Loading
How a Corrupted USB Drive Was Saved by GNU/Linux
Would SUSE and fsck be able to recover the data in a usable way?
My friend's brother had a 512MB Lexar Media Jumpdrive Pro USB drive that became corrupted after using it with Windows 2000. His IT department was able to get back some but not all of the file contents, but without any file names. On his own, he tried some recovery utilities, but all failed. Using a typical Linux distro--in this case SuSE 8.0--however, it wasn't hard to recover almost all of the data from the drive along with the filenames and to burn a CD-ROM of the contents.
Here's what I heard about the data loss:
Date: Sun, 1 Aug 2004 17:06:03 -0700
Subject: USB
... My USB drive is a
Lexar Media USB Jumpdrive Pro 2.0 (512 MB). I was working
on it in a computer with Windows 2000 and logged off before
ejecting the drive. Next time when I tried to use it,
it showed up as a Removable drive rather than the usual
Lexar Media drive and when I tried to open it, it said the
drive was not formatted; and under Properties, 0 bytes free
and used space and file system "RAW"
According to Lexar tech support, there is a bug with
Windows 2000 (that MS never bothered to fix) and can corrupt
the drive when it is removed without proper eject. They
recommend EasyRecovery Pro for data recovery which did
allow me to recover some files (> 500) using their RAW data
recovery program (all other tool failed because usually
said "no recognizable file on disc"). Unfortunately,
all the file names are lost and some files are gone.
The big questions was "can Linux read the drive?" A Web search of "linux usb jumpdrive pro" gave me hope that my kernel, 2.4.18 on SuSE 8.0, would recognize the drive in question. So, as root, I typed:
# tail -f /var/log/messages
and plugged the drive into a USB socket. Here's what appeared; I removed "Aug 5 01:32:15 linux kernel:" from each line below):
usb.c: registered new driver usb-storage
scsi0 : SCSI emulation for USB Mass Storage devices
usb-uhci.c: interrupt, status 3, frame# 1313
Vendor: LEXAR Model: JUMPDRIVE PRO Rev: 0
Type: Direct-Access ANSI SCSI revision: 02
Attached scsi removable disk sda at scsi0, channel 0, id 0, lun 0
SCSI device sda: 1001952 512-byte hdwr sectors (513 MB)
sda: Write Protect is off
sda: sda1
WARNING: USB Mass Storage data integrity not assured
USB Mass Storage device found at 4
USB Mass Storage support registered.
Encouraged by that report, I tried this:
# dd if=/dev/sda of=/tmp/r1 bs=512
which reported that 1,001,952 blocks had been transferred. I then unplugged the drive and did the rest of my work using the image stored in /dev/sda.
The master boot record, which is the boot sector for the entire drive and its first sector, has a partition table, as well as other interesting things:
# od -Ax -tx1 /tmp/r1 | less
...
*
0001b0 00 00 00 00 00 00 00 00 48 04 07 c9 00 00 80 01
0001c0 01 00 06 0f ff e0 3f 00 00 00 b1 45 0f 00 00 00
0001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
The boot sector has a reasonable-looking partition table with one entry. It began at offset 0x1be, the two bytes 80 01. Your favorite search engine can give you other information about the partition table, but I note two things here. First, the entry has an LBA32 format--starting logical sector 0x3f, length 0xf45b1. Now, 0xf45b1 is 1000881 decimal. That plus 63 (0x3f) is 1000944. The difference between the 1001952 and this 1000944 is 1008, that is, 63*16. I guess this has something to do with cylinder boundaries. The second thing of note is the byte at 0x1c2, with value 06; this is the partition type. What does 06 mean?
