1 |
On Friday 18 May 2007 13:25, Hans-Werner Hilse wrote: |
2 |
> Hi, |
3 |
> |
4 |
> On Fri, 18 May 2007 12:50:07 +0100 Mick <michaelkintzios@×××××.com> |
5 |
> wrote: |
6 |
|
7 |
> > No matter if I use vfat, msdos, or ntfs. It seems to me that I need |
8 |
> > to reconstruct the hex of the partition table - but don't know how to |
9 |
> > do this and testdisk does not see the device to recover previous |
10 |
> > partition tables. |
11 |
> |
12 |
> I'm pretty sure someone borked the first sectors of that stick. It |
13 |
> might have contained a partition table at some point in the past, and |
14 |
> the partition table might be gone now (HD mode). But there is also the |
15 |
> possibility that there wasn't a partition table but just a single |
16 |
> filesystem on the stick (superfloppy mode). |
17 |
> |
18 |
> My suggestion is to take a hex editor and search for the start of a |
19 |
> partition. Most partition types are easily recognizable by some magic |
20 |
> bytes. It would, however, help a lot if you could tell what kind of |
21 |
> filesystem there was. If you found the start of the filesystem, just |
22 |
> use dd again and skip the bytes until the real start of the FS. You can |
23 |
> then mount the resulting file (w/o partitioning and such). |
24 |
> |
25 |
> Did you try the recovery tools for the FS in question? |
26 |
|
27 |
I tried fsck.msdos but didn't fix it. |
28 |
|
29 |
Like most USB sticks I would assume that it is either FAT32 or FAT16. Given |
30 |
that this is what I see when I dump the first few bytes, can you please tell |
31 |
me where the fs data starts and how to dd that without inc the initial |
32 |
partition table data? |
33 |
============================================== |
34 |
000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
35 |
* |
36 |
0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |
37 |
000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |
38 |
* |
39 |
020000 01 df 02 df 03 df 04 df 05 df 06 df 07 df 08 df |
40 |
020010 09 df 0a df 0b df 0c df 0d df 0e df 0f df 10 df |
41 |
020020 11 df 12 df 13 df 14 df 15 df 16 df 17 df 18 df |
42 |
020030 19 df 1a df 1b df 1c df 1d df 1e df 1f df 20 df |
43 |
020040 21 df 22 df 23 df 24 df 25 df 26 df 27 df 28 df |
44 |
020050 29 df 2a df 2b df 2c df ff ff 2e df 2f df 30 df |
45 |
020060 31 df 32 df 33 df 34 df 35 df 36 df 37 df 38 df |
46 |
020070 39 df 3a df 3b df 3c df 3d df 3e df 3f df 40 df |
47 |
020080 41 df 42 df 43 df 44 df 45 df 46 df 47 df 48 df |
48 |
020090 49 df 4a df 4b df 4c df 4d df 4e df 4f df 50 df |
49 |
0200a0 51 df 52 df 53 df 54 df 55 df 56 df 57 df 58 df |
50 |
0200b0 59 df 5a df 5b df 5c df 5d df 5e df 5f df 60 df |
51 |
0200c0 61 df 62 df 63 df 64 df 65 df 66 df 67 df 68 df |
52 |
0200d0 69 df 6a df 6b df 6c df 6d df 6e df 6f df 70 df |
53 |
[snip] |
54 |
|
55 |
0202a0 51 e0 52 e0 53 e0 54 e0 55 e0 56 e0 57 e0 58 e0 |
56 |
0202b0 59 e0 5a e0 5b e0 5c e0 5d e0 5e e0 5f e0 60 e0 |
57 |
0202c0 61 e0 62 e0 63 e0 64 e0 65 e0 66 e0 4f 93 00 00 |
58 |
0202d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
59 |
* |
60 |
020360 00 00 00 00 00 00 00 00 00 00 00 00 b7 e0 b8 e0 |
61 |
020370 b9 e0 ba e0 bb e0 bc e0 bd e0 be e0 bf e0 c0 e0 |
62 |
020380 c1 e0 c2 e0 c3 e0 c4 e0 c5 e0 c6 e0 c7 e0 c8 e0 |
63 |
020390 c9 e0 ca e0 cb e0 cc e0 cd e0 ce e0 cf e0 d0 e0 |
64 |
0203a0 d1 e0 d2 e0 d3 e0 d4 e0 d5 e0 d6 e0 d7 e0 d8 e0 |
65 |
[snip] |
66 |
|
67 |
021ab0 59 ec 5a ec 5b ec 5c ec 5d ec 5e ec 5f ec 60 ec |
68 |
021ac0 61 ec ff ff 63 ec 64 ec 65 ec 66 ec 67 ec 68 ec |
69 |
021ad0 69 ec 6a ec 6b ec 6c ec 6d ec 6e ec 6f ec 70 ec |
70 |
021ae0 71 ec ff ff 00 00 00 00 00 00 00 00 00 00 00 00 |
71 |
021af0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
72 |
* |
73 |
022720 00 00 00 00 00 00 00 00 00 00 96 f2 97 f2 98 f2 |
74 |
022730 99 f2 9a f2 9b f2 9c f2 9d f2 9e f2 9f f2 a0 f2 |
75 |
022740 a1 f2 a2 f2 a3 f2 a4 f2 a5 f2 a6 f2 a7 f2 a8 f2 |
76 |
022750 a9 f2 aa f2 ab f2 ac f2 ad f2 ae f2 af f2 b0 f2 |
77 |
============================================== |
78 |
|
79 |
I assume that the asterisks indicate a new file starting there? |
80 |
|
81 |
Thanks for all your help. :) |
82 |
-- |
83 |
Regards, |
84 |
Mick |