14 +0100
Mick <michaelkintzios@gmail.com> wrote:

> On Friday 18 May 2007 13:25, Hans-Werner Hilse wrote:
> > Hi,
> >
> > On Fri, 18 May 2007 12:50:07 +0100 Mick <michaelkintzios@gmail.com>
> > wrote:
> 
> > > No matter if I use vfat, msdos, or ntfs.  It seems to me that I
> > > need to reconstruct the hex of the partition table - but don't
> > > know how to do this and testdisk does not see the device to
> > > recover previous partition tables.
I agree that you probalby need to get the partition table, or at least
information about the partition in question.  Althought it is possibe
that the disk is all one filesystem, I have never seen windows do it
that way for a usb stick.  I assume it's all one big partition,
formatted vfat, just like all the others I've seen.  
> > I'm pretty sure someone borked the first sectors of that stick. It
> > might have contained a partition table at some point in the past,
> > and the partition table might be gone now (HD mode). 
I agree, this eems to be the case.  
> > But there is
> > also the possibility that there wasn't a partition table but just a
> > single filesystem on the stick (superfloppy mode).
> >
> > My suggestion is to take a hex editor and search for the start of a
> > partition. Most partition types are easily recognizable by some
> > magic bytes. It would, however, help a lot if you could tell what
> > kind of filesystem there was. If you found the start of the
> > filesystem, just use dd again and skip the bytes until the real
> > start of the FS. You can then mount the resulting file (w/o
> > partitioning and such).
I agree.  I've been reading about vfat filesystems a little and I think
this article http://en.wikipedia.org/wiki/VFAT seems to have all the
information we need.  However,
> ==============================================
> 000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
If there are zeroes all through here...
> 0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
> 000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
and FF's all through here, I'm not sure there's enough left over to
recover filesystem information.  
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Corrupt USB pen drive

[Hans-Werner Hilse]

Hi,

On Fri, 18 May 2007 14:11:14 +0100 Mick <michaelkintzios@gmail.com>
wrote:

> > Did you try the recovery tools for the FS in question?
> 
> I tried fsck.msdos but didn't fix it.

Doesn't make me wonder, as I'll explain below, there's no file system
starting at offset 0 in that image of your stick...

> Like most USB sticks I would assume that it is either FAT32 or
> FAT16.

I would have guessed that too. However: FAT file systems even carry
"FAT" as verbatim chars at the start of the partition... So it's quite
easy to spot the start of a FAT partition...

> Given that this is what I see when I dump the first few
> bytes, can you please tell me where the fs data starts and how to dd
> that without inc the initial partition table data?
> ==============================================
> 000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> *
> 0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa

I'll answer another question first: The asterisk indicates consecutive
lines w/ the same data. So here, we have a full block (512 bytes,
0x000-0x1ff) containing almost only zeros. It stops with a valid master
boot record magic number (0x55aa). This MBR doesn't contain anything,
so there's no partition table, either. It also might be a part of a FAT
file system's boot sector (the end-of-sector marker bytes).

> 000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
> *
> 020000 [...]

OK, so from 0x00200-0x1ffff it contains only consecutive 0xff bytes,
i.e. (0x20000 / 0x200) = 0x100 = 256 (dec) blocks (à 0x200=512 bytes).
That's nearly 128 kBytes of 0xff. I wonder how it got there. I think
all this indicates that there might have been some tool which overwrote
the first 128k of this stick with some "default data" or similar. At
least, the first 128k are modified and can't work this way, since
there's neither a valid MBR, nor a valid partition table nor a valid
file system at offset 0.

What's following next? I think it might be the tail of a FAT16 (the FAT
itself). This means there is no boot sector anymore. The boot sector is
not redundant for FAT file systems, so it would have to be recreated.
The FAT itself, however, is usually present a second time (see
http://en.wikipedia.org/wiki/File_Allocation_Table for details). It
clearly looks like FAT, since this we have a end-of-file indication:

> 020000 01 df 02 df 03 df 04 df 05 df 06 df 07 df 08 df
> 020010 09 df 0a df 0b df 0c df 0d df 0e df 0f df 10 df
> 020020 11 df 12 df 13 df 14 df 15 df 16 df 17 df 18 df
> 020030 19 df 1a df 1b df 1c df 1d df 1e df 1f df 20 df
> 020040 21 df 22 df 23 df 24 df 25 df 26 df 27 df 28 df
> 020050 29 df 2a df 2b df 2c df ff ff 2e df 2f df 30 df
                                 -----
> 020060 31 df 32 df 33 df 34 df 35 df 36 df 37 df 38 df
> [...]

All the rest of data you've quoted doesn't mean a lot, I think it's all
from the FAT. I would suggest you find out whether there's a full copy
of the FAT intact after the data you quoted. Just search for some of
the byte sequences you quoted here and if you're lucky, there's an
intact FAT later on. After the FATs, there will most probably be the
directory table. You should be able to look up the file names there
verbatim.