Typing fdisk /dev/hda as root and giving the command l to list, shows that type 6 is:
0 Empty 1c Hidden Win95 FA 65 Novell Netware bb Boot Wizard hid 1 FAT12 1e Hidden Win95 FA 70 DiskSecure Mult c1 DRDOS/sec (FAT- 2 XENIX root 24 NEC DOS 75 PC/IX c4 DRDOS/sec (FAT- 3 XENIX usr 39 Plan 9 80 Old Minix c6 DRDOS/sec (FAT- 4 FAT16 <32M 3c PartitionMagic 81 Minix / old Lin c7 Syrinx 5 Extended 40 Venix 80286 82 Linux swap da Non-FS data 6 FAT16 41 PPC PReP Boot 83 Linux db CP/M / CTOS / . ...
So, it's FAT16.
Now, if I had been watching carefully, I would have known from the line sda: sda1 in /var/log/messages that the partition table was okay and contained only one entry.
______________________
Webcast
How to Build an Optimal Hadoop Cluster to Store and Maintain Unlimited Amounts of Data Using Microservers
Realizing the promise of Apache® Hadoop® requires the effective deployment of compute, memory, storage and networking to achieve optimal results. With its flexibility and multitude of options, it is easy to over or under provision the server infrastructure, resulting in poor performance and high TCO. Join us for an in depth, technical discussion with industry experts from leading Hadoop and server companies who will provide insights into the key considerations for designing and deploying an optimal Hadoop cluster.
Sponsored by AMD
White Paper
Red Hat White Paper: Using an Open Source Framework to Catch the Bad Guy
Built-in forensics, incident response, and security with Red Hat Enterprise Linux 6
Every security policy provides guidance and requirements for ensuring adequate protection of information and data, as well as high-level technical and administrative security requirements for a system in a given environment. Traditionally, providing security for a system focuses on the confidentiality of the information on it. However, protecting the data integrity and system and data availability is just as important. For example, when processing United States intelligence information, there are three attributes that require protection: confidentiality, integrity, and availability.
Learn more about catching the bad guy in this free white paper.
Sponsored by DLT Solutions
- Dynamic DNS—an Object Lesson in Problem Solving
- Making Linux and Android Get Along (It's Not as Hard as It Sounds)
- Using Salt Stack and Vagrant for Drupal Development
- New Products
- A Topic for Discussion - Open Source Feature-Richness?
- Drupal Is a Framework: Why Everyone Needs to Understand This
- Validate an E-Mail Address with PHP, the Right Way
- RSS Feeds
- Readers' Choice Awards
- Tech Tip: Really Simple HTTP Server with Python
- DynDNS
3 hours 14 min ago - Reply to comment | Linux Journal
3 hours 47 min ago - All the articles you talked
6 hours 10 min ago - All the articles you talked
6 hours 13 min ago - All the articles you talked
6 hours 15 min ago - myip
10 hours 39 min ago - Keeping track of IP address
12 hours 30 min ago - Roll your own dynamic dns
17 hours 44 min ago - Please correct the URL for Salt Stack's web site
20 hours 55 min ago - Android is Linux -- why no better inter-operation
23 hours 11 min ago
Enter to Win an Adafruit Pi Cobbler Breakout Kit for Raspberry Pi
It's Raspberry Pi month at Linux Journal. Each week in May, Adafruit will be giving away a Pi-related prize to a lucky, randomly drawn LJ reader. Winners will be announced weekly.
Fill out the fields below to enter to win this week's prize-- a Pi Cobbler Breakout Kit for Raspberry Pi.
Congratulations to our winners so far:
- 5-8-13, Pi Starter Pack: Jack Davis
- 5-15-13, Pi Model B 512MB RAM: Patrick Dunn
- 5-21-13, Prototyping Pi Plate Kit: Philip Kirby
- Next winner announced on 5-27-13!
Free Webinar: Hadoop
How to Build an Optimal Hadoop Cluster to Store and Maintain Unlimited Amounts of Data Using Microservers
Realizing the promise of Apache® Hadoop® requires the effective deployment of compute, memory, storage and networking to achieve optimal results. With its flexibility and multitude of options, it is easy to over or under provision the server infrastructure, resulting in poor performance and high TCO. Join us for an in depth, technical discussion with industry experts from leading Hadoop and server companies who will provide insights into the key considerations for designing and deploying an optimal Hadoop cluster.
