Re: [gentoo-user] Corrupt USB pen drive

[Etaoin Shrdlu]

On Friday 18 May 2007 15:11, Mick wrote:

> On Friday 18 May 2007 13:25, Hans-Werner Hilse wrote:
> > Did you try the recovery tools for the FS in question?
>
> I tried fsck.msdos but didn't fix it.
>
> Like most USB sticks I would assume that it is either FAT32 or FAT16.
> Given that this is what I see when I dump the first few bytes, can you
> please tell me where the fs data starts and how to dd that without inc
> the initial partition table data?
> ==============================================
> 000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> *
> 0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
> 000200 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
> *
> 020000 01 df 02 df 03 df 04 df 05 df 06 df 07 df 08 df
>
>[cut]
> I assume that the asterisks indicate a new file starting there?

Are you using hexdump to read the data? Does the above output come from 
hexdumping the actual device or the image file?

The asterisks look strange. If you look carefully, you see that each 
asterisk does not merely replace a single line of output, but several 
lines. Look at the addresses of the lines before and after: for example, 
000200 -> asterisk -> 020000 in your output above. So, that asterisk 
represents 0x020000 - 0x000210 =  0x1fdf0 bytes, ie 130544 bytes. If the 
dump comes from the actual device (like I suppose), it could be that 
these bytes are skipped because they are somehow unreadable, so it's 
really difficult to compare this output with one from a working device, 
in either HD or superfloppy mode. In particular, there is an asterisk 
immediately after the first 16 bytes (line 000000), and the dump 
continues at byte 0x0001f0 (496 decimal), and this means that the very 
first sector (where the interesting stuff is) is almost entirely damaged 
or otherwise unreadable.
Also, trying to dd the device to a file as you did would almost certainly 
insert unpredictable garbage in the file to represent the unreadable 
parts of the device.

Chances are it was in HD mode (ie, with a partition table), because the 
signature at the end of the first 512 bytes (the "55 aa" at the end of 
the 0001f0 line) indicates a boot sector (the MBR).
Within this boot sector, the partition table is 64 bytes long and usually 
lives from byte 446 to byte 509 of the sector (512 bytes long, numbered 
from 0 to 511; bytes 510 and 511 are the signature). Since a partition 
table is composed of four records, each 16 bytes long, this means you 
have only the last 14 bytes of the fourth partition table record. But, 
it's very very likely that there was only a single partition, and thus 
the fourth record is unused and set to all zeros. What you would need is 
the value of the bytes from 446 to 461 (the first partition table 
record, which has info about the first partition), but, as I said above, 
all this data seems to be lost in the asterisk, like tears in the rain 
(cit.).

Bottom line: I would not bet on data recovery from that stick.
It's also true that there might be some program I'm unaware of which 
could try or be able to recover things, but unfortunately I have no 
advice for you about this.
-- 
gentoo-user@g.o mailing list