Loading
How a Corrupted USB Drive Was Saved by GNU/Linux
Would SUSE and fsck be able to recover the data in a usable way?
When I actually started looking, however, I wasn't really sure if this was a FAT16 vs FAT12. The drive's capacity of 512MB suggested it could be either FAT16 or FAT32. I also somehow had the impression that the partition could have contained a FAT32 filesystem in the same partition type. As I continued to look through the filesystem, I noticed this:
# od -Ax -w8 -tx1 -tc /tmp/r1 | less
045400 4c 45 58 41 52 20 4d 45 L E X A R M E
045408 44 49 41 28 00 00 00 00 D I A ( \0 \0 \0 \0
045410 00 00 00 00 00 00 4b 5a \0 \0 \0 \0 \0 \0 K Z
045418 33 2b 00 00 00 00 00 00 3 + \0 \0 \0 \0 \0 \0
045420 41 52 00 53 00 54 00 55 A R \0 S \0 T \0
045428 00 4c 00 0f 00 9a 6f 00 \0 L \0 017 \0 232 o \0
045430 67 00 2e 00 78 00 6c 00 g \0 . \0 x \0 l \0
045438 73 00 00 00 00 00 ff ff s \0 \0 \0 \0 \0
045440 52 4e 41 4c 4f 47 7e 31 R S T L O G ~ 1
045448 58 4c 53 20 00 b8 03 61 X L S \0 003 a
045450 50 30 e4 30 00 00 ca 74 P 0 0 \0 \0 t
045458 4b 30 f2 6a 00 3e 00 00 K 0 j \0 > \0 \0
...
On a side note, I recently discovered the hard way that CMD | less doesn't do what you want it to if the output of CMD is too long. In this case it was okay to use, but it isn't always; this probably is system-dependent. If you have enough space on your hard drive, it may pay to do something like this:
# od -Ax -w8 -tx1 -tc /tmp/r1 > /tmp/r2; less r2
or
# hexdump -C /tmp/r1 > /tmp/r2; less r2
So this looks like the start of a directory. Immediately above that area, though, I saw this:
042420 00 00 00 00 00 00 14 dd 15 dd 16 dd 17 dd 18 dd
042430 19 dd 1a dd 1b dd 1c dd 1d dd 1e dd 1f dd 20 dd
042440 21 dd 22 dd 23 dd 24 dd 25 dd 26 dd 27 dd 28 dd
042450 29 dd 2a dd 2b dd 2c dd 2d dd 2e dd 2f dd 30 dd
042460 31 dd 32 dd 33 dd 34 dd 35 dd 36 dd ff ff 00 00
042470 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
That looked like an allocation chain with 16-bit entries. If these had taken the form 31 dd 00 00 32 dd 00 00 rather than 31 dd 32 dd, I might have thought I was looking at FAT32.
I had heard somewhere that typically two FATs can be found together, one right after the other. I told less(1) to find another line resembling the line at 0x42460, by typing ?31 dd 32 dd 33 dd. In response, less(1) showed me this:
023a20 00 00 00 00 00 00 14 dd 15 dd 16 dd 17 dd 18 dd
023a30 19 dd 1a dd 1b dd 1c dd 1d dd 1e dd 1f dd 20 dd
023a40 21 dd 22 dd 23 dd 24 dd 25 dd 26 dd 27 dd 28 dd
023a50 29 dd 2a dd 2b dd 2c dd 2d dd 2e dd 2f dd 30 dd
023a60 31 dd 32 dd 33 dd 34 dd 35 dd 36 dd ff ff 00 00
023a70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
026a00 f8 ff ff ff 03 00 e6 02 21 03 a0 03 15 03 91 03
026a10 ff ff 0a 00 0b 00 ff ff 0d 00 0e 00 0f 00 10 00
The data at 0x42460 and at 0x23a60 are the same; this told me that the offset between tables was:
0x42460 - 0x23a60 = 0x1ea00
because 0x26a00 is the start of FAT#2. Therefore, the start of FAT#1 should be at
0x26a00 - 0x1ea00 = 0x08000
But when I looked there, I saw this instead:
007c00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
*
012400 01 52 02 52 03 52 04 52 05 52 06 52 07 52 08 52
012410 09 52 0a 52 0b 52 0c 52 0d 52 0e 52 0f 52 10 52
012420 11 52 12 52 13 52 14 52 15 52 16 52 17 52 18 52
Somebody had written a whole mess of 0xff bytes. I guess this was part of the corruption.
At this point, 0x12400 looked okay, but was it? What's in the corresponding place in FAT#2?
0x12400 + 0x1ea00 = 0x30e00
030e00 01 52 02 52 03 52 04 52 05 52 06 52 07 52 08 52
030e10 09 52 0a 52 0b 52 0c 52 0d 52 0e 52 0f 52 10 52
030e20 11 52 12 52 13 52 14 52 15 52 16 52 17 52 18 52
Luckily, this looked okay too. In fact, FAT#2 might be completely okay even though the first 40KB or so of FAT#1 had been corrupted.
All of this has been interesting, but the point of this exercise was to repair the filesystem and read the data. So I now turned to my friend fsck for the repair work, in particular fsck.msdos, err and dosfsck(8). I took the filesystem image and did what needed to be done with a spare loop device:
# losetup /dev/loop2 /tmp/r1
# fsck.msdos /dev/loop2
But according to fsck.msdos(8), the "disk" claimed to have something near 165 FATs, whereas fsck.msdos only supports two. Apparently, some filesystem parameters were messed up severely.
______________________
White Paper
Fabric-Based Computing Enables Optimized Hyperscale Data Centers
Today’s modular x86 servers are compute-centric, designed as a least common denominator to support a wide range of IT workloads. Those generic, virtualized IT workloads have much different resource optimization requirements than hyperscale and cloud applications. They have resulted in a “one size fits all” enterprise IT architecture that is not optimized for a specific set of IT workloads, and especially not emerging hyperscale workloads, such as web applications, big data, and object storage. In this report, you will learn how shifting the focus from traditional compute-centric IT architectures to an innovative disaggregated fabric-based architecture can optimize and scale your data center.
Sponsored by AMD
White Paper
Red Hat White Paper: Using an Open Source Framework to Catch the Bad Guy
Built-in forensics, incident response, and security with Red Hat Enterprise Linux 6
Every security policy provides guidance and requirements for ensuring adequate protection of information and data, as well as high-level technical and administrative security requirements for a system in a given environment. Traditionally, providing security for a system focuses on the confidentiality of the information on it. However, protecting the data integrity and system and data availability is just as important. For example, when processing United States intelligence information, there are three attributes that require protection: confidentiality, integrity, and availability.
Learn more about catching the bad guy in this free white paper.
Sponsored by DLT Solutions
- New Products
- Making Linux and Android Get Along (It's Not as Hard as It Sounds)
- A Topic for Discussion - Open Source Feature-Richness?
- Drupal Is a Framework: Why Everyone Needs to Understand This
- Readers' Choice Awards
- Home, My Backup Data Center
- What's the tweeting protocol?
- New Products
- RSS Feeds
- One Hand Slapping
- Reply to comment | Linux Journal
7 hours 23 min ago - Reply to comment | Linux Journal
9 hours 56 min ago - Reply to comment | Linux Journal
11 hours 13 min ago - great post
11 hours 48 min ago - Google Docs
12 hours 10 min ago - Reply to comment | Linux Journal
16 hours 59 min ago - Reply to comment | Linux Journal
17 hours 45 min ago - Web Hosting IQ
19 hours 19 min ago - Thanks for taking the time to
20 hours 56 min ago - Linux is good
22 hours 54 min ago
Enter to Win an Adafruit Prototyping Pi Plate Kit for Raspberry Pi
It's Raspberry Pi month at Linux Journal. Each week in May, Adafruit will be giving away a Pi-related prize to a lucky, randomly drawn LJ reader. Winners will be announced weekly.
