Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

It's an 8 GB Patriot thumb drive, which I've used extensively with lots of data. Today, it is detected, but all data is gone: (EDIT at least some data is still there, but the partition table is gone)


EDIT @Sathya (thanks) here's the relevant output from sudo fdisk -l:

Disk /dev/sdc: 8019 MB, 8019509248 bytes
247 heads, 62 sectors/track, 1022 cylinders
Units = cylinders of 15314 * 512 = 7840768 bytes

Disk /dev/sdc doesn't contain a valid partition table

It looks like it is /dev/sdc, with that 8 GB... and no partition table.

I tried to mount /dev/sdc (and then dmesg | tail):

/media> sudo mount /dev/sdc mytmp
mount: wrong fs type, bad option, bad superblock on /dev/sdc,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

/media> dmesg | tail
[   24.300000]  sdc: unknown partition table
[   24.320000] sd 2:0:0:0: Attached scsi removable disk sdc
[   24.370000] usb-storage: device scan complete
[   26.870000] EXT2-fs error (device sdc): ext2_check_descriptors: Block bitmap for group 1 not in group (block 0)!
[   26.870000] EXT2-fs: group descriptors corrupted!
[   50.420000] unhashed dentry being revalidated: .DCOPserver_eeepc-brendanma__0
[   50.430000] unhashed dentry being revalidated: .DCOPserver_eeepc-brendanma__0
[   50.430000] unhashed dentry being revalidated: .DCOPserver_eeepc-brendanma__0
[ 5565.470000] EXT2-fs error (device sdc): ext2_check_descriptors: Block bitmap for group 1 not in group (block 0)!
[ 5565.470000] EXT2-fs: group descriptors corrupted!

EDIT @Col: results from testdisk

Disk /dev/sdc - 8013 MB / 7642 MiB - CHS 1022 247 62
Current partition structure:
     Partition                  Start        End    Size in sectors

Partition sector doesn't have the endmark 0xAA55

After I hit [proceed], it says:

Structure: Ok.


Keys A: add partition, L: load backup, Enter: to continue

The "Structure: Ok." seems reassuring... will "A: add partition" make my old data accessible (if it's still there), or will it make a new, fresh partition?

Another option is "[ MBR Code ] Write TestDisk MBR code to first sector" - would it be better to do this?


EDIT I found that at least some of my data is still on the flash drive, by using the below, and searching for English text in less (like " the "):

cat /dev/sde | tr -cd '\11\12\40\1540-\176' | less

(The drive changed from "/dev/sdb" to "/dev/sde" because I connected some extra drives today). I've learnt that "/dev/sde1" would be the first partition; and "/dev/sde" is the whole drive. Because unix treats these devices just like files, you can use all the ordinary unix file commands on them, like cat, and then process them like any other stream of data. The tr above removes non-printable characters ("\40" is space, which I wanted to preserve). In less, you can use "/" to search, similar to Vim.

How can I get my data back (assuming it's still there)? If only the partition table is corrupted, is there a standard "partition recovery tool"? Is there a way to "repartition" without deleting everything?

share|improve this question
    
@ChrisF That answer doesn't work... and I can't respond to it there - so I have here (see the edit to the question). –  13ren Aug 31 '09 at 10:45
    
@13ren - If you use the same OpenID on both sites you can associate your accounts. However for now please e-mail team@superuser.com and ask them to do the association. I have merged the two questions in the meantime. –  Diago Aug 31 '09 at 10:55
1  
@13ren - I know you can't respond there. I was including the link for the moderators so they could find the question. –  ChrisF Aug 31 '09 at 10:57
    
Thanks ChrisF, sorry I misunderstood. I sent an email as you suggested. @Diago thanks for merging, I can comment now. I'll email them again. –  13ren Aug 31 '09 at 11:12
1  
Insert the drive, and do a sudo fdisk -l and can you please update the post with the output ? –  Sathya Aug 31 '09 at 12:34

4 Answers 4

It may be worth running testdisk over the device, it sounds like your partition table may have gone pop. Testdisk should be able to recover your data.

share|improve this answer
    
@Col thanks, but I don't have testdisk - I tried sudo testdisk and man testdisk. I just apt-get installed it, and it detects /dev/sdc with 8GB (as added to the question). I'm don't want to proceed further til I understand a little more. –  13ren Sep 1 '09 at 5:56
    
@Col, I've tried it, and added the results to the question –  13ren Sep 2 '09 at 8:14
    
If you're feeling nervous it might be worth using dd to create an image of the usb stick onto your hard drive, I think this should work even with an unmountable drive since it copies bit for bit. –  Col Sep 2 '09 at 8:28
    
Thanks, that's a good idea! But how do I copy a file with dd? The man page talks about "files"... oh, does /dev/sdc count as a "file"? So I can just copy the entire /dev/sdc to a convention file like" dd /dev/sdc mybackupfile ? –  13ren Sep 2 '09 at 8:38
    
Yah, it would be something like sudo dd if=/dev/sdc of=usb.dd which will copy everything to the file usb.dd –  Col Sep 2 '09 at 8:44

ddrescue is the tool you need. I don't think you'll be able to salvage the partition table and access the data any other way, based on the output you've posted from testdisk etc.

http://www.forensicswiki.org/wiki/Ddrescue

ddrescue is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.

The basic operation of ddrescue is fully automatic. That is, you don't have to wait for an error, stop the program, read the log, run it in reverse mode, etc.

If you use the logfile feature of ddrescue, the data is rescued very efficiently, (only the needed blocks are read). Also you can interrupt the rescue at any time and resume it later at the same point.

Ddrescue does not write zeros to the output when it finds bad sectors in the input, and does not truncate the output file if not asked to. So, every time you run it on the same output file, it tries to fill in the gaps without wiping out the data already rescued.

If you have two or more damaged copies of a file, cdrom, etc, and run ddrescue on all of them, one at a time, with the same output file, you will probably obtain a complete and error-free file. This is because the probability of having damaged areas at the same places on different input files is very low. Using the logfile, only the needed blocks are read from the second and successive copies.

share|improve this answer

Don't worry, your data is not gone --- you are right about the disk not being mounted, regardless of what the graphical interface says.

You can mount it by doing (as root) something like:

mount /dev/sdb1 /media/Patriot\ Memory

Where I think that sdb1 refers to your usb stick--it might be sdc1 or sdd1

share|improve this answer
    
Or even sda1, depending on the age of the computer (ie, if the harddrives in it are IDE ones) –  Matthew Scharley Aug 31 '09 at 8:12
    
@Michiel thanks - but it says "mount: No medium found". Using sdc1 and sdd1 gave "mount: special device /dev/sdc1 does not exist", which makes me think that "sdb1" does exist but there's something wrong. It has worked for months, and nothing changed that I know of - so I fear it's some kind of hardware failure –  13ren Aug 31 '09 at 11:20

While it's possible to rebuild the partition table, the first thing you should do it to take an image of the device. You can do this with dd if=/dev/sdb of=~/memstick.img - changing paths as needed.

Once you've done that, run PhotoRec, which should be able to pull out any files that are on there. If you've got everything you need, format the stick and start again, if not, you can try further data recovery.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.