Re: [gentoo-user] Corrupt USB pen drive

[Mick <michaelkintzios@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 3720 bytes --]

On Friday 18 May 2007 13:25, Hans-Werner Hilse wrote:
> Hi,
>
> On Fri, 18 May 2007 12:50:07 +0100 Mick <michaelkintzios@gmail.com>
> wrote:

> > No matter if I use vfat, msdos, or ntfs.  It seems to me that I need
> > to reconstruct the hex of the partition table - but don't know how to
> > do this and testdisk does not see the device to recover previous
> > partition tables.
>
> I'm pretty sure someone borked the first sectors of that stick. It
> might have contained a partition table at some point in the past, and
> the partition table might be gone now (HD mode). But there is also the
> possibility that there wasn't a partition table but just a single
> filesystem on the stick (superfloppy mode).
>
> My suggestion is to take a hex editor and search for the start of a
> partition. Most partition types are easily recognizable by some magic
> bytes. It would, however, help a lot if you could tell what kind of
> filesystem there was. If you found the start of the filesystem, just
> use dd again and skip the bytes until the real start of the FS. You can
> then mount the resulting file (w/o partitioning and such).
>
> Did you try the recovery tools for the FS in question?

I tried fsck.msdos but didn't fix it.

Like most USB sticks I would assume that it is either FAT32 or FAT16.  Given 
that this is what I see when I dump the first few bytes, can you please tell 
me where the fs data starts and how to dd that without inc the initial 
partition table data?
==============================================
000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
*
020000 01 df 02 df 03 df 04 df 05 df 06 df 07 df 08 df
020010 09 df 0a df 0b df 0c df 0d df 0e df 0f df 10 df
020020 11 df 12 df 13 df 14 df 15 df 16 df 17 df 18 df
020030 19 df 1a df 1b df 1c df 1d df 1e df 1f df 20 df
020040 21 df 22 df 23 df 24 df 25 df 26 df 27 df 28 df
020050 29 df 2a df 2b df 2c df ff ff 2e df 2f df 30 df
020060 31 df 32 df 33 df 34 df 35 df 36 df 37 df 38 df
020070 39 df 3a df 3b df 3c df 3d df 3e df 3f df 40 df
020080 41 df 42 df 43 df 44 df 45 df 46 df 47 df 48 df
020090 49 df 4a df 4b df 4c df 4d df 4e df 4f df 50 df
0200a0 51 df 52 df 53 df 54 df 55 df 56 df 57 df 58 df
0200b0 59 df 5a df 5b df 5c df 5d df 5e df 5f df 60 df
0200c0 61 df 62 df 63 df 64 df 65 df 66 df 67 df 68 df
0200d0 69 df 6a df 6b df 6c df 6d df 6e df 6f df 70 df
[snip]

0202a0 51 e0 52 e0 53 e0 54 e0 55 e0 56 e0 57 e0 58 e0
0202b0 59 e0 5a e0 5b e0 5c e0 5d e0 5e e0 5f e0 60 e0
0202c0 61 e0 62 e0 63 e0 64 e0 65 e0 66 e0 4f 93 00 00
0202d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
020360 00 00 00 00 00 00 00 00 00 00 00 00 b7 e0 b8 e0
020370 b9 e0 ba e0 bb e0 bc e0 bd e0 be e0 bf e0 c0 e0
020380 c1 e0 c2 e0 c3 e0 c4 e0 c5 e0 c6 e0 c7 e0 c8 e0
020390 c9 e0 ca e0 cb e0 cc e0 cd e0 ce e0 cf e0 d0 e0
0203a0 d1 e0 d2 e0 d3 e0 d4 e0 d5 e0 d6 e0 d7 e0 d8 e0
[snip]

021ab0 59 ec 5a ec 5b ec 5c ec 5d ec 5e ec 5f ec 60 ec
021ac0 61 ec ff ff 63 ec 64 ec 65 ec 66 ec 67 ec 68 ec
021ad0 69 ec 6a ec 6b ec 6c ec 6d ec 6e ec 6f ec 70 ec
021ae0 71 ec ff ff 00 00 00 00 00 00 00 00 00 00 00 00
021af0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
022720 00 00 00 00 00 00 00 00 00 00 96 f2 97 f2 98 f2
022730 99 f2 9a f2 9b f2 9c f2 9d f2 9e f2 9f f2 a0 f2
022740 a1 f2 a2 f2 a3 f2 a4 f2 a5 f2 a6 f2 a7 f2 a8 f2
022750 a9 f2 aa f2 ab f2 ac f2 ad f2 ae f2 af f2 b0 f2
==============================================

I assume that the asterisks indicate a new file starting there?

Thanks for all your help.  :)
-- 
Regards,
Mick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]