OK, but how to continue? You probably need a new boot sector and a
clean FAT. You can manually create one, but it's a tedious process.
Look at the FAT documentation and try to figure out cluster size
(probably Stick size / 65536) and so on. OTOH, you can try to create a
new FAT16 fs on media with the same size as the stick (e.g. 
"dd if=/dev/zero") and then try to "implant" the backup copy of your
FAT (two times, once as new primary FAT, once as a secondary FAT) and
directory table and of course the data into that new FAT16.

Unfortunately, by default it seems that the backup copy of the FAT
itself for a 255744 sector Stick defaults to start at 0x1f600. So a
considerable amount even of the backup FAT would be destroyed if the
original layout resembles this geometry.

So at that point, there's not a lot you can do, aside from tools like
the mentioned Photorec and its commercial brothers, which can do a neat
job when you're back to heuristically determining start/stop of files
(which mustn't be too fragmented, of course) in a data stream.

-hwh
--
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Corrupt USB pen drive

[Etaoin Shrdlu]

On Friday 18 May 2007 16:48, Hans-Werner Hilse wrote:

> I'll answer another question first: The asterisk indicates consecutive
> lines w/ the same data. So here, we have a full block (512 bytes,
> 0x000-0x1ff) containing almost only zeros. It stops with a valid
> master boot record magic number (0x55aa). This MBR doesn't contain
> anything, so there's no partition table, either. It also might be a
> part of a FAT file system's boot sector (the end-of-sector marker
> bytes).
>[cut]

I did not know about the meaning of the asterisk...so your explanation 
does make more sense than mine. Thanks for clearing up things.
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Corrupt USB pen drive

[Etaoin Shrdlu]

On Friday 18 May 2007 15:11, Mick wrote:

> On Friday 18 May 2007 13:25, Hans-Werner Hilse wrote:
> > Did you try the recovery tools for the FS in question?
>
> I tried fsck.msdos but didn't fix it.
>
> Like most USB sticks I would assume that it is either FAT32 or FAT16. 
> Given that this is what I see when I dump the first few bytes, can you
> please tell me where the fs data starts and how to dd that without inc
> the initial partition table data?
> ==============================================
> 000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> *
> 0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
> 000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
> *
> 020000 01 df 02 df 03 df 04 df 05 df 06 df 07 df 08 df
>
>[cut]
> I assume that the asterisks indicate a new file starting there?

Are you using hexdump to read the data? Does the above output come from 
hexdumping the actual device or the image file?

The asterisks look strange. If you look carefully, you see that each 
asterisk does not merely replace a single line of output, but several 
lines. Look at the addresses of the lines before and after: for example, 
000200 -> asterisk -> 020000 in your output above. So, that asterisk 
represents 0x020000 - 0x000210 =  0x1fdf0 bytes, ie 130544 bytes. If the 
dump comes from the actual device (like I suppose), it could be that 
these bytes are skipped because they are somehow unreadable, so it's 
really difficult to compare this output with one from a working device, 
in either HD or superfloppy mode. In particular, there is an asterisk 
immediately after the first 16 bytes (line 000000), and the dump 
continues at byte 0x0001f0 (496 decimal), and this means that the very 
first sector (where the interesting stuff is) is almost entirely damaged 
or otherwise unreadable.
Also, trying to dd the device to a file as you did would almost certainly 
insert unpredictable garbage in the file to represent the unreadable 
parts of the device.

Chances are it was in HD mode (ie, with a partition table), because the 
signature at the end of the first 512 bytes (the "55 aa" at the end of 
the 0001f0 line) indicates a boot sector (the MBR).
Within this boot sector, the partition table is 64 bytes long and usually 
lives from byte 446 to byte 509 of the sector (512 bytes long, numbered 
from 0 to 511; bytes 510 and 511 are the signature). Since a partition 
table is composed of four records, each 16 bytes long, this means you 
have only the last 14 bytes of the fourth partition table record. But, 
it's very very likely that there was only a single partition, and thus 
the fourth record is unused and set to all zeros. What you would need is 
the value of the bytes from 446 to 461 (the first partition table 
record, which has info about the first partition), but, as I said above, 
all this data seems to be lost in the asterisk, like tears in the rain 
(cit.).

Bottom line: I would not bet on data recovery from that stick.
It's also true that there might be some program I'm unaware of which 
could try or be able to recover things, but unfortunately I have no 
advice for you about this.
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Corrupt USB pen drive

[Mick]

[-- Attachment #1: Type: text/plain, Size: 1278 bytes --]

On Friday 18 May 2007 16:16, Etaoin Shrdlu wrote:
> On Friday 18 May 2007 15:11, Mick wrote:
> > On Friday 18 May 2007 13:25, Hans-Werner Hilse wrote:
> > > Did you try the recovery tools for the FS in question?
> >
> > I tried fsck.msdos but didn't fix it.
[snip... lot's of good advice]

> Bottom line: I would not bet on data recovery from that stick.
> It's also true that there might be some program I'm unaware of which
> could try or be able to recover things, but unfortunately I have no
> advice for you about this.