Fill out the fields below to enter to win this week's prize-- a Prototyping Pi Plate Kit for Raspberry Pi.
Congratulations to our winners so far:
- 5-8-13, Pi Starter Pack: Jack Davis
- 5-15-13, Pi Model B 512MB RAM: Patrick Dunn
- Next winner announced on 5-21-13!
Free Webinar: Linux Backup and Recovery
Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.
In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.
Developer Poll
Comments
How about multiple partitions?
Collin,
It was an enlightening article for me. However, I have a slightly different problem. I have a USB disk (1GB) which when I fsck.vfat - shows the following:
dosfsck 3.0.3, 18 May 2009, FAT32, LFN
/dev/sdb1: 379 files, 55267/62958 clusters
I cannot see the files on the drive. Moreover, when I do:
$sudo sfdisk -l -f /dev/sdb1
Disk /dev/sdb1: 1015 cylinders, 32 heads, 62 sectors/track
Units = cylinders of 1015808 bytes, blocks of 1024 bytes, counting from 0
Device Boot Start End #cyls #blocks Id System
/dev/sdb1p1 ? 392205+ 967563- 575358- 570754815+ 72 Unknown
start: (c,h,s) expected (1023,31,62) found (357,116,40)
end: (c,h,s) expected (1023,31,62) found (357,32,45)
/dev/sdb1p2 ? 85024+ 1060845- 975821- 968014120 65 Novell Netware 386
start: (c,h,s) expected (1023,31,62) found (288,115,43)
end: (c,h,s) expected (1023,31,62) found (367,114,50)
/dev/sdb1p3 ? 942480+ 1918301- 975821- 968014096 79 Unknown
start: (c,h,s) expected (1023,31,62) found (366,32,33)
end: (c,h,s) expected (1023,31,62) found (357,32,43)
/dev/sdb1p4 ? 0 1833279- 1833280- 1818613248 d Unknown
start: (c,h,s) expected (0,0,1) found (372,97,50)
end: (c,h,s) expected (1023,31,62) found (0,10,0)
I tried mounting each of the separate partitions by changing the partition ID to VFAT, but it still didn't work. I dont know if data can still be recovered from it. What do you suggest?
Regards,
Subh
Thanks
I was having issues with a flash drive not being detected just now. Wouldn't mount and fsck.msdos gave a funny error. following your steps to view the partition table and with a bit of help from google, the active flag was set to 81H. So I used fdisk to toggle it and now it works. :)
Flash drive recovery
I brought a 49GB ameco flash drive. after using of 2 months, by mistake I formated it in windows using NTFS. Then it goes to RAW file system. It is showing in windows but for formating is not supporting in FAT/FAT32. Then i tryied in Linux, but the drive is not showing. One of my friend said that, it having problem with '0" sector problem. what can I do?
LINUCKS SAVES TEH DAY!!1
LINUCKS SAVES TEH DAY!!1
Who ever made the comment
Who ever made the comment above is a pr*** yes linux did save the day and your an asshole.
stoped at the first step
Hi, I tried to follow your instructions to recovery data froma a camera, but when i try to make dd if=/dev/sda of=file from a live cd of kubuntu, my computer doesn´t work. any help? thanx a lot
This Makes sense, I've had a similar experience with Linux
This makes sense. I once had a friend who had a Microsoft Word document on his flash drive which was corrupted on Windows. I stuck the flash drive in my laptop run Ubuntu v 6.06 (Freeware/shareware Linux) and opened the file up without any problems whatsoever. It just worked.
Hey iv lost all my work on my
Hey iv lost all my work on my lexar usb. Very important work. how do i recover all of it. please anyone help???
