[gentoo-user] Corrupt xD card with photos

[gentoo-user] Corrupt xD card with photos

[Mick]

[-- Attachment #1: Type: text/plain, Size: 2810 bytes --]

Hi All,

I was handed what seems to be a corrupt xD flash card to extract the last 
photo from it.  When the WinXP system at work coughed and died on it 
(couldn't read it) I thought that my Linux would do better.  Anyhow, I've 
inserted it into my Fuji camera and this is what dmesg shows:

===================================================
usb 2-1: new full speed USB device using uhci_hcd and address 4
usb 2-1: configuration #1 chosen from 1 choice
scsi2 : SCSI emulation for USB Mass Storage devices
usb-storage: device found at 4
usb-storage: waiting for device to settle before scanning
  Vendor: FUJIFILM  Model: USB-DRIVEUNIT     Rev: 1.00
  Type:   Direct-Access                      ANSI SCSI revision: 00
SCSI device sda: 256000 512-byte hdwr sectors (131 MB)
sda: Write Protect is off
sda: Mode Sense: 07 00 00 00
sda: assuming drive cache: write through
SCSI device sda: 256000 512-byte hdwr sectors (131 MB)
sda: Write Protect is off
sda: Mode Sense: 07 00 00 00
sda: assuming drive cache: write through
 sda: unknown partition table
sd 2:0:0:0: Attached scsi removable disk sda
sd 2:0:0:0: Attached scsi generic sg0 type 0
usb-storage: device scan complete
====================================================

Mount fails:
====================================================
$ mount /dev/sda
mount: wrong fs type, bad option, bad superblock on /dev/sda,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so
====================================================

and dmesg then shows:
====================================================
FAT: bogus number of reserved sectors
VFS: Can't find a valid FAT filesystem on dev sda.
FAT: bogus number of reserved sectors
VFS: Can't find a valid FAT filesystem on dev sda.
====================================================

This is what fdisk shows:
====================================================
# fdisk /dev/sda
Device contains neither a valid DOS partition table, nor Sun, SGI or OSF 
disklabel
Building a new DOS disklabel. Changes will remain in memory only,
until you decide to write them. After that, of course, the previous
content won't be recoverable.

Warning: invalid flag 0x0000 of partition table 4 will be corrected by w(rite)

Command (m for help): p

Disk /dev/sda: 131 MB, 131072000 bytes
5 heads, 50 sectors/track, 1024 cylinders
Units = cylinders of 250 * 512 = 128000 bytes

   Device Boot      Start         End      Blocks   Id  System

Command (m for help): 

====================================================

Is there a Linux (or even M$Windoze?) way of me recovering the last photo, 
that doesn't involve reconstructing raw data with a hexeditor?
-- 
Regards,
Mick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Corrupt xD card with photos

[Richard Fish]

On 9/11/06, Mick <michaelkintzios@gmail.com> wrote:
> Mount fails:
> ====================================================
> $ mount /dev/sda
> mount: wrong fs type, bad option, bad superblock on /dev/sda,
>        missing codepage or other error
>        In some cases useful info is found in syslog - try
>        dmesg | tail  or so

What does "file -s /dev/sda" report?

-Richard
-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Corrupt xD card with photos

[Matthias Bethke]

[-- Attachment #1: Type: text/plain, Size: 815 bytes --]

Hi Mick,
on Monday, 2006-09-11 at 19:50:05, you wrote:
> Is there a Linux (or even M$Windoze?) way of me recovering the last photo, 
> that doesn't involve reconstructing raw data with a hexeditor?