Guys, thank you sooo much!  I used fdisk to create a single partition FAT16 
fs.  Then I used testdisk which would not recover any partitions, but it 
could at least see the partition (despite the fact that I could not 
mount /dev/sda1 from the command line due to the previously reported errors).  
Then I used photorec which worked out its magic and recovered a load of files 
(some were corrupted) - wey hey!  :)

My friend is happy and so am I proving to him that Linux can save your skin - 
I'm no Linux evangelist, as I believe that there are "horses for courses", 
but I suspect we may have a convert.  Let's see if he starts asking for a 
Gentoo install CD next.  Ha!

Thanks again for your help.
-- 
Regards,
Mick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Corrupt USB pen drive [ot]

[Dan Farrell]

On Mon, 21 May 2007 10:47:03 +0100
Mick <michaelkintzios@gmail.com> wrote:

> I believe that there are "horses for courses"

me too, linux discs are for computers, windows discs make good
coasters.  ; ) 
-- 
gentoo-user@gentoo.org mailing list

[gentoo-user] Re: Corrupt USB pen drive

[Francesco Talamona]

On Thursday 17 May 2007, Mick wrote:
> Hi All,
>
> A colleague used a USB stick on his home machine and when he brought
> it to work he can no longer access it using WinXP.  I offered to help
> with my Gentoo laptop (as one ought to rise to the challenge!) but it
> seems that Linux is also struggling to get to it:
> ==========================================
> usb 2-1: new full speed USB device using uhci_hcd and address 2
> usb 2-1: configuration #1 chosen from 1 choice
> scsi0 : SCSI emulation for USB Mass Storage devices
> usb-storage: device found at 2
> usb-storage: waiting for device to settle before scanning
> scsi 0:0:0:0: Direct-Access              USB BAR          1.89 PQ: 0
> ANSI: 2 SCSI device sda: 255744 512-byte hdwr sectors (131 MB)
> sda: Write Protect is off
> sda: Mode Sense: 03 00 00 00
> sda: assuming drive cache: write through
> SCSI device sda: 255744 512-byte hdwr sectors (131 MB)
> sda: Write Protect is off
> sda: Mode Sense: 03 00 00 00
> sda: assuming drive cache: write through
>  sda: unknown partition table
> sd 0:0:0:0: Attached scsi removable disk sda
> sd 0:0:0:0: Attached scsi generic sg0 type 0
> usb-storage: device scan complete
> UDF-fs: No VRS found
> Unable to identify CD-ROM format.
> FAT: bogus logical sector size 65535
> VFS: Can't find a valid FAT filesystem on dev sda.
> NTFS-fs warning (device sda): is_boot_sector_ntfs(): Invalid boot
> sector checksum.
> NTFS-fs error (device sda): read_ntfs_boot_sector(): Primary boot
> sector is invalid.
> NTFS-fs error (device sda): read_ntfs_boot_sector(): Mount option
> errors=recover not used. Aborting without trying to recover.
> NTFS-fs error (device sda): ntfs_fill_super(): Not an NTFS volume.
> hfs: can't find a HFS filesystem on dev sda.
> VFS: Can't find ext3 filesystem on dev sda.
> VFS: Can't find an ext2 filesystem on dev sda.
> ReiserFS: sda: warning: sh-2021: reiserfs_fill_super: can not find
> reiserfs on sda
> ==========================================
>
> I tried to dd the boot sector so that I can look at it on my hard
> drive, but it cannot access /dev/sda.  Is there anything that I can
> do with my Gentoo to recover the files on this USB?

If you have usb support built modular in the kernel it worth a try to 
force the laptopo to USB 1.1 so it can read a reluctant key (I once had 
a key that stopped working on USB 2.0 but was perfectly readable by 
older PCs).

You can then try ddrescue, a dd clone that is specifically designed to 
skip errors on bad media for recovery attempt.

Good luck
	Francesco.

-- 
Linux Version 2.6.21-gentoo, Compiled #1 PREEMPT Mon Apr 30 21:45:34 
CEST 2007
One 1GHz AMD Athlon 64 Processor, 2GB RAM, 2004.01 Bogomips Total
aemaeth
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Corrupt USB pen drive

[Etaoin Shrdlu]

On Thursday 17 May 2007 13:36, Mick wrote:

> A colleague used a USB stick on his home machine and when he brought
> it to work he can no longer access it using WinXP.  I offered to help
> with my Gentoo laptop (as one ought to rise to the challenge!) but it
> seems that Linux is also struggling to get to it:
>[cut]
> sda: assuming drive cache: write through
>  sda: unknown partition table

Might not help you in this case, but I seem to remember that, for some 
USB pens at least, if you format the drive using the windows "utility" 
that comes with the device, it screws up the partition table and uses 
the whole /dev/sda device to create a single fat32 filesystem. I'm 
fairly sure I saw one of two of these in the past.

So, have you tried mounting it using just

mount -t vfat /dev/sda /mnt/somewhere

?
-- 
gentoo-user@gentoo.org mailing list