usb key filesystem

Place to discuss anything, almost. No politics, religion, Microsoft, or anything else that I (the nazi censor) deem inappropriate.

usb key filesystem

Postby Master of Reality » Tue Mar 13, 2007 7:44 am

I've got a USB key here that worked one second, then the partition table was gone the next time it was put into a computer.

The computers at my school have a habit of erasing the partition table but leaving the filesystem fine, so i tried recreating a fat32 partition, but it still doesnt mount.

Is there some way to determine if there is still a filesystem on the usbkey or a way to recover files that were on it?
Master of Reality
guru
guru
 
Posts: 562
Joined: Thu Jan 09, 2003 8:25 pm

Postby Void Main » Tue Mar 13, 2007 10:50 am

Sounds like more than just the partition table got wiped out then. If just the partition table was wiped out you should be able to recreate it and mount the file system (assuming you created the partition table with exactly the same boundries as it had previously, beginning cylinder of the partition being the most critical). Now, if the file system is just damaged and the disk isn't completely wiped you still might be able to recover some data from it. A quick check you can do is if you remember some text exactly as it would have been in a file on the disk you could search for it in several different ways. One example I might try is:

strings /dev/sda1 | grep "My Exact Text"

You can also use the "dd" command with the "bs", "count", and "skip" params to grab data from specific locations on the disk. I have had to pick data out like this in the past. There are other tools you can use to browse the disk like "hexedit", "hexdump", "od", etc.

I also used a cool utility called gpart to successfully recover a damaged/lost partition table in the past:

http://www.stud.uni-hannover.de/user/76201/gpart/

This may not be a good choice in your case.

One thing I might suggest before you try anything else is get an image of whatever data IS on the drive off into a file on your hard drive so you can't damage it any farther than what it already is. If you have created a partition that spans the entire drive just do this (assuming it's called /dev/sda1):

dd bs=1M if=/dev/sda1 of=thumb.img

In fact you can now do all your searching/browsing on this image file.

Then of course there are all the other for pay utilities like Norton Disk Doctor, etc. If the drive has been wiped there is nothing they can do either though.
User avatar
Void Main
Site Admin
Site Admin
 
Posts: 5705
Joined: Wed Jan 08, 2003 5:24 am
Location: Tuxville, USA

Postby Master of Reality » Thu Mar 15, 2007 8:40 am

I made an image of the data, used strings on it to find that it looks like all the data should be there (or at least quite a bit).

I'm not really sure what to do next to try to recover the data, its from a 1GB USB key, so it should have been FAT32, but as i've said that wont work to mount it.

I've got gpart, but im not quite sure how to use it. It told me that it thinks there is four partition on it that are unknown, but i'm positive there isnt.
Master of Reality
guru
guru
 
Posts: 562
Joined: Thu Jan 09, 2003 8:25 pm


Return to The Lounge

Who is online

Users browsing this forum: No registered users and 0 guests

cron