FAT was (probably) not corrupted
The many FF FF entries in the beginnning of the FAT were probably correct:
In FAT systems, unfragmenting utilities usually deploy directories at the beginning of the partition. If there are not too many entries in a directory, the 32-bit entries in the directories all fit in one block (e.g. in a system with 8k-blocks, there are 256 entries per block), so the directory "file" has the lenght of one block. It is marked in the fat with FFF (FAT12), FF FF (FAT16) or FF FF FF FF (FAT32).
So I would expect to see many FF bytes in the start of a FAT. Did you ever look whether the FAT contained FF bytes at the beginning or not?
The boot sector of a fat disk partition (not the MBR) contains drive parameters , if the FAT boot sector is damaged, you will have some problems. I suppose windows damaged that sector due to some bug, not the FAT. Writing there, e.g the information that there are about 165 fats ;-)
The disk parameters consist of head/cylinder/sector information (which can safely be ignored (and is ignored, I guess, even by Windows) since it is purely redundant, the relevant data being in the MBR, plus some routine information (e.g. bytes per sector, which is virtually alway 512), plus vital information as number reserved sectors at the start of the partition, which has to be known to calculate the start of the first FAT. Whether the information about the number of FATs is vital depends on the probability that someone created a FAT system with only one FAT ...
Collin - Thank you, thank you, thank you
Collin - Thank you for posting this article! Yesterday, I accidently shut down my Windows XP computer without ejecting my Lexar Jumpdrive. Afterward, I got the "Drive not Formatted" error. Fortunately I found your article, and have a second computer running Redhat. Following essentially the same precedure you described, I was able to recover all the data from my disabled Jumpdrive. You saved the day. Thanks again!!
512MB USB corrupted in Windows XP
Hey! i just happened to jump to this page, nice comments here. my problem is that this very incidence happened with me 2 weeks back. my 512 MB kingston usb disk got corrupted. i have tried numerous programs to read it. it is shown in windows xp as removabe drive but it cannot be formatted. the system is shown as raw. some hard disk tools do show the exact size of the disk but can anyone tell me how to get the disk back! i will appreciate the replies to my email at sash@highnoon.com.pk
Thankx!
Recovery Tool!!!
PPL before you try anything you must check this.
http://www.runtime.org/gdb.htm
I managed to recover my files after 3 mins and with beautifull interface. This software works perfect. I tryed dozens dos recovery tools and noone worked
Try this mmaybe it helps you out
Regards
GetDataBack Sucks
this is just another hostage holding, overpriced data reocovery tools that won't recover jack until you pay the outrageous $$$
I totally agree i knew i
I totally agree i knew i shouldn't have wasted my dollars on this crap software it completely fucked up my drive and none of the files it recovered actually worked!!!!!!!! useless piece of crap software i am demanding a refund but these fuckers will probably get away with it!!!
re:
stuck the flash drive in my laptop run Ubuntu v 6.06 (Freeware/shareware Linux) and opened the file up without any problems whatsoever. It just worked.
gpart can help you too
The information here was invaluable, because it gave me some encouragement in trying to recover the 250GB USB drive that Win2K suddenly didnt want to accept after I missed that a VMWare Virtual machine had mounted the drive...
I lost the partition table and have no disk large enough to create an image to.
With the above info I started dumping 50MB of the disk and found that no physical damage was evident, but still no way of finding the appropriate data for the approach above.
Knowing that it was a single 250GB FAT32 partition I downloaded GPart
http://www.stud.uni-hannover.de/user/76201/gpart/
It guessed what I believe correctly and after reboot the disk was mountable (in fact it automounted which maybe wasnt the best approach). I ran fsck.vfat with no reported errors!
