RAW file system of a USB flash drive

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
AlGebra
Posts: 7
Joined: 02 Mar 2018, 05:21

RAW file system of a USB flash drive

#1 Post by AlGebra »

Hello,

Very much as the topic title says, recently a flash drive I use of a sudden turned out to have a RAW file system - when plugged in, on several different computers, it is recognised, but is either seen as "needs to be formatted", or simply as empty, with both taken up and available space zero in properties etc. Since I had some files on it I would like to recover, I tried several different tools, including TestDisk - however, while TestDisk detects it in the Disk Selection menu (if it is seen as "unformatted" by the OS, and not if it is seen as just "empty", for some reason), the Quick Search option simply doesn't produce any output, and likewise if I try to go to the Advanced option instead of Analyse from the corresponding menu.

Any advice, thus, on how to proceed with the matter would be greatly appreciated.

Thanks. :)

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: RAW file system of a USB flash drive

#2 Post by cgrenier »

Please copy/paste the testdisk.log file content.

AlGebra
Posts: 7
Joined: 02 Mar 2018, 05:21

Re: RAW file system of a USB flash drive

#3 Post by AlGebra »

Here it is (I think it should be obvious, but it is the SanDisK device I have problems with):



Thu Mar 1 14:38:07 2018
Command line: TestDisk

TestDisk 7.1-WIP, Data Recovery Utility, February 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows Vista (6002) SP2
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=200049647616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=8036285952
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=200049647616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=8036285952
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=140207473152
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=100661248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=8036285952
Hard disk list
Disk /dev/sda - 200 GB / 186 GiB - CHS 24321 255 63, sector size=512 - Hitachi (number edited out), S/N:3830373036314242443630304857424347314744, FW:BBDOC33P
Disk /dev/sdb - 8036 MB / 7663 MiB - CHS 977 255 63, sector size=512 - SanDisk U3 Titanium, FW:7.01
Drive F: - 100 MB / 95 MiB - CHS 23 64 32, sector size=2048 - SanDisk U3 Titanium, FW:7.01

Partition table type defaults to Intel
Disk /dev/sdb - 8036 MB / 7663 MiB - SanDisk U3 Titanium
Partition table type: Intel

Analyse Disk /dev/sdb - 8036 MB / 7663 MiB - CHS 977 255 63
Current partition structure:

Partition sector doesn't have the endmark 0xAA55

search_part()
Disk /dev/sdb - 8036 MB / 7663 MiB - CHS 977 255 63
file_pread(5,2,buffer,15695871(977/5/52)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,1,buffer,15695871(977/5/52)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,2,buffer,15695872(977/5/53)) lseek err Invalid argument
file_pread(5,2,buffer,15697552(977/32/32)) lseek err Invalid argument
file_pread(5,1,buffer,15697552(977/32/32)) lseek err Invalid argument
file_pread(5,2,buffer,15697553(977/32/33)) lseek err Invalid argument
file_pread(5,2,buffer,15697616(977/33/33)) lseek err Invalid argument
file_pread(5,1,buffer,15697616(977/33/33)) lseek err Invalid argument
file_pread(5,14,buffer,15695874(977/5/55)) lseek err Invalid argument
file_pread(5,3,buffer,15695888(977/6/6)) lseek err Invalid argument
file_pread(5,3,buffer,15695935(977/6/53)) lseek err Invalid argument
file_pread(5,8,buffer,15695951(977/7/6)) lseek err Invalid argument
file_pread(5,11,buffer,15695998(977/7/53)) lseek err Invalid argument
file_pread(5,2,buffer,15697920(977/38/22)) lseek err Invalid argument

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdb - 8036 MB / 7663 MiB - CHS 977 255 63
file_pread(5,2,buffer,15695871(977/5/52)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,1,buffer,15695871(977/5/52)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,2,buffer,15695872(977/5/53)) lseek err Invalid argument
file_pread(5,2,buffer,15697552(977/32/32)) lseek err Invalid argument
file_pread(5,1,buffer,15697552(977/32/32)) lseek err Invalid argument
file_pread(5,2,buffer,15697553(977/32/33)) lseek err Invalid argument
file_pread(5,2,buffer,15697616(977/33/33)) lseek err Invalid argument
file_pread(5,1,buffer,15697616(977/33/33)) lseek err Invalid argument
file_pread(5,1,buffer,15695871(977/5/52)) ReadFile The request could not be performed because of an I/O device error.

file_pread(5,1,buffer,15695872(977/5/53)) lseek err Invalid argument

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

Interface Advanced

TestDisk exited normally.

AlGebra
Posts: 7
Joined: 02 Mar 2018, 05:21

Re: RAW file system of a USB flash drive

#4 Post by AlGebra »

Well - any further suggestions, please?

AlGebra
Posts: 7
Joined: 02 Mar 2018, 05:21

Re: RAW file system of a USB flash drive

#5 Post by AlGebra »

Hmm, so nothing at all to do here, then?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: RAW file system of a USB flash drive

#6 Post by cgrenier »

You should clone the USB disk using ddrescue as described in https://www.cgsecurity.org/testdisk.pdf
Once it's done, use PhotoRec on the clone.

AlGebra
Posts: 7
Joined: 02 Mar 2018, 05:21

Re: RAW file system of a USB flash drive

#7 Post by AlGebra »

Thanks - I will see what I can do.

Admittedly, I haven't looked much at PhotoRec, but isn't it mostly meant to work with image files, though?

AlGebra
Posts: 7
Joined: 02 Mar 2018, 05:21

Re: RAW file system of a USB flash drive

#8 Post by AlGebra »

On a Linux Mint Cinnamon 18.3 system, trying to execute the suggested installation command (apt install ddrescue), I get an 'Unable to locate package' message, and the Software Manager doesn't seem to have it listed; there is, however, something called Gddrescue - would it be the same software, or could it be used in lieu?

Thanks.

AlGebra
Posts: 7
Joined: 02 Mar 2018, 05:21

Re: RAW file system of a USB flash drive

#9 Post by AlGebra »

Hmm, ok - trying to follow the testdisk.pdf instructions and those here: http://www.gnu.org/software/ddrescue/ma ... .html#Top , from the terminal:

ddrescue /dev/sdb usb.dd usb.log
ddrescue: Can't open input file: Permission denied

Would I be doing something wrong, or would there be another problem?

Also, from the same link (DDRescue manual):
3 Using ddrescue safely

Ddrescue is like any other power tool. You need to understand what it does, and you need to understand some things about the machines it does those things to, in order to use it safely.

Never try to rescue a r/w mounted partition. The resulting copy may be useless. It is best that the device or partition to be rescued is not mounted at all, not even read-only. Then how is it to be detected?

Never try to repair a file system on a drive with I/O errors; you will probably lose even more data.Is this not exactly the case, by the logfile I pasted above?

If you use a device or a partition as destination, any data stored there will be overwritten. How to assign, then, a path for the output file?

Some systems may change device names on reboot (e.g. udev enabled systems). If you reboot, check the device names before restarting ddrescue.

If you interrupt the rescue and then reboot, any partially copied partitions should be hidden before allowing them to be touched by any operating system that tries to mount and "fix" the partitions it sees.
Thanks again. ;)

Locked