Some of key questions to be discussed are:
- What is the “typical” Hadoop cluster and what should be installed on the different machine types?
- Why should you consider the typical workload patterns when making your hardware decisions?
- Are all microservers created equal for Hadoop deployments?
- How do I plan for expansion if I require more compute, memory, storage or networking?
Developer Poll
Comments
How about multiple partitions?
Collin,
It was an enlightening article for me. However, I have a slightly different problem. I have a USB disk (1GB) which when I fsck.vfat - shows the following:
dosfsck 3.0.3, 18 May 2009, FAT32, LFN
/dev/sdb1: 379 files, 55267/62958 clusters
I cannot see the files on the drive. Moreover, when I do:
$sudo sfdisk -l -f /dev/sdb1
Disk /dev/sdb1: 1015 cylinders, 32 heads, 62 sectors/track
Units = cylinders of 1015808 bytes, blocks of 1024 bytes, counting from 0
Device Boot Start End #cyls #blocks Id System
/dev/sdb1p1 ? 392205+ 967563- 575358- 570754815+ 72 Unknown
start: (c,h,s) expected (1023,31,62) found (357,116,40)
end: (c,h,s) expected (1023,31,62) found (357,32,45)
/dev/sdb1p2 ? 85024+ 1060845- 975821- 968014120 65 Novell Netware 386
start: (c,h,s) expected (1023,31,62) found (288,115,43)
end: (c,h,s) expected (1023,31,62) found (367,114,50)
/dev/sdb1p3 ? 942480+ 1918301- 975821- 968014096 79 Unknown
start: (c,h,s) expected (1023,31,62) found (366,32,33)
end: (c,h,s) expected (1023,31,62) found (357,32,43)
/dev/sdb1p4 ? 0 1833279- 1833280- 1818613248 d Unknown
start: (c,h,s) expected (0,0,1) found (372,97,50)
end: (c,h,s) expected (1023,31,62) found (0,10,0)
I tried mounting each of the separate partitions by changing the partition ID to VFAT, but it still didn't work. I dont know if data can still be recovered from it. What do you suggest?
Regards,
Subh
Thanks
I was having issues with a flash drive not being detected just now. Wouldn't mount and fsck.msdos gave a funny error. following your steps to view the partition table and with a bit of help from google, the active flag was set to 81H. So I used fdisk to toggle it and now it works. :)
Flash drive recovery
I brought a 49GB ameco flash drive. after using of 2 months, by mistake I formated it in windows using NTFS. Then it goes to RAW file system. It is showing in windows but for formating is not supporting in FAT/FAT32. Then i tryied in Linux, but the drive is not showing. One of my friend said that, it having problem with '0" sector problem. what can I do?
LINUCKS SAVES TEH DAY!!1
LINUCKS SAVES TEH DAY!!1
Who ever made the comment
Who ever made the comment above is a pr*** yes linux did save the day and your an asshole.
stoped at the first step
Hi, I tried to follow your instructions to recovery data froma a camera, but when i try to make dd if=/dev/sda of=file from a live cd of kubuntu, my computer doesn´t work. any help? thanx a lot
This Makes sense, I've had a similar experience with Linux
This makes sense. I once had a friend who had a Microsoft Word document on his flash drive which was corrupted on Windows. I stuck the flash drive in my laptop run Ubuntu v 6.06 (Freeware/shareware Linux) and opened the file up without any problems whatsoever. It just worked.
Hey iv lost all my work on my
Hey iv lost all my work on my lexar usb. Very important work. how do i recover all of it. please anyone help???
