* Re: [gentoo-user] Corrupt USB pen drive
@ 2007-05-18 15:16 99% ` Etaoin Shrdlu
0 siblings, 0 replies; 1+ results
From: Etaoin Shrdlu @ 2007-05-18 15:16 UTC (permalink / raw
To: gentoo-user
On Friday 18 May 2007 15:11, Mick wrote:
> On Friday 18 May 2007 13:25, Hans-Werner Hilse wrote:
> > Did you try the recovery tools for the FS in question?
>
> I tried fsck.msdos but didn't fix it.
>
> Like most USB sticks I would assume that it is either FAT32 or FAT16.
> Given that this is what I see when I dump the first few bytes, can you
> please tell me where the fs data starts and how to dd that without inc
> the initial partition table data?
> ==============================================
> 000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> *
> 0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
> 000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
> *
> 020000 01 df 02 df 03 df 04 df 05 df 06 df 07 df 08 df
>
>[cut]
> I assume that the asterisks indicate a new file starting there?
Are you using hexdump to read the data? Does the above output come from
hexdumping the actual device or the image file?
The asterisks look strange. If you look carefully, you see that each
asterisk does not merely replace a single line of output, but several
lines. Look at the addresses of the lines before and after: for example,
000200 -> asterisk -> 020000 in your output above. So, that asterisk
represents 0x020000 - 0x000210 = 0x1fdf0 bytes, ie 130544 bytes. If the
dump comes from the actual device (like I suppose), it could be that
these bytes are skipped because they are somehow unreadable, so it's
really difficult to compare this output with one from a working device,
in either HD or superfloppy mode. In particular, there is an asterisk
immediately after the first 16 bytes (line 000000), and the dump
continues at byte 0x0001f0 (496 decimal), and this means that the very
first sector (where the interesting stuff is) is almost entirely damaged
or otherwise unreadable.
Also, trying to dd the device to a file as you did would almost certainly
insert unpredictable garbage in the file to represent the unreadable
parts of the device.
Chances are it was in HD mode (ie, with a partition table), because the
signature at the end of the first 512 bytes (the "55 aa" at the end of
the 0001f0 line) indicates a boot sector (the MBR).
Within this boot sector, the partition table is 64 bytes long and usually
lives from byte 446 to byte 509 of the sector (512 bytes long, numbered
from 0 to 511; bytes 510 and 511 are the signature). Since a partition
table is composed of four records, each 16 bytes long, this means you
have only the last 14 bytes of the fourth partition table record. But,
it's very very likely that there was only a single partition, and thus
the fourth record is unused and set to all zeros. What you would need is
the value of the bytes from 446 to 461 (the first partition table
record, which has info about the first partition), but, as I said above,
all this data seems to be lost in the asterisk, like tears in the rain
(cit.).
Bottom line: I would not bet on data recovery from that stick.
It's also true that there might be some program I'm unaware of which
could try or be able to recover things, but unfortunately I have no
advice for you about this.
--
gentoo-user@gentoo.org mailing list
^ permalink raw reply [relevance 99%]
Results 1-1 of 1 | reverse | options above
-- pct% links below jump to the message on this page, permalinks otherwise --
2007-05-17 11:36 [gentoo-user] Corrupt USB pen drive Mick
2007-05-18 12:25 ` Hans-Werner Hilse
2007-05-18 13:11 ` Mick
2007-05-18 15:16 99% ` Etaoin Shrdlu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox