From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org) by nuthatch.gentoo.org with esmtp (Exim 4.62) (envelope-from ) id 1Hp3Ek-0000Zb-KC for garchives@archives.gentoo.org; Fri, 18 May 2007 14:15:19 +0000 Received: from robin.gentoo.org (localhost [127.0.0.1]) by robin.gentoo.org (8.14.0/8.14.0) with SMTP id l4IEE0EX013734; Fri, 18 May 2007 14:14:00 GMT Received: from spore.ath.cx (c-24-245-14-14.hsd1.mn.comcast.net [24.245.14.14]) by robin.gentoo.org (8.14.0/8.14.0) with ESMTP id l4IE7794002564 for ; Fri, 18 May 2007 14:07:07 GMT Received: from voyager.g.spore.ath.cx (voyager.g.spore.ath.cx [192.168.2.115]) by spore.ath.cx (Postfix) with ESMTP id 671354E2C4 for ; Fri, 18 May 2007 09:07:06 -0500 (CDT) Date: Fri, 18 May 2007 09:09:17 -0500 From: Dan Farrell To: gentoo-user@lists.gentoo.org Subject: Re: [gentoo-user] Corrupt USB pen drive Message-ID: <20070518090917.07abb935@voyager.g.spore.ath.cx> In-Reply-To: <200705181411.23476.michaelkintzios@gmail.com> References: <200705171236.28695.michaelkintzios@gmail.com> <200705181250.17314.michaelkintzios@gmail.com> <20070518142540.4bf077f2.hilse@web.de> <200705181411.23476.michaelkintzios@gmail.com> Organization: Spore Ltd X-Mailer: Claws Mail 2.9.1 (GTK+ 2.10.9; i686-pc-linux-gnu) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@gentoo.org Reply-to: gentoo-user@lists.gentoo.org Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Archives-Salt: 431d1076-8f82-473b-8f4d-6b1486703e34 X-Archives-Hash: 3878fe01ec84669cf41bcd95cfffcfdf On Fri, 18 May 2007 14:11:14 +0100 Mick wrote: > On Friday 18 May 2007 13:25, Hans-Werner Hilse wrote: > > Hi, > > > > On Fri, 18 May 2007 12:50:07 +0100 Mick > > wrote: > > > > No matter if I use vfat, msdos, or ntfs. It seems to me that I > > > need to reconstruct the hex of the partition table - but don't > > > know how to do this and testdisk does not see the device to > > > recover previous partition tables. I agree that you probalby need to get the partition table, or at least information about the partition in question. Althought it is possibe that the disk is all one filesystem, I have never seen windows do it that way for a usb stick. I assume it's all one big partition, formatted vfat, just like all the others I've seen. > > I'm pretty sure someone borked the first sectors of that stick. It > > might have contained a partition table at some point in the past, > > and the partition table might be gone now (HD mode). I agree, this eems to be the case. > > But there is > > also the possibility that there wasn't a partition table but just a > > single filesystem on the stick (superfloppy mode). > > > > My suggestion is to take a hex editor and search for the start of a > > partition. Most partition types are easily recognizable by some > > magic bytes. It would, however, help a lot if you could tell what > > kind of filesystem there was. If you found the start of the > > filesystem, just use dd again and skip the bytes until the real > > start of the FS. You can then mount the resulting file (w/o > > partitioning and such). I agree. I've been reading about vfat filesystems a little and I think this article http://en.wikipedia.org/wiki/VFAT seems to have all the information we need. However, > ============================================== > 000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 If there are zeroes all through here... > 0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa > 000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff and FF's all through here, I'm not sure there's enough left over to recover filesystem information. -- gentoo-user@gentoo.org mailing list