FAT was (probably) not corrupted
The many FF FF entries in the beginnning of the FAT were probably correct:
In FAT systems, unfragmenting utilities usually deploy directories at the beginning of the partition. If there are not too many entries in a directory, the 32-bit entries in the directories all fit in one block (e.g. in a system with 8k-blocks, there are 256 entries per block), so the directory "file" has the lenght of one block. It is marked in the fat with FFF (FAT12), FF FF (FAT16) or FF FF FF FF (FAT32).
So I would expect to see many FF bytes in the start of a FAT. Did you ever look whether the FAT contained FF bytes at the beginning or not?
The boot sector of a fat disk partition (not the MBR) contains drive parameters , if the FAT boot sector is damaged, you will have some problems. I suppose windows damaged that sector due to some bug, not the FAT. Writing there, e.g the information that there are about 165 fats ;-)
The disk parameters consist of head/cylinder/sector information (which can safely be ignored (and is ignored, I guess, even by Windows) since it is purely redundant, the relevant data being in the MBR, plus some routine information (e.g. bytes per sector, which is virtually alway 512), plus vital information as number reserved sectors at the start of the partition, which has to be known to calculate the start of the first FAT. Whether the information about the number of FATs is vital depends on the probability that someone created a FAT system with only one FAT ...
Collin - Thank you, thank you, thank you
Collin - Thank you for posting this article! Yesterday, I accidently shut down my Windows XP computer without ejecting my Lexar Jumpdrive. Afterward, I got the "Drive not Formatted" error. Fortunately I found your article, and have a second computer running Redhat. Following essentially the same precedure you described, I was able to recover all the data from my disabled Jumpdrive. You saved the day. Thanks again!!
512MB USB corrupted in Windows XP
Hey! i just happened to jump to this page, nice comments here. my problem is that this very incidence happened with me 2 weeks back. my 512 MB kingston usb disk got corrupted. i have tried numerous programs to read it. it is shown in windows xp as removabe drive but it cannot be formatted. the system is shown as raw. some hard disk tools do show the exact size of the disk but can anyone tell me how to get the disk back! i will appreciate the replies to my email at sash@highnoon.com.pk
Thankx!
Recovery Tool!!!
PPL before you try anything you must check this.
http://www.runtime.org/gdb.htm
I managed to recover my files after 3 mins and with beautifull interface. This software works perfect. I tryed dozens dos recovery tools and noone worked
Try this mmaybe it helps you out
Regards
GetDataBack Sucks
this is just another hostage holding, overpriced data reocovery tools that won't recover jack until you pay the outrageous $$$
I totally agree i knew i
I totally agree i knew i shouldn't have wasted my dollars on this crap software it completely fucked up my drive and none of the files it recovered actually worked!!!!!!!! useless piece of crap software i am demanding a refund but these fuckers will probably get away with it!!!
re:
stuck the flash drive in my laptop run Ubuntu v 6.06 (Freeware/shareware Linux) and opened the file up without any problems whatsoever. It just worked.
gpart can help you too
The information here was invaluable, because it gave me some encouragement in trying to recover the 250GB USB drive that Win2K suddenly didnt want to accept after I missed that a VMWare Virtual machine had mounted the drive...
I lost the partition table and have no disk large enough to create an image to.
With the above info I started dumping 50MB of the disk and found that no physical damage was evident, but still no way of finding the appropriate data for the approach above.
Knowing that it was a single 250GB FAT32 partition I downloaded GPart
http://www.stud.uni-hannover.de/user/76201/gpart/
It guessed what I believe correctly and after reboot the disk was mountable (in fact it automounted which maybe wasnt the best approach). I ran fsck.vfat with no reported errors!
Once again, I had great help of the info you supplied and hope that more people in desperate need will find your article.
fsck.msdos reporting to find 165 FATs
Thanks for the great article. When trying fsck.msdos on a damaged CF card image, I stumbled over the same problem:
the "disk" claimed to have something near 165 FATs
(actually 191 in my case). I then noticed that you mounted the MBR instead of the FAT partition. When specifying the partition offset with losetup (I believe 0x8000 in your case), e.g.
losetup -o 32768 /dev/loop2 /tmp/r1then fsck.msdos should be able to find 2 FATs (the number of FATs should be at offset 0x10 from start of the partition) and your Rapair Attempt #1 might work.
