linux - Partition table corrupted (USB flash drive)

11
2013-09

Questioner

It's an 8 GB Patriot thumb drive, which I've used extensively with lots of data. Today, it is detected, but all data is gone: (EDIT at least some data is still there, but the partition table is gone)

EDIT @Sathya (thanks) here's the relevant output from sudo fdisk -l:

Disk /dev/sdc: 8019 MB, 8019509248 bytes
247 heads, 62 sectors/track, 1022 cylinders
Units = cylinders of 15314 * 512 = 7840768 bytes

Disk /dev/sdc doesn't contain a valid partition table

It looks like it is /dev/sdc, with that 8 GB... and no partition table.

I tried to mount /dev/sdc (and then dmesg | tail):

/media> sudo mount /dev/sdc mytmp
mount: wrong fs type, bad option, bad superblock on /dev/sdc,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

/media> dmesg | tail
[   24.300000]  sdc: unknown partition table
[   24.320000] sd 2:0:0:0: Attached scsi removable disk sdc
[   24.370000] usb-storage: device scan complete
[   26.870000] EXT2-fs error (device sdc): ext2_check_descriptors: Block bitmap for group 1 not in group (block 0)!
[   26.870000] EXT2-fs: group descriptors corrupted!
[   50.420000] unhashed dentry being revalidated: .DCOPserver_eeepc-brendanma__0
[   50.430000] unhashed dentry being revalidated: .DCOPserver_eeepc-brendanma__0
[   50.430000] unhashed dentry being revalidated: .DCOPserver_eeepc-brendanma__0
[ 5565.470000] EXT2-fs error (device sdc): ext2_check_descriptors: Block bitmap for group 1 not in group (block 0)!
[ 5565.470000] EXT2-fs: group descriptors corrupted!

EDIT @Col: results from testdisk

Disk /dev/sdc - 8013 MB / 7642 MiB - CHS 1022 247 62
Current partition structure:
     Partition                  Start        End    Size in sectors

Partition sector doesn't have the endmark 0xAA55

After I hit [proceed], it says:

Structure: Ok.


Keys A: add partition, L: load backup, Enter: to continue

The "Structure: Ok." seems reassuring... will "A: add partition" make my old data accessible (if it's still there), or will it make a new, fresh partition?

Another option is "[ MBR Code ] Write TestDisk MBR code to first sector" - would it be better to do this?

EDIT I found that at least some of my data is still on the flash drive, by using the below, and searching for English text in less (like " the "):

cat /dev/sde | tr -cd '\11\12\40\1540-\176' | less

(The drive changed from "/dev/sdb" to "/dev/sde" because I connected some extra drives today). I've learnt that "/dev/sde1" would be the first partition; and "/dev/sde" is the whole drive. Because unix treats these devices just like files, you can use all the ordinary unix file commands on them, like cat, and then process them like any other stream of data. The tr above removes non-printable characters ("\40" is space, which I wanted to preserve). In less, you can use "/" to search, similar to Vim.

How can I get my data back (assuming it's still there)? If only the partition table is corrupted, is there a standard "partition recovery tool"? Is there a way to "repartition" without deleting everything?

Answers

Col

It may be worth running testdisk over the device, it sounds like your partition table may have gone pop. Testdisk should be able to recover your data.

ddrescue is the tool you need. I don't think you'll be able to salvage the partition table and access the data any other way, based on the output you've posted from testdisk etc.

http://www.forensicswiki.org/wiki/Ddrescue

ddrescue is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.

The basic operation of ddrescue is fully automatic. That is, you don't have to wait for an error, stop the program, read the log, run it in reverse mode, etc.

If you use the logfile feature of ddrescue, the data is rescued very efficiently, (only the needed blocks are read). Also you can interrupt the rescue at any time and resume it later at the same point.

Ddrescue does not write zeros to the output when it finds bad sectors in the input, and does not truncate the output file if not asked to. So, every time you run it on the same output file, it tries to fill in the gaps without wiping out the data already rescued.

