data recovery - No partition on USB Flash Drive?

24
2014-04
  • Skytunnel

    A friend gave me a corrupted USB memory stick to try recovery data from. But I've had some unusual results, so thought I'd share to see if anyone is familiar with this problem...

    • First off I just tried opening from my own PC. Windows prompted to Format the drive, which I of course declined
    • Downloaded TestDisk to anaylsis the drive. And right away I noticed something strange, on the listed drives it comes up as

    Disk /dev/sdc - 6144 B - USB Flash Drive

    • That's right, the first USB flash drive smaller than a floppy disk!?
    • Moving on anyway... first anaylsis comes up with:

    Partition sector doesn't have the endmark 0xAA55

    • TestDisk's Quick Search gave no results, moved on to Deeper Search:

    No partition found or selected for recovery

    • This left me stumped. I tired a couple of other programs with no success
    • I did manage to get a backup image, but it was just as small as TestDisk indicated, so nothing of use on it
    • After a few hours trying various suggestions from other sources, I gave in and just tried formatting the drive. But returned the message:

    Windows was unable to complete the format.

    • From googling that, the suggestion was to delete the partition. But there is no partition to delete in this case.
    • most recently I've tried formatting from cmd, and got this result:

    Format D: /FS:FAT32

    The type of the file system is RAW

    The new file system is FAT32

    Verifying 0M

    11 bad sectors were encountered during the format. These sectors cannot be guaranteed to have been cleaned

    The volume is too small for FAT32

    Anyone got any suggestions?


    UPDATE: As per suggestion from @Karen, I tried running a CLEAN from DISKPART, results as follows

    DiskPart has encountered an error: The request could not be preformed because of an I/O device error.

  • Answers
    Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

    Related Question

    linux - Partition table corrupted (USB flash drive)
  • Questioner

    It's an 8 GB Patriot thumb drive, which I've used extensively with lots of data. Today, it is detected, but all data is gone: (EDIT at least some data is still there, but the partition table is gone)


    EDIT @Sathya (thanks) here's the relevant output from sudo fdisk -l:

    Disk /dev/sdc: 8019 MB, 8019509248 bytes
    247 heads, 62 sectors/track, 1022 cylinders
    Units = cylinders of 15314 * 512 = 7840768 bytes
    
    Disk /dev/sdc doesn't contain a valid partition table
    

    It looks like it is /dev/sdc, with that 8 GB... and no partition table.

    I tried to mount /dev/sdc (and then dmesg | tail):

    /media> sudo mount /dev/sdc mytmp
    mount: wrong fs type, bad option, bad superblock on /dev/sdc,
           missing codepage or other error
           In some cases useful info is found in syslog - try
           dmesg | tail  or so
    
    /media> dmesg | tail
    [   24.300000]  sdc: unknown partition table
    [   24.320000] sd 2:0:0:0: Attached scsi removable disk sdc
    [   24.370000] usb-storage: device scan complete
    [   26.870000] EXT2-fs error (device sdc): ext2_check_descriptors: Block bitmap for group 1 not in group (block 0)!
    [   26.870000] EXT2-fs: group descriptors corrupted!
    [   50.420000] unhashed dentry being revalidated: .DCOPserver_eeepc-brendanma__0
    [   50.430000] unhashed dentry being revalidated: .DCOPserver_eeepc-brendanma__0
    [   50.430000] unhashed dentry being revalidated: .DCOPserver_eeepc-brendanma__0
    [ 5565.470000] EXT2-fs error (device sdc): ext2_check_descriptors: Block bitmap for group 1 not in group (block 0)!
    [ 5565.470000] EXT2-fs: group descriptors corrupted!
    

    EDIT @Col: results from testdisk

    Disk /dev/sdc - 8013 MB / 7642 MiB - CHS 1022 247 62
    Current partition structure:
         Partition                  Start        End    Size in sectors
    
    Partition sector doesn't have the endmark 0xAA55
    

    After I hit [proceed], it says:

    Structure: Ok.
    
    
    Keys A: add partition, L: load backup, Enter: to continue
    

    The "Structure: Ok." seems reassuring... will "A: add partition" make my old data accessible (if it's still there), or will it make a new, fresh partition?

    Another option is "[ MBR Code ] Write TestDisk MBR code to first sector" - would it be better to do this?


    EDIT I found that at least some of my data is still on the flash drive, by using the below, and searching for English text in less (like " the "):

    cat /dev/sde | tr -cd '\11\12\40\1540-\176' | less
    

    (The drive changed from "/dev/sdb" to "/dev/sde" because I connected some extra drives today). I've learnt that "/dev/sde1" would be the first partition; and "/dev/sde" is the whole drive. Because unix treats these devices just like files, you can use all the ordinary unix file commands on them, like cat, and then process them like any other stream of data. The tr above removes non-printable characters ("\40" is space, which I wanted to preserve). In less, you can use "/" to search, similar to Vim.

    How can I get my data back (assuming it's still there)? If only the partition table is corrupted, is there a standard "partition recovery tool"? Is there a way to "repartition" without deleting everything?


  • Related Answers
  • Col

    It may be worth running testdisk over the device, it sounds like your partition table may have gone pop. Testdisk should be able to recover your data.

  • Seasoned Advice (cooking)

    ddrescue is the tool you need. I don't think you'll be able to salvage the partition table and access the data any other way, based on the output you've posted from testdisk etc.

    http://www.forensicswiki.org/wiki/Ddrescue

    ddrescue is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.

    The basic operation of ddrescue is fully automatic. That is, you don't have to wait for an error, stop the program, read the log, run it in reverse mode, etc.

    If you use the logfile feature of ddrescue, the data is rescued very efficiently, (only the needed blocks are read). Also you can interrupt the rescue at any time and resume it later at the same point.

    Ddrescue does not write zeros to the output when it finds bad sectors in the input, and does not truncate the output file if not asked to. So, every time you run it on the same output file, it tries to fill in the gaps without wiping out the data already rescued.

    If you have two or more damaged copies of a file, cdrom, etc, and run ddrescue on all of them, one at a time, with the same output file, you will probably obtain a complete and error-free file. This is because the probability of having damaged areas at the same places on different input files is very low. Using the logfile, only the needed blocks are read from the second and successive copies.