I had the honor of being tasked by my wife with recovering photos from
the amorphous blob of data left over after some virus persuaded her
Windoze that it was a good idea to dump its memory all over the NTFS
root block. "recoverpics" finds pretty much every JFIF picture that is
in one piece, i.e. not in a fragmented file, no matter what the file
system. At 5k source it could be worth a try:
https://www.linguistik.uni-erlangen.de/~msbethke/software.html

HTH,
  Matthias
-- 
I prefer encrypted and signed messages. KeyID: FAC37665
Fingerprint: 8C16 3F0A A6FC DF0D 19B0  8DEF 48D9 1700 FAC3 7665

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Corrupt xD card with photos

[Mick]

[-- Attachment #1: Type: text/plain, Size: 519 bytes --]

On Monday 11 September 2006 21:37, Richard Fish wrote:
> On 9/11/06, Mick <michaelkintzios@gmail.com> wrote:
> > Mount fails:
> > ====================================================
> > $ mount /dev/sda
> > mount: wrong fs type, bad option, bad superblock on /dev/sda,
> >        missing codepage or other error
> >        In some cases useful info is found in syslog - try
> >        dmesg | tail  or so
>
> What does "file -s /dev/sda" report?

# file -s /dev/sda
/dev/sda: data

-- 
Regards,
Mick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Corrupt xD card with photos

[Mick]

[-- Attachment #1: Type: text/plain, Size: 1040 bytes --]

On Monday 11 September 2006 22:19, Matthias Bethke wrote:
> Hi Mick,
>
> on Monday, 2006-09-11 at 19:50:05, you wrote:
> > Is there a Linux (or even M$Windoze?) way of me recovering the last
> > photo, that doesn't involve reconstructing raw data with a hexeditor?
>
> I had the honor of being tasked by my wife with recovering photos from
> the amorphous blob of data left over after some virus persuaded her
> Windoze that it was a good idea to dump its memory all over the NTFS
> root block. "recoverpics" finds pretty much every JFIF picture that is
> in one piece, i.e. not in a fragmented file, no matter what the file
> system. At 5k source it could be worth a try:
> https://www.linguistik.uni-erlangen.de/~msbethke/software.html

Thanks Matthias,

How do I install it manually?  install tells me:

# install
install: missing file operand

So, I ran:

# install recoverpics.c recoverpics

Which didn't complain.  What next?  How do I run it?  Is there any 
documentation anywhere?

-- 
Regards,
Mick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

[gentoo-user] Re: Corrupt xD card with photos

[Sven Köhler]

[-- Attachment #1: Type: text/plain, Size: 3532 bytes --]

> I was handed what seems to be a corrupt xD flash card to extract the last 
> photo from it.  When the WinXP system at work coughed and died on it 
> (couldn't read it) I thought that my Linux would do better.  Anyhow, I've 
> inserted it into my Fuji camera and this is what dmesg shows:
> 
> ===================================================
> usb 2-1: new full speed USB device using uhci_hcd and address 4
> usb 2-1: configuration #1 chosen from 1 choice
> scsi2 : SCSI emulation for USB Mass Storage devices
> usb-storage: device found at 4
> usb-storage: waiting for device to settle before scanning
>   Vendor: FUJIFILM  Model: USB-DRIVEUNIT     Rev: 1.00
>   Type:   Direct-Access                      ANSI SCSI revision: 00
> SCSI device sda: 256000 512-byte hdwr sectors (131 MB)
> sda: Write Protect is off
> sda: Mode Sense: 07 00 00 00
> sda: assuming drive cache: write through
> SCSI device sda: 256000 512-byte hdwr sectors (131 MB)
> sda: Write Protect is off
> sda: Mode Sense: 07 00 00 00
> sda: assuming drive cache: write through
>  sda: unknown partition table
> sd 2:0:0:0: Attached scsi removable disk sda
> sd 2:0:0:0: Attached scsi generic sg0 type 0
> usb-storage: device scan complete
> ====================================================

First thing that i see is:
where the hell is /dev/sda1? Yes, there should be a FAT partition on
that xD card, but it's not there.