If the partion table was intact, dd'ing /dev/sda1 instead of /dev/sda would give you the partition image only, thus eliminating the need to care about the partition offset.
Unfortunately, in my case FAT#2 amd the directory table is damaged. I'm going to write a restore program exploiting the FAT chains...
Thanks,
Joerg
links to FAT info?
Great article. I'm now trying to recover an 11gb FAT32 partition from my wife's windows machine. The MBR seems OK ( fdisk sees the partition - as does w2k disk manager ). Somehow the partition itself is messed up ( virus? sunspots? ). windows doesn't think it has a file system. fsck.vfat thinks it has 255 FATs.
This article is exactly what I was looking for in trying to fix this. But it assumes a lot of info about FAT file systems:
"That looked like an allocation chain with 16-bit entries. If these had taken the form 31 dd 00 00 32 dd 00 00 rather than 31 dd 32 dd, I might have thought I was looking at FAT32."
Where do you find this info? This is way beyond my meager knowledge. Any references would be *really* useful.
re: links to FAT info?
Where do you find this info? This is way beyond my meager knowledge. Any references would be *really* useful.
Sorry, I don't remember. But I remember reading somewhere that what FATxx means is is that the cluster numbers take xx bits. Hence seeing two consecutive 16-bit numbers (31 dd 32 dd) gave me the clue that it was FAT16. Unless a FAT filesystem is severely fragmented, one would expect to see consecutive cluster numbers either in a file allocation chain (cluster numbers within a file) or the free list.
NOTE: I haven't verified the full technical accuracy of the following links, your mileage may vary, not a statement of my employer, don't try this at home, etc etc etc., but these are just links that appear useful, just based on a casual glance:
I just googled on "fat16 fat32 structure cluster number" (no quotes); the first couple of links look very useful. One of them contains a pointer to http://home.teleport.com/~brainy/fatgen102.pdf, which looks pretty useful.
Another place to look is http://www.storagereview.com/guide2000/ref/hdd/file/clustChaining.html, which I think you'll find helpful.
FAT info
Here, very cool site!
http://home.freeuk.net/foxy2k/disk/disk1.htm
Of course, advisable to handle with care, preferrably messing with an image file first. :-)
What to do when FAT1/FAT2 aren't working?
Salve!
Thank you for this artikel, but what to do when both FATs are gone?
I have a problem wit a 128 MB SMartMedia Card (FAT16 formated with
axxpac, a memory extention for PalmIIIx http://www.axxpac.de),
probly due ejct during writing and befor unounting it with Linux.
What I found out (with help from Debian-User-German) ML befor finding your article:
cfdisk 2.12p
Disk Drive: /dev/hde
Size: 131072000 bytes, 131 MB
Heads: 16 Sectors per Track: 32 Cylinders: 500
Name Flags Part Type FS Type [Label] Size (MB)
Pri/Log Free Space 0,03*
hde1 Boot Primary FAT16 131,05*
From a fresh formateded Card wrote I 64 Bit to the Card I can't mounted
dd if=/hd1/smartmedia128/neu/ddsmart128-neu-050616 ibs=1 skip=24063 bs=1 \
count=64 seek=24063 of=/dev/hde
Now cfdisk tells:
hde1 Boot Primary FAT16 [AXXPAC/TH ] 131,05*
The card is now mountable, I see all directories and all files, *g*
but only files smaller then 0x4000Bit (16384) can be read without
read/write errors. dosfsck will truncate all files to <=16384 and
is no help. Is this 0x4000 limit based on cluster - that there is
information to jump to the next cluster missing?