If you have two or more damaged copies of a file, cdrom, etc, and run ddrescue on all of them, one at a time, with the same output file, you will probably obtain a complete and error-free file. This is because the probability of having damaged areas at the same places on different input files is very low. Using the logfile, only the needed blocks are read from the second and successive copies.

Related Answers

a_m0d

Okay, it turns out that in this case something (possibly when I wrote the iso-9660 file system to the drive) has triggered some form of internal write protection on the drive. There are no external write protection / hold switches, but yet this is the output in dmesg when I run

dd if=/dev/zero of=/dev/sdb

as root:

sd 9:0:0:0: [sdb] Add. Sense: Write protected
end_request: I/O error, dev sdb, sector 4028744
sd 9:0:0:0: [sdb] Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE,SUGGEST_OK
sd 9:0:0:0: [sdb] Sense Key : Data Protect [current] 
Info fld=0x0

Note the comments in there about protection! However, when I plug the device in, I get,

scsi 10:0:0:0: Direct-Access     FLASH    Drive  AU_USB20  8.07 PQ: 0 ANSI: 2
sd 10:0:0:0: [sdb] 4069376 512-byte hardware sectors (2084 MB)
sd 10:0:0:0: [sdb] Write Protect is off
sd 10:0:0:0: [sdb] Mode Sense: 03 00 00 00
sd 10:0:0:0: [sdb] Assuming drive cache: write through
sd 10:0:0:0: [sdb] 4069376 512-byte hardware sectors (2084 MB)
sd 10:0:0:0: [sdb] Write Protect is off
sd 10:0:0:0: [sdb] Mode Sense: 03 00 00 00
sd 10:0:0:0: [sdb] Assuming drive cache: write through

Note that this message says that the device is not write protected! So unfortunately, it looks like the disk has had it (i.e kaput).

CesarB

Looking at the dmesg snippet, it seems something is automaticaly mounting the drive (check with mount). Before doing anything with it, you should umount it by hand.

Then zero the block with the partition table (dd if=/dev/zero of=... bs=512 count=1), and run a partitioning tool to recreate an empty partition table. After that, unplug and replug (should not be needed, but...) and create/format the partitions you want on it. After creating the partitions (perhaps you will have to unplug and replug again), you should have /dev/sdb1 or something like that, which is where you should create the filesystem.

Note that all steps should be done as root (with sudo or an equivalent). Be careful to not write the wrong device name, or you could wipe your harddisk!

Anonymous

I had the exact same problem as you. However, I was able to find a solution from a surprising place. An old laptop with Windows 98SE on it, which is the last Windows system I ever owned. Anyway just put it in and when you try to access the drive Windows will ask you if you'd like to format it. Click yes and you'll have a fat16 formatted drive that's fully functional. I don't know if it works with newer versions of Windows though. Best of luck.

David Cantwell

I am new to this Linux sys admin stuff, so when I had exactly the same problem I poked and prodded with no madness to my method but managed to remove the iso9660 fs and reclaim the thumb drive.

$ sudo fdisk -l /dev/sdb1

returned

Disk /dev/sdb1: 16.0 GB, 16037969920 bytes 64 heads, 32 sectors/track, 15295 cylinders, total 31324160 sectors Units = sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I>/O size (minimum/optimal): 512 bytes / 512 bytes Disk identifier: 0x57155aa7
Device Boot      Start         End      Blocks   Id  System
/dev/sdb1p1 2048 31324159 15661056 5 Extended

So I then tried

$ sudo fdisk /dev/sdb1

Command (m for help): m Command action . . .

followed by

Command (m for help): d Extended Selected partition 1

Command (m for help): v Remaining 31324159 unallocated 512-byte sectors

Then when prompted again selected for fdisk to create an empty dos partition table (something I figured I could overwrite with whatever I wanted later)

Command (m for help): v Remaining 31324159 unallocated 512-byte sectors

Command (m for help): o Building a new DOS disklabel with disk identifier 0xea06616f. Changes will remain in memory only, until you decide to write them. After that, of course, the previous content won't be recoverable.

Warning: invalid flag 0x0000 of partition table 4 will be corrected by w(rite)

Command (m for help): w The partition table has been altered!

