[gentoo-user] flash drive FAT partition disappears

[gentoo-user] flash drive FAT partition disappears

[Alan E. Davis]

[-- Attachment #1: Type: text/plain, Size: 875 bytes --]

I can't think of a specific place to look for this, so will try the
eclectics at gentoo-user.

A student handed me a USB flash drive with a video file on it he wanted to
offer to me to watch.  It mounted automatically, I copied the file, then I
took the disk out of the drive and gave it to him.  I cannot say with 100%
certainty that I unmounted it.  The file was completely copied.  I am pretty
careful, so I think I unmounted it.

Today he came back to me, asking what happened to his disk.  He said nothing
it there anymore.  I checked.  Gparted says this drive (4 GB I think) has 2
Terabytes of unallocated space.  None of the Windoze gurus (so to speak)
around here know what to do.

Any ideas?   I'm afraid the little bit of progress I've made over the past
13 years in advocating GNU/Linux and Free Softwrae, will be lost if this
problem isn't solved.

Thanks,

Alan

[-- Attachment #2: Type: text/html, Size: 959 bytes --]

Re: [gentoo-user] flash drive FAT partition disappears

[Jesús Guerrero]

Hello, first, the disclaimer: take everything I'll say here as a starting
point, not as an universal truth. I am by no means specialist in this kind
of toys. 

On Thu, 19 Nov 2009 02:46:36 +0000, "Alan E. Davis" <lngndvs@gmail.com>
wrote:
> I can't think of a specific place to look for this, so will try the
> eclectics at gentoo-user.
> 
> A student handed me a USB flash drive with a video file on it he wanted
to
> offer to me to watch.  It mounted automatically, I copied the file, then
I
> took the disk out of the drive and gave it to him.  I cannot say with
100%
> certainty that I unmounted it.  The file was completely copied.  I am
> pretty
> careful, so I think I unmounted it.

Even if you didn't, in my understanding, all that could cause (normally)
is a broken file system. The effects will usually depends on whatever was
happening at the moment, and at the fs you are using. Some mount options
can influence this as well. To palliate the effects of a catastrophic plug
off without having umounted before you can use the -osync mount option,
which will enable synchronous writes (making your device seems slower,
because writes will no longer be deferred/cached for a later oportunity).

But, that's not a substitute for a true umount, or a sync. It's just a way
to shorten the scope of any possible problem if you accidentelly unplug the
drive without having used umount first.

As a note, FAT is not precisely known for being too solid.

> Today he came back to me, asking what happened to his disk.  He said
> nothing
> it there anymore.  I checked.  Gparted says this drive (4 GB I think)
has 2
> Terabytes of unallocated space.  None of the Windoze gurus (so to speak)
> around here know what to do.
> 
> Any ideas?   I'm afraid the little bit of progress I've made over the
past
> 13 years in advocating GNU/Linux and Free Softwrae, will be lost if this
> problem isn't solved.

Your problem with the size of the drive is a bit more alarming. It could
be a problem in your partition table. In that case, the chance is high that
testdisk can guess a valid partition table and restore the drive to a
working state. However, it could also be a fortuitous electric accident
that fried the unit, that happens sometimes, and it has nothing to do with
you or linux. In any case, and to max the chance to recover anything, the
first thing you should be doing is an image of the device, using dd, just
in case.

All this, assuming that the student didn't already mess up the drive.
Anyway, if s/he truly saved the only copy of anything important in a
pendrive and then sent it around the world, s/he almost deserves any pain
that could derive from that action.

-- 
Jesús Guerrero

Re: [gentoo-user] flash drive FAT partition disappears

[Philip Webb]

091119 Alan E. Davis wrote:
> A student handed me a USB flash drive with a video file on it
> he wanted to offer to me to watch.  It mounted automatically,
> I copied the file, then I took the disk out and gave it to him.
> I cannot say with 100% certainty that I unmounted it.
> The file was completely copied.
> Today he came back asking what happened to his disk, nothing there anymore.
> I checked.  Gparted says this drive (4 GB I think)
> has  2 Terabytes of unallocated space.
         ^^^^^^^^^ surely not on a USB drive ??

A few quick suggestions: (1) you told it 'mv', not 'cp' (I've done that);
(2) he did something with it after he got it back (people do);
(3) he brought back a different USB stick (people mix them up);
(3) why don't you simply reformat the drive as Vfat for him
& copy the video file back onto it ?  did it contain other items too ?
-- Surely, nothing you can have done would have deleted a partition !

-- 
========================,,============================================
SUPPORT     ___________//___,   Philip Webb
ELECTRIC   /] [] [] [] [] []|   Cities Centre, University of Toronto
TRANSIT    `-O----------O---'   purslowatchassdotutorontodotca

Re: [gentoo-user] flash drive FAT partition disappears

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 1128 bytes --]

On Thu, 19 Nov 2009 04:30:46 +0100, Jesús Guerrero wrote:

> Even if you didn't, in my understanding, all that could cause (normally)
> is a broken file system. The effects will usually depends on whatever
> was happening at the moment, and at the fs you are using.

As he was only reading from the drive, I doubt he could have corrupted
the filesystem, let alone the partition table.

> Some mount
> options can influence this as well. To palliate the effects of a
> catastrophic plug off without having umounted before you can use the
> -osync mount option, which will enable synchronous writes (making your
> device seems slower, because writes will no longer be deferred/cached
> for a later oportunity).

However, these increase writes to the device, particularly to the FAT,
shortening the life of the drive.

I suspect you did nothing wrong and that the problem is either a
coincidental hardware failure or something the owner did to the stick
after you returned it. Convincing the owner of that is another matter.


-- 
Neil Bothwick

Of all the people I've met you're certainly one of them

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] flash drive FAT partition disappears

[Stroller]

On 19 Nov 2009, at 03:30, Jesús Guerrero wrote:
> ... In any case, and to max the chance to recover anything, the
> first thing you should be doing is an image of the device, using dd,  
> just
> in case.

This.

Then run Photorec on the image.
http://www.cgsecurity.org/wiki/PhotoRec

Stroller.

Re: [gentoo-user] flash drive FAT partition disappears

[Marcus Wanner]

On 11/19/2009 3:22 AM, Neil Bothwick wrote:
> I suspect you did nothing wrong and that the problem is either a
> coincidental hardware failure or something the owner did to the stick
> after you returned it. Convincing the owner of that is another matter.
>   
I am pretty sure that this is the case. The fact that the partition 
table is no longer valid is very interesting, and I would be interested 
in seeing the first 512 bytes (I believe that is where the partition 
table resides) of the dd image, if you can make one, just to see if it's 
corrupt or has been correctly erased. The fact that there is 2 TB left 
according to gparted leads me to believe that it is corrupt, which would 
mean that it is probably a hardware failure, and nothing to do with 
Linux, as someone else said.

Good luck with that student, here's hoping there was nothing important 
on that drive when it died!

Marcus

Re: [gentoo-user] flash drive FAT partition disappears

[Paul Hartman]

On Thu, Nov 19, 2009 at 2:11 PM, Marcus Wanner <marcusw@cox.net> wrote:
> On 11/19/2009 3:22 AM, Neil Bothwick wrote:
>>
>> I suspect you did nothing wrong and that the problem is either a
>> coincidental hardware failure or something the owner did to the stick
>> after you returned it. Convincing the owner of that is another matter.
>>
>
> I am pretty sure that this is the case. The fact that the partition table is
> no longer valid is very interesting, and I would be interested in seeing the
> first 512 bytes (I believe that is where the partition table resides) of the
> dd image, if you can make one, just to see if it's corrupt or has been
> correctly erased. The fact that there is 2 TB left according to gparted
> leads me to believe that it is corrupt, which would mean that it is probably
> a hardware failure, and nothing to do with Linux, as someone else said.
>
> Good luck with that student, here's hoping there was nothing important on
> that drive when it died!
>
> Marcus

On the bright side, if ONLY the partition table was corrupt, maybe
re-creating it with fdisk might make the data accessible again. You
might also try a tool like dfsee which might be able to analyse or
extract some partiton/FAT data from it.