With fsck I got also the errormessage that multiple files or
directories use the same cluster.
ls -lRA is working, but some files and dirs have the date of the
crash day - but they are older and not written on that day.
So "ls -lRA" is not the final "Acid Test" for the recovery, a "cp -Rp *"
would not work in my case.
-What can I do insted of msfsck?
-When I something with "ls -lRA" the FAT1/FAT2 are still there?
-How can I extract the starting adresses for each file I see
with ls -lRA?
I know that there are tools like autopsy, but I hope that
the FATs are still recoverable.
Greetings
rob
Continue.... What to do when both FAT not working...
dosfsck will truncate all files to <=16384 and
is no help. Is this 0x4000 limit based on cluster - that there is
information to jump to the next cluster missing?
With fsck I got also the errormessage that multiple files or
directories use the same cluster.
ls -lRA is working, but some files and dirs have the date of the
crash day - but they are older and not written on that day.
So "ls -lRA" is not the final "Acid Test" for the recovery, a "cp -Rp *"
would not work in my case.
-What can I do insted of msfsck?
-When I something with "ls -lRA" the FAT1/FAT2 are still there?
-How can I extract the starting adresses for each file I see
with ls -lRA?
I know that there are tools like autopsy, but I hope that
the FATs are still recoverable.
Greetings
rob
continue ... does the forum don't like "
read/write errors. dosfsck will truncate all files to smaller 16384 and
is no help. Is this 0x4000 limit based on cluster - that there is
information to jump to the next cluster missing?
With fsck I got also the errormessage that multiple files or
directories use the same cluster.
ls -lRA is working, but some files and dirs have the date of the
crash day - but they are older and not written on that day.
So "ls -lRA" is not the final "Acid Test" for the recovery, a "cp -Rp *"
would not work in my case.
-What can I do insted of msfsck?
-When I something with "ls -lRA" the FAT1/FAT2 are still there?
-How can I extract the starting adresses for each file I see
with ls -lRA?
I know that there are tools like autopsy, but I hope that
the FATs are still recoverable.
Greetings
rob
PS: Sorry for my fragmentated post ;)
The FATs
From what I understood, you've overwritten both FATs with "clean" ones? Bad move, sorry..
FAT = File Allocation Table .. basically, holds the information of where different parts of files are on a disk.
The root directory (which is located right after the FATs), however, holds some other info: file names, attributes, sizes, dates, and starting clusters' numbers, that's why you can see the files and can access them, but only the first 16kB, since that is the size of a cluster on that particular disk..
Was the drive corrupted or filesystem?
This piece is confusing: "According to Lexar tech support, there is a bug with Windows 2000 (that MS never bothered to fix) and can corrupt the drive when it is removed without proper eject.".
Does this mean that the drive was damaged because of this bug (and you could say good bye my $70 USB), or was it the filesystem on this drive (so that reformatting that USB would make it usable again)?
re: Was the drive corrupted or filesystem?
Just the filesystem was corrupted. The electronics in the card were fine.
Prosoft engineering
Prosoft engineering produces a range of data rescue software for the Mac which I have personally used with much success. They support everying from HDD to memory cards to USB flash drives.
address is: http://www.prosofteng.com
There are various products from Image Rescue to Data Rescue, they are not open source but there are trial versions available for download which will allow you to recover a file at a time. Of course all of this is for the mac only. They are famous for their official Novell client for Mac as well.
Shameless ad.
Shameless ad.
Mounting under /tmp
Nice article, printed and saved for if I ever need to do something similar. A very quick point though - beware of mounting under /tmp on systems that aren't yours; some badly written tmp cleanup scripts can go in and clean up your newly mounted filesystem :-( I've lost filesystems to this a couple of time before I worked out what was going on...
JPEG images
I approached a similar problem I had differently - I knew I was looking for JPEG images and that there was a chance they were intact. I assumed the FAT was unreliable, and admittedly forgot about the second FAT copy.