Once again, I had great help of the info you supplied and hope that more people in desperate need will find your article.
fsck.msdos reporting to find 165 FATs
Thanks for the great article. When trying fsck.msdos on a damaged CF card image, I stumbled over the same problem:
the "disk" claimed to have something near 165 FATs
(actually 191 in my case). I then noticed that you mounted the MBR instead of the FAT partition. When specifying the partition offset with losetup (I believe 0x8000 in your case), e.g.
losetup -o 32768 /dev/loop2 /tmp/r1then fsck.msdos should be able to find 2 FATs (the number of FATs should be at offset 0x10 from start of the partition) and your Rapair Attempt #1 might work.
If the partion table was intact, dd'ing /dev/sda1 instead of /dev/sda would give you the partition image only, thus eliminating the need to care about the partition offset.
Unfortunately, in my case FAT#2 amd the directory table is damaged. I'm going to write a restore program exploiting the FAT chains...
Thanks,
Joerg
links to FAT info?
Great article. I'm now trying to recover an 11gb FAT32 partition from my wife's windows machine. The MBR seems OK ( fdisk sees the partition - as does w2k disk manager ). Somehow the partition itself is messed up ( virus? sunspots? ). windows doesn't think it has a file system. fsck.vfat thinks it has 255 FATs.
This article is exactly what I was looking for in trying to fix this. But it assumes a lot of info about FAT file systems:
"That looked like an allocation chain with 16-bit entries. If these had taken the form 31 dd 00 00 32 dd 00 00 rather than 31 dd 32 dd, I might have thought I was looking at FAT32."
Where do you find this info? This is way beyond my meager knowledge. Any references would be *really* useful.
re: links to FAT info?
Where do you find this info? This is way beyond my meager knowledge. Any references would be *really* useful.
Sorry, I don't remember. But I remember reading somewhere that what FATxx means is is that the cluster numbers take xx bits. Hence seeing two consecutive 16-bit numbers (31 dd 32 dd) gave me the clue that it was FAT16. Unless a FAT filesystem is severely fragmented, one would expect to see consecutive cluster numbers either in a file allocation chain (cluster numbers within a file) or the free list.
NOTE: I haven't verified the full technical accuracy of the following links, your mileage may vary, not a statement of my employer, don't try this at home, etc etc etc., but these are just links that appear useful, just based on a casual glance:
I just googled on "fat16 fat32 structure cluster number" (no quotes); the first couple of links look very useful. One of them contains a pointer to http://home.teleport.com/~brainy/fatgen102.pdf, which looks pretty useful.
Another place to look is http://www.storagereview.com/guide2000/ref/hdd/file/clustChaining.html, which I think you'll find helpful.
FAT info
Here, very cool site!
http://home.freeuk.net/foxy2k/disk/disk1.htm
Of course, advisable to handle with care, preferrably messing with an image file first. :-)
What to do when FAT1/FAT2 aren't working?
Salve!
Thank you for this artikel, but what to do when both FATs are gone?
I have a problem wit a 128 MB SMartMedia Card (FAT16 formated with
axxpac, a memory extention for PalmIIIx http://www.axxpac.de),
probly due ejct during writing and befor unounting it with Linux.
What I found out (with help from Debian-User-German) ML befor finding your article:
cfdisk 2.12p
Disk Drive: /dev/hde
Size: 131072000 bytes, 131 MB
Heads: 16 Sectors per Track: 32 Cylinders: 500
Name Flags Part Type FS Type [Label] Size (MB)
Pri/Log Free Space 0,03*
hde1 Boot Primary FAT16 131,05*
From a fresh formateded Card wrote I 64 Bit to the Card I can't mounted
dd if=/hd1/smartmedia128/neu/ddsmart128-neu-050616 ibs=1 skip=24063 bs=1 \
count=64 seek=24063 of=/dev/hde
Now cfdisk tells:
hde1 Boot Primary FAT16 [AXXPAC/TH ] 131,05*
The card is now mountable, I see all directories and all files, *g*
but only files smaller then 0x4000Bit (16384) can be read without
read/write errors. dosfsck will truncate all files to <=16384 and
is no help. Is this 0x4000 limit based on cluster - that there is
information to jump to the next cluster missing?
