Re: [PLUG] FS recovery tools?

[JP Vossen <jp@jpsdomain.org>]

> Date: Sat, 25 Aug 2007 11:42:04 -0500
> From: "Greg Lopp" <lopp@pobox.com>
> Subject: [PLUG] FS recovery tools?
>
> A friend had a U3 thumbdrive go "bad" on him.  This badness manifested in
> different ways on different flavors of Windows and thinking that it might
> just be some simple partition table or fat corruption, I offered to take a
> look.  Knowing that it could also be completely toes up, I made no promises.
>
> When I plug it in, it enumerates as expected, presenting itself as two
> devices, one writable, one not (as a CD ROM)(where it would keep its U3
> autorun and apps).  This is followed by a message about an unrecognized
> partition table type.
>
> When I use dd to repeatedly to read the device, I get the same values each
> time.
> Looking at the contents with hexdump, I find a strange, repeating bit
> pattern, all over the place :
> df f2 05 a6 74 c7 55 71  76 b1 2d 3f 59 f0 e1 7f
> This fills spaces that I would suspect are otherwise unwritten to.
> Normally, I would expect FF or 00 in those spaces, but I don't know NAND
> flash like I should.  Additionally, I don't know partition table
> formats/offsets like I should.
>
> I've used the end of that bit pattern as an indicator of "interesting
> locations" on the data image and tried to "mount -o loop,offset=${offset}
> backupImage /mnt" at each location.  The kernel looks for ext2, vfat and
> iso9660 at each offset, but it never finds a recognizable file system.
>
> "strings backupImage" does not reveal anything that looks like files or
> filenames.
>
> It appears I can still write to the device and read it back.
>
> Can anybody recommend other things to try or recovery packages to play
> with?

There was a thread on the www.pantug.org list a while ago about 
something like this.  I couldn't find the exact details so I reposted, 
and I got the following answer:

[Try] GetDataBack I have had success with this: http://www.runtime.org/

See also:
http://groups.google.com/group/pantug/browse_thread/thread/e980c96d4aa4a2fb

HTH,
JP
----------------------------|:::======|-------------------------------
JP Vossen, CISSP            |:::======|        jp{at}jpsdomain{dot}org
My Account, My Opinions     |=========|      http://www.jpsdomain.org/
----------------------------|=========|-------------------------------
Microsoft has single-handedly nullified Moore's Law.
Innate design flaws of Windows make a personal firewall, anti-virus
and anti-malware software mandatory. The resulting software arms race
has effectively flattened Moore's Law on hardware running Windows.
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug