Re: [gentoo-user] Corrupt USB pen drive

[Dan Farrell]

On Fri, 18 May 2007 14:11:14 +0100
Mick <michaelkintzios@×××××.com> wrote:

> On Friday 18 May 2007 13:25, Hans-Werner Hilse wrote:
> > Hi,
> >
> > On Fri, 18 May 2007 12:50:07 +0100 Mick <michaelkintzios@×××××.com>
> > wrote:
>
> > > No matter if I use vfat, msdos, or ntfs.  It seems to me that I
> > > need to reconstruct the hex of the partition table - but don't
> > > know how to do this and testdisk does not see the device to
> > > recover previous partition tables.
I agree that you probalby need to get the partition table, or at least
information about the partition in question.  Althought it is possibe
that the disk is all one filesystem, I have never seen windows do it
that way for a usb stick.  I assume it's all one big partition,
formatted vfat, just like all the others I've seen.  
> > I'm pretty sure someone borked the first sectors of that stick. It
> > might have contained a partition table at some point in the past,
> > and the partition table might be gone now (HD mode).
I agree, this eems to be the case.  
> > But there is
> > also the possibility that there wasn't a partition table but just a
> > single filesystem on the stick (superfloppy mode).
> >
> > My suggestion is to take a hex editor and search for the start of a
> > partition. Most partition types are easily recognizable by some
> > magic bytes. It would, however, help a lot if you could tell what
> > kind of filesystem there was. If you found the start of the
> > filesystem, just use dd again and skip the bytes until the real
> > start of the FS. You can then mount the resulting file (w/o
> > partitioning and such).
I agree.  I've been reading about vfat filesystems a little and I think
this article http://en.wikipedia.org/wiki/VFAT seems to have all the
information we need.  However,
> ==============================================
> 000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
If there are zeroes all through here...
> 0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
> 000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
and FF's all through here, I'm not sure there's enough left over to
recover filesystem information.  
-- 
gentoo-user@g.o mailing list