Calling ioctl() to re-read partition table.

WARNING: Re-reading the partition table failed with error 22: Invalid argument. The kernel still uses the old table. The new table will be used at the next reboot or after you run partprobe(8) or kpartx(8) Syncing disks.

I took the returned messages to mean that I at least "broke" the iso9660 fs so went on to try mkfs

dcantwell@LASOKA:~$ sudo mkfs /dev/sdb1 mke2fs 1.41.14 (22-Dec-2010) Filesystem label= OS type: Linux Block size=4096 (log=2) Fragment size=4096 (log=2) Stride=0 blocks, Stripe width=0 blocks 979200 inodes, 3915520 blocks .195776 blocks (5.00%) reserved for the super user First data block=0 .Maximum filesystem blocks=4009754624 120 block groups 32768 blocks per group, 32768 fragments per group 8160 inodes per group Superblock backups stored on blocks: 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208

Writing inode tables: done
Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 28 mounts or 180 days, whichever comes first. Use tune2fs -c or -i to override.

All this left me with the "lost+found" directory on the thumb drive.

dcantwell@LASOKA:~$ sudo mount /dev/sdb1 /media/ dcantwell@LASOKA:~$ ls /media/ lost+found

Finally, I went to the Ubuntu website (http://www.ubuntu.com/download/ubuntu/download, section 2) and used the stick to create a bootable image of Ubuntu for trial use, and it let me. The beauty of the Ubuntu images made on the stick this way is that they can be deleted easily and the stick reclaimed for other use.

I mention this very last step because in hindsight I wonder if I had done just that in the first place that it would have worked, I dunno. As mentioned, I am new to this Linux stuff and am trying different distro's (e.g. Fedora, Ubuntu, etc.) on live cd's with whatever media is most convenient, and I sure do break a lot of shit along the way.

Kim

mkdosfs -I /dev/sdb

will create a vfat file system on the drive. The -I has to be passed if you want the file system to be created on the entire drive and not on a partition. If you want to partition the drive first, use fdisk. Of course fdisk can't read the drive now, because it doesn't have any partitions. But I'm sure it will be able to write to it.

gbarry

Remove the drive and see if you can still read from it. I wonder if somehow /dev/usb (or wherever you read from) has become an ordinary file directory.

Slink84

Have you tried to re-mount it with -t option?

umount /dev/sdb
sudo mount -t vfat /dev/sdb /mnt/point

If that won't work, I'll try to reproduce it later, when I get home. Seems like an interesting problem. Will be fun to tinker with :]

gbarry

I still feel that we are assuming something that's going to turn out to be untrue. Since the device is readable, this line will at least let you see the data for yourself, rather than depending on the other programs' interpretations.

 dd if=/dev/sdb  count=1 | xxd -g1 -u

Also, maybe we could separate problems with the dev node from problems with what's on the device, by forcing it onto another port. Either plug it into another USB jack, or plug another drive in first, to occupy sdb.

Joakim Elofsson

Currently your USB drive got no partition table, iso9660 filesystem sits directly on whole disk (just like a cdrom)

sd 6:0:0:0: [sdb] Assuming drive cache: write through
 sdb: unknown partition table

I think you need make a partition first

sudo cfdisk /dev/sdb

(make sure it's not mounted before) in the fdisk application create a new partition.

after that is done, make the filesystem on the new partition

sudo mkfs -t vfat /dev/sdb1

MaxMackie

Maybe with a simple

mkfs -t vfat /dev/sdb1

slhck

Last night I did

dd if=fedora.iso of=sdx

After four hours I had an unbootable, unchangeable, iso9660 brick. Following David's train of thought, I called Ubuntu's 'startup disk creator' (Type 'startup disk creator' in the dash), and merely selected 'erase'. That did it.

The USB drive was then reported as FAT32 and all is well.

knockNrod

U3 has a utility to remove their U3 partition. It also removes the partition/device created by the utility that creates the iso 9660. This has been confirmed only on a u3 usb stick, but it is able to be formatted now and totally recover the entire space as a flash drive. You might give it a shot.

Home

linux - Partition table corrupted (USB flash drive)