So first step:
Re-create a primary FAT partition without formatting it (for example use
cfdisk)

> Mount fails:
> ====================================================
> $ mount /dev/sda
> mount: wrong fs type, bad option, bad superblock on /dev/sda,
>        missing codepage or other error
>        In some cases useful info is found in syslog - try
>        dmesg | tail  or so
> ====================================================
> 
> and dmesg then shows:
> ====================================================
> FAT: bogus number of reserved sectors
> VFS: Can't find a valid FAT filesystem on dev sda.
> FAT: bogus number of reserved sectors
> VFS: Can't find a valid FAT filesystem on dev sda.
> ====================================================
> 
> This is what fdisk shows:
> ====================================================
> # fdisk /dev/sda
> Device contains neither a valid DOS partition table, nor Sun, SGI or OSF 
> disklabel
> Building a new DOS disklabel. Changes will remain in memory only,
> until you decide to write them. After that, of course, the previous
> content won't be recoverable.
> 
> Warning: invalid flag 0x0000 of partition table 4 will be corrected by w(rite)
> 
> Command (m for help): p
> 
> Disk /dev/sda: 131 MB, 131072000 bytes
> 5 heads, 50 sectors/track, 1024 cylinders
> Units = cylinders of 250 * 512 = 128000 bytes
> 
>    Device Boot      Start         End      Blocks   Id  System
> 
> Command (m for help): 
> 
> ====================================================
> 
> Is there a Linux (or even M$Windoze?) way of me recovering the last photo, 
> that doesn't involve reconstructing raw data with a hexeditor?

Maybe your are abled to mount the FAT partition after you "fixed" the
partition table. Well, "fixing" it basically means: delete it, and
create a new one. Typically, the FAT partition simply comsumes the whole
disk. There should be a fair chance, that (c)fdisk chooses the same
start/end-sectors for the partition like any other tool (including the
camera).

Good luck!


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 251 bytes --]

[gentoo-user] Re: Corrupt xD card with photos

[Remy Blank]

Sven Köhler wrote:
> First thing that i see is:
> where the hell is /dev/sda1? Yes, there should be a FAT partition on
> that xD card, but it's not there.
> 
> So first step:
> Re-create a primary FAT partition without formatting it (for example use
> cfdisk)

This is worth a try. However, I would first dump the whole card to a
file, make a copy of the file, and try all recovery attempts on the
copy. This way, you can always go back to the original and try something
else.

Make a copy:

  dd if=/dev/sda of=xd.img bs=1M

Make a working copy:

  cp xd.img xd_work.img

Re-create the partition table:

  fdisk -b 512 -C 1024 -H 5 -S 50 xd_work.img

Enter: "n", "p", "1", "1", "1024", "t", "6", "w"

(Not quite sure about the partition type (6), you might want to try
other types like FAT32 (b))

Try to mount the partition:

  mkdir mnt
  mount -o ro,loop,offset=25600 xd_work.img mnt

(25600 is 50 (number of sectors) * 512 (bytes per sector), that's the
start of the first partition)

Most of this will have to be done as root, so please be careful.

Good luck!
-- Remy


Remove underscore and suffix in reply address for a timely response.

-- 
gentoo-user@gentoo.org mailing list

Re: [gentoo-user] Re: Corrupt xD card with photos

[Mick]

[-- Attachment #1: Type: text/plain, Size: 1311 bytes --]

On Tuesday 12 September 2006 08:26, Remy Blank wrote:

> This is worth a try. However, I would first dump the whole card to a
> file, make a copy of the file, and try all recovery attempts on the
> copy. This way, you can always go back to the original and try something
> else.

Blast!  Too late now - I've tried to recreate the partition table (see other 
message).  But this is a very sensible approach and I should have thought of 
it at the time.  Thank you very much for your advice - well worth bookmarking 
this one!

> Make a copy:
>
>   dd if=/dev/sda of=xd.img bs=1M
>
> Make a working copy:
>
>   cp xd.img xd_work.img
>
> Re-create the partition table:
>
>   fdisk -b 512 -C 1024 -H 5 -S 50 xd_work.img
>
> Enter: "n", "p", "1", "1", "1024", "t", "6", "w"
>
> (Not quite sure about the partition type (6), you might want to try
> other types like FAT32 (b))
>
> Try to mount the partition:
>
>   mkdir mnt
>   mount -o ro,loop,offset=25600 xd_work.img mnt
>
> (25600 is 50 (number of sectors) * 512 (bytes per sector), that's the
> start of the first partition)
>
> Most of this will have to be done as root, so please be careful.
>
> Good luck!
> -- Remy
>
>
> Remove underscore and suffix in reply address for a timely response.