With fsck I got also the errormessage that multiple files or
directories use the same cluster.
ls -lRA is working, but some files and dirs have the date of the
crash day - but they are older and not written on that day.
So "ls -lRA" is not the final "Acid Test" for the recovery, a "cp -Rp *"
would not work in my case.
-What can I do insted of msfsck?
-When I something with "ls -lRA" the FAT1/FAT2 are still there?
-How can I extract the starting adresses for each file I see
with ls -lRA?
I know that there are tools like autopsy, but I hope that
the FATs are still recoverable.
Greetings
rob
Continue.... What to do when both FAT not working...
dosfsck will truncate all files to <=16384 and
is no help. Is this 0x4000 limit based on cluster - that there is
information to jump to the next cluster missing?
With fsck I got also the errormessage that multiple files or
directories use the same cluster.
ls -lRA is working, but some files and dirs have the date of the
crash day - but they are older and not written on that day.
So "ls -lRA" is not the final "Acid Test" for the recovery, a "cp -Rp *"
would not work in my case.
-What can I do insted of msfsck?
-When I something with "ls -lRA" the FAT1/FAT2 are still there?
-How can I extract the starting adresses for each file I see
with ls -lRA?
I know that there are tools like autopsy, but I hope that
the FATs are still recoverable.
Greetings
rob
continue ... does the forum don't like "
read/write errors. dosfsck will truncate all files to smaller 16384 and
is no help. Is this 0x4000 limit based on cluster - that there is
information to jump to the next cluster missing?
With fsck I got also the errormessage that multiple files or
directories use the same cluster.
ls -lRA is working, but some files and dirs have the date of the
crash day - but they are older and not written on that day.
So "ls -lRA" is not the final "Acid Test" for the recovery, a "cp -Rp *"
would not work in my case.
-What can I do insted of msfsck?
-When I something with "ls -lRA" the FAT1/FAT2 are still there?
-How can I extract the starting adresses for each file I see
with ls -lRA?
I know that there are tools like autopsy, but I hope that
the FATs are still recoverable.
Greetings
rob
PS: Sorry for my fragmentated post ;)
The FATs
From what I understood, you've overwritten both FATs with "clean" ones? Bad move, sorry..
FAT = File Allocation Table .. basically, holds the information of where different parts of files are on a disk.
The root directory (which is located right after the FATs), however, holds some other info: file names, attributes, sizes, dates, and starting clusters' numbers, that's why you can see the files and can access them, but only the first 16kB, since that is the size of a cluster on that particular disk..
Was the drive corrupted or filesystem?
This piece is confusing: "According to Lexar tech support, there is a bug with Windows 2000 (that MS never bothered to fix) and can corrupt the drive when it is removed without proper eject.".
Does this mean that the drive was damaged because of this bug (and you could say good bye my $70 USB), or was it the filesystem on this drive (so that reformatting that USB would make it usable again)?
re: Was the drive corrupted or filesystem?
Just the filesystem was corrupted. The electronics in the card were fine.
Prosoft engineering
Prosoft engineering produces a range of data rescue software for the Mac which I have personally used with much success. They support everying from HDD to memory cards to USB flash drives.
address is: http://www.prosofteng.com
There are various products from Image Rescue to Data Rescue, they are not open source but there are trial versions available for download which will allow you to recover a file at a time. Of course all of this is for the mac only. They are famous for their official Novell client for Mac as well.
Shameless ad.
Shameless ad.
Mounting under /tmp
Nice article, printed and saved for if I ever need to do something similar. A very quick point though - beware of mounting under /tmp on systems that aren't yours; some badly written tmp cleanup scripts can go in and clean up your newly mounted filesystem :-( I've lost filesystems to this a couple of time before I worked out what was going on...
JPEG images
I approached a similar problem I had differently - I knew I was looking for JPEG images and that there was a chance they were intact. I assumed the FAT was unreliable, and admittedly forgot about the second FAT copy.