I also assumed there was no fragmentation, and then proceeded to 'dd' anything that looked like an EXIF header +1.5MB to disk as individual files.
Something along these lines:
hexdump -C sda1_flashdisk.dd | grep -i "exif" >headers.hex
cat headers.hex | awk --non-decimal-data '{print (sprintf("%d","0x"$1)/512)}' > headers.512.dec
cat headers.512.dec | xargs --replace bash -c "dd skip={} if=sda1_flashdisk.dd bs=512 count=3000 of=./{}.jpg"
I was lucky on several counts: all files were of predicatable content, there was little if any fragmentation, and JPEG seems to tolerate excess junk added to the end of file :-)
I wish I had known about this
I wish I had known about this about a month ago. My Father had a 128MB Sandisk USB flash disk which he had been using under Windows 2000 and it died in a rather spectacular way, the only difference here though is that when I fed it to my linux workstation, it did not find any partition records - it was royally goosed. I had an identical USB flash disk to my Father's and tried to overwrite the partition records from my chip to his, but with no success. Extremely interesting article though and very well researched. Congratulations on recovering your data - I challenge any Windows user to even come close to that without having to write a suite of programs.
Overall, pretty good
I've done this type of recovery myself, using basically the same approach: look at hex dumps and compare the corrupted media with uncorrupted media, looking for areas that match, then copying individual sectors in an attempt to produce something readable. I wouldn't have thought of using the backup FAT table for fsck.msdos, though. :) Usually, fixing a partition table would do it. Or I would've copied FAT#2 on top of FAT#1 and just tried to mount it...
Overwriting FAT#1 with FAT#2 (or vice-versa)
Overwriting FAT#1 with FAT#2 (or vice-versa) - this isn't necessarilly a good idea if there's a chance that both are more or less corrupted.
In such cases, trying to "merge" them (with extreme care, of course) would be better..
Well, just using the copy #1 at one time, and #2 at the other, while both times trying to access & restore files and see which time you get better results ("proper" file contents), would be the most cautious way.
thanks for your comment
Thanks for posting your comment! Those are both good ideas, which I didn't think of. Well, I thought of trying to fix the partition table but I didn't know enough about the boot sector contents (and still don't).
The important thing is that GNU/Linux distros give us enough tools so that we can approach these problems in different ways... even problems caused by closed operating systems!
Thanks again for your note.
Question: How would gpart hav
Question: How would gpart have performed on that job?
I recovered once a whole laptop for someone in the office with half a years work of source code on it...
"I recovered once a whole lap
"I recovered once a whole laptop for someone in the office with half a years work of source code on it"
Can we infer from your comment that your colleague whose work you saved is a software developer who had not backed up his or her work in six months? Yeesh! I'm getting queasy just thinking about this; I need to go lie down for a while ....
Windows tools to test
Hey, there are some windows based tools that exist but I don't think they work for flash drives, but you could always try.
Driverescue 1.9d (scans through bios in windows).
Testdisk - http://www.cgsecurity.org/testdisk.html
PCInspector - which looks exactly like Driverescue before driverescue went commerical http://www.pcinspector.de/file_recovery/UK/welcome.htm
My usb-disk (Trekstore, 8
My usb-disk (Trekstore, 8 GB) was damaged by unpluging during a write-operation.
I tried some ways, mentioned above. Nothing worked.
Finally I found Testdisk and it worked greatly!
Many thanks for that advice!
Using windows Disk Manager
Using windows Disk Manager to creat a new partition for your usb drive, although may lost 8MB space, still is the best way to do the rescure for a USB flash drive.
Or using Partition Magic
Or using Partition Magic Boot Disk to repartition this USB drive, you will gain back all the space on it.
Recover HD after Ghosting
Could you use this same process to recover files after Ghosting a HD? If not; what would you suggest I use? If it's possible at all to recover files after Ghosting a HD.