-- 
Regards,
Mick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Corrupt xD card with photos

[Matthias Bethke]

[-- Attachment #1: Type: text/plain, Size: 732 bytes --]

Hi Mick,
on Monday, 2006-09-11 at 22:50:01, you wrote:
> Thanks Matthias,
> 
> How do I install it manually?  install tells me:
> 
> # install
> install: missing file operand

Ow, sorry, I missed your reply before!
Well, simple, you don't :) This is a very primitive program and the
Makefile is just there so you don't have to set any CFLAGS (such as
-D_LARGEFILE64_SOURCE) by hand. You run make, it compiles the single
source file and leaves an executable there which you can move whereever
you want it. Or run it directly, as hopefully you won't need it too
often.

cheers!
	Matthias
-- 
I prefer encrypted and signed messages. KeyID: FAC37665
Fingerprint: 8C16 3F0A A6FC DF0D 19B0  8DEF 48D9 1700 FAC3 7665

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Corrupt xD card with photos

[Mick]

[-- Attachment #1: Type: text/plain, Size: 1105 bytes --]

On Monday 25 September 2006 22:09, Matthias Bethke wrote:

> on Monday, 2006-09-11 at 22:50:01, you wrote:

> > How do I install it manually?  install tells me:
> >
> > # install
> > install: missing file operand
>
> Ow, sorry, I missed your reply before!
> Well, simple, you don't :) This is a very primitive program and the
> Makefile is just there so you don't have to set any CFLAGS (such as
> -D_LARGEFILE64_SOURCE) by hand. You run make, it compiles the single
> source file and leaves an executable there which you can move whereever
> you want it. Or run it directly, as hopefully you won't need it too
> often.

Thanks again Matthias,

I must be doing something wrong:
============================================
$ ./recoverpics
./recoverpics: line 1: /bin: is a directory
./recoverpics: line 2: /bin: is a directory
./recoverpics: line 3: syntax error near unexpected token `('
./recoverpics: line 3: ` * Copyright (C) 2004 Matthias Bethke 
<Matthias.Bethke@gmx.net>'
============================================

Is that the expected output?
-- 
Regards,
Mick

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] Corrupt xD card with photos

[Matthias Bethke]

[-- Attachment #1: Type: text/plain, Size: 1484 bytes --]

Hi Mick,
on Monday, 2006-09-25 at 22:54:49, you wrote:
> I must be doing something wrong:
> ============================================
> $ ./recoverpics
> ./recoverpics: line 1: /bin: is a directory
> ./recoverpics: line 2: /bin: is a directory
> ./recoverpics: line 3: syntax error near unexpected token `('
> ./recoverpics: line 3: ` * Copyright (C) 2004 Matthias Bethke 
> <Matthias.Bethke@gmx.net>'
> ============================================
> 
> Is that the expected output?

No, not really. Looks like you're starting the source or something?
Here's how it's supposed to look:
| mb@huxley ~ $ tar -jxvvf recoverpics-1.6.tar.bz2
| -rw-r----- mb/users      13294 2004-02-28 07:08:36 recoverpics/recoverpics.c
| drwxr-x---                  Creating directory: recoverpics
| -rwxr-xr-x mb/users        542 2004-02-27 16:13:03 recoverpics/checkpics.sh
| -rw-r----- mb/users        140 2004-02-27 16:10:04 recoverpics/Makefile
| mb@huxley ~ $ cd recoverpics/
| mb@huxley ~/recoverpics $ make
| cc -O2 -finline-functions -D_LARGEFILE64_SOURCE=1 -D_FILE_OFFSET_BITS=64
| recoverpics.c -orecoverpics
| strip recoverpics
| mb@huxley ~/recoverpics $ ./recoverpics
| Usage: recoverpics <file> [offset] [max-output-size]

Then you should be able to run it as "./recoverpics /dev/sda" or
something.

good luck :)
	Matthias

-- 
I prefer encrypted and signed messages. KeyID: FAC37665
Fingerprint: 8C16 3F0A A6FC DF0D 19B0  8DEF 48D9 1700 FAC3 7665

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]