I also assumed there was no fragmentation, and then proceeded to 'dd' anything that looked like an EXIF header +1.5MB to disk as individual files.
Something along these lines:
hexdump -C sda1_flashdisk.dd | grep -i "exif" >headers.hex
cat headers.hex | awk --non-decimal-data '{print (sprintf("%d","0x"$1)/512)}' > headers.512.dec
cat headers.512.dec | xargs --replace bash -c "dd skip={} if=sda1_flashdisk.dd bs=512 count=3000 of=./{}.jpg"
I was lucky on several counts: all files were of predicatable content, there was little if any fragmentation, and JPEG seems to tolerate excess junk added to the end of file :-)
I wish I had known about this
I wish I had known about this about a month ago. My Father had a 128MB Sandisk USB flash disk which he had been using under Windows 2000 and it died in a rather spectacular way, the only difference here though is that when I fed it to my linux workstation, it did not find any partition records - it was royally goosed. I had an identical USB flash disk to my Father's and tried to overwrite the partition records from my chip to his, but with no success. Extremely interesting article though and very well researched. Congratulations on recovering your data - I challenge any Windows user to even come close to that without having to write a suite of programs.
Overall, pretty good
I've done this type of recovery myself, using basically the same approach: look at hex dumps and compare the corrupted media with uncorrupted media, looking for areas that match, then copying individual sectors in an attempt to produce something readable. I wouldn't have thought of using the backup FAT table for fsck.msdos, though. :) Usually, fixing a partition table would do it. Or I would've copied FAT#2 on top of FAT#1 and just tried to mount it...
Overwriting FAT#1 with FAT#2 (or vice-versa)
Overwriting FAT#1 with FAT#2 (or vice-versa) - this isn't necessarilly a good idea if there's a chance that both are more or less corrupted.
In such cases, trying to "merge" them (with extreme care, of course) would be better..
Well, just using the copy #1 at one time, and #2 at the other, while both times trying to access & restore files and see which time you get better results ("proper" file contents), would be the most cautious way.
thanks for your comment
Thanks for posting your comment! Those are both good ideas, which I didn't think of. Well, I thought of trying to fix the partition table but I didn't know enough about the boot sector contents (and still don't).
The important thing is that GNU/Linux distros give us enough tools so that we can approach these problems in different ways... even problems caused by closed operating systems!
Thanks again for your note.
Question: How would gpart hav
Question: How would gpart have performed on that job?
I recovered once a whole laptop for someone in the office with half a years work of source code on it...
"I recovered once a whole lap
"I recovered once a whole laptop for someone in the office with half a years work of source code on it"
Can we infer from your comment that your colleague whose work you saved is a software developer who had not backed up his or her work in six months? Yeesh! I'm getting queasy just thinking about this; I need to go lie down for a while ....
Windows tools to test
Hey, there are some windows based tools that exist but I don't think they work for flash drives, but you could always try.
Driverescue 1.9d (scans through bios in windows).
Testdisk - http://www.cgsecurity.org/testdisk.html
PCInspector - which looks exactly like Driverescue before driverescue went commerical http://www.pcinspector.de/file_recovery/UK/welcome.htm
My usb-disk (Trekstore, 8
My usb-disk (Trekstore, 8 GB) was damaged by unpluging during a write-operation.
I tried some ways, mentioned above. Nothing worked.
Finally I found Testdisk and it worked greatly!
Many thanks for that advice!
Using windows Disk Manager
Using windows Disk Manager to creat a new partition for your usb drive, although may lost 8MB space, still is the best way to do the rescure for a USB flash drive.
Or using Partition Magic
Or using Partition Magic Boot Disk to repartition this USB drive, you will gain back all the space on it.
Recover HD after Ghosting
Could you use this same process to recover files after Ghosting a HD? If not; what would you suggest I use? If it's possible at all to recover files after Ghosting a HD.