Re: [gentoo-user] Corrupt USB pen drive

[Dan Farrell]

On Thu, 17 May 2007 12:36:25 +0100
Mick <michaelkintzios@×××××.com> wrote:

> Hi All,
>
> A colleague used a USB stick on his home machine and when he brought
> it to work he can no longer access it using WinXP.  I offered to help
> with my Gentoo laptop (as one ought to rise to the challenge!) but it
> seems that Linux is also struggling to get to it:
> ==========================================
> usb 2-1: new full speed USB device using uhci_hcd and address 2
> usb 2-1: configuration #1 chosen from 1 choice
> scsi0 : SCSI emulation for USB Mass Storage devices
> usb-storage: device found at 2
> usb-storage: waiting for device to settle before scanning
> scsi 0:0:0:0: Direct-Access              USB BAR          1.89 PQ: 0
> ANSI: 2 SCSI device sda: 255744 512-byte hdwr sectors (131 MB)
> sda: Write Protect is off
> sda: Mode Sense: 03 00 00 00
> sda: assuming drive cache: write through
> SCSI device sda: 255744 512-byte hdwr sectors (131 MB)
> sda: Write Protect is off
> sda: Mode Sense: 03 00 00 00
> sda: assuming drive cache: write through
>  sda: unknown partition table
> sd 0:0:0:0: Attached scsi removable disk sda
> sd 0:0:0:0: Attached scsi generic sg0 type 0
> usb-storage: device scan complete
> UDF-fs: No VRS found
> Unable to identify CD-ROM format.
> FAT: bogus logical sector size 65535
> VFS: Can't find a valid FAT filesystem on dev sda.
> NTFS-fs warning (device sda): is_boot_sector_ntfs(): Invalid boot
> sector checksum.
> NTFS-fs error (device sda): read_ntfs_boot_sector(): Primary boot
> sector is invalid.
> NTFS-fs error (device sda): read_ntfs_boot_sector(): Mount option
> errors=recover not used. Aborting without trying to recover.
> NTFS-fs error (device sda): ntfs_fill_super(): Not an NTFS volume.
> hfs: can't find a HFS filesystem on dev sda.
> VFS: Can't find ext3 filesystem on dev sda.
> VFS: Can't find an ext2 filesystem on dev sda.
> ReiserFS: sda: warning: sh-2021: reiserfs_fill_super: can not find
> reiserfs on sda
> ==========================================
>
> I tried to dd the boot sector so that I can look at it on my hard
> drive, but it cannot access /dev/sda.  Is there anything that I can
> do with my Gentoo to recover the files on this USB?

have you tried reading raw from the device like 
| dd if=/dev/sda of=sda.image 
?  That might do the recovery.  How to get it out of the image is the
same problem but once the backup succeeds you can plug it into a
windows xp box and reformat, and you will probably end up with the same
partition structure as originally.  Then you can try to read the right
part of the image out of the image, once you get the numbers from fdisk
on the newly formatted drive, and end up with an image of sda1.  From
there you should be able to mount sda1 and read out the data, if it
isn't corrupted.  

I also am wondering what happened to the partition table.  I bet your
coworker has a security-compromised box at home (oh, runs windows?
right...)  At any rate, if the data is recoverable, it may be possible
to rebuild the partition table if you can find out where the partition
started and ended.  People have done it before, i've read online about
it.  
-- 
gentoo-user@g.o mailing list