Hello,
Very much as the topic title says, recently a flash drive I use of a sudden turned out to have a RAW file system - when plugged in, on several different computers, it is recognised, but is either seen as "needs to be formatted", or simply as empty, with both taken up and available space zero in properties etc. Since I had some files on it I would like to recover, I tried several different tools, including TestDisk - however, while TestDisk detects it in the Disk Selection menu (if it is seen as "unformatted" by the OS, and not if it is seen as just "empty", for some reason), the Quick Search option simply doesn't produce any output, and likewise if I try to go to the Advanced option instead of Analyse from the corresponding menu.
Any advice, thus, on how to proceed with the matter would be greatly appreciated.
Thanks.
RAW file system of a USB flash drive
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
- cgrenier
- Site Admin
- Posts: 5432
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: RAW file system of a USB flash drive
Please copy/paste the testdisk.log file content.
Re: RAW file system of a USB flash drive
Here it is (I think it should be obvious, but it is the SanDisK device I have problems with):
Thu Mar 1 14:38:07 2018
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, February 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows Vista (6002) SP2
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=200049647616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=8036285952
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=200049647616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=8036285952
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=140207473152
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=100661248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=8036285952
Hard disk list
Disk /dev/sda - 200 GB / 186 GiB - CHS 24321 255 63, sector size=512 - Hitachi (number edited out), S/N:3830373036314242443630304857424347314744, FW:BBDOC33P
Disk /dev/sdb - 8036 MB / 7663 MiB - CHS 977 255 63, sector size=512 - SanDisk U3 Titanium, FW:7.01
Drive F: - 100 MB / 95 MiB - CHS 23 64 32, sector size=2048 - SanDisk U3 Titanium, FW:7.01
Partition table type defaults to Intel
Disk /dev/sdb - 8036 MB / 7663 MiB - SanDisk U3 Titanium
Partition table type: Intel
Analyse Disk /dev/sdb - 8036 MB / 7663 MiB - CHS 977 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk /dev/sdb - 8036 MB / 7663 MiB - CHS 977 255 63
file_pread(5,2,buffer,15695871(977/5/52)) ReadFile The request could not be performed because of an I/O device error.
file_pread(5,1,buffer,15695871(977/5/52)) ReadFile The request could not be performed because of an I/O device error.
file_pread(5,2,buffer,15695872(977/5/53)) lseek err Invalid argument
file_pread(5,2,buffer,15697552(977/32/32)) lseek err Invalid argument
file_pread(5,1,buffer,15697552(977/32/32)) lseek err Invalid argument
file_pread(5,2,buffer,15697553(977/32/33)) lseek err Invalid argument
file_pread(5,2,buffer,15697616(977/33/33)) lseek err Invalid argument
file_pread(5,1,buffer,15697616(977/33/33)) lseek err Invalid argument
file_pread(5,14,buffer,15695874(977/5/55)) lseek err Invalid argument
file_pread(5,3,buffer,15695888(977/6/6)) lseek err Invalid argument
file_pread(5,3,buffer,15695935(977/6/53)) lseek err Invalid argument
file_pread(5,8,buffer,15695951(977/7/6)) lseek err Invalid argument
file_pread(5,11,buffer,15695998(977/7/53)) lseek err Invalid argument
file_pread(5,2,buffer,15697920(977/38/22)) lseek err Invalid argument
Results
interface_write()
No partition found or selected for recovery
search_part()
Disk /dev/sdb - 8036 MB / 7663 MiB - CHS 977 255 63
file_pread(5,2,buffer,15695871(977/5/52)) ReadFile The request could not be performed because of an I/O device error.
file_pread(5,1,buffer,15695871(977/5/52)) ReadFile The request could not be performed because of an I/O device error.
file_pread(5,2,buffer,15695872(977/5/53)) lseek err Invalid argument
file_pread(5,2,buffer,15697552(977/32/32)) lseek err Invalid argument
file_pread(5,1,buffer,15697552(977/32/32)) lseek err Invalid argument
file_pread(5,2,buffer,15697553(977/32/33)) lseek err Invalid argument
file_pread(5,2,buffer,15697616(977/33/33)) lseek err Invalid argument
file_pread(5,1,buffer,15697616(977/33/33)) lseek err Invalid argument
file_pread(5,1,buffer,15695871(977/5/52)) ReadFile The request could not be performed because of an I/O device error.
file_pread(5,1,buffer,15695872(977/5/53)) lseek err Invalid argument
Results
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
Interface Advanced
TestDisk exited normally.
Thu Mar 1 14:38:07 2018
Command line: TestDisk
TestDisk 7.1-WIP, Data Recovery Utility, February 2018
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows Vista (6002) SP2
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=200049647616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=8036285952
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=200049647616
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=8036285952
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=140207473152
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\D:
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=100661248
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=8036285952
Hard disk list
Disk /dev/sda - 200 GB / 186 GiB - CHS 24321 255 63, sector size=512 - Hitachi (number edited out), S/N:3830373036314242443630304857424347314744, FW:BBDOC33P
Disk /dev/sdb - 8036 MB / 7663 MiB - CHS 977 255 63, sector size=512 - SanDisk U3 Titanium, FW:7.01
Drive F: - 100 MB / 95 MiB - CHS 23 64 32, sector size=2048 - SanDisk U3 Titanium, FW:7.01
Partition table type defaults to Intel
Disk /dev/sdb - 8036 MB / 7663 MiB - SanDisk U3 Titanium
Partition table type: Intel
Analyse Disk /dev/sdb - 8036 MB / 7663 MiB - CHS 977 255 63
Current partition structure:
Partition sector doesn't have the endmark 0xAA55
search_part()
Disk /dev/sdb - 8036 MB / 7663 MiB - CHS 977 255 63
file_pread(5,2,buffer,15695871(977/5/52)) ReadFile The request could not be performed because of an I/O device error.
file_pread(5,1,buffer,15695871(977/5/52)) ReadFile The request could not be performed because of an I/O device error.
file_pread(5,2,buffer,15695872(977/5/53)) lseek err Invalid argument
file_pread(5,2,buffer,15697552(977/32/32)) lseek err Invalid argument
file_pread(5,1,buffer,15697552(977/32/32)) lseek err Invalid argument
file_pread(5,2,buffer,15697553(977/32/33)) lseek err Invalid argument
file_pread(5,2,buffer,15697616(977/33/33)) lseek err Invalid argument
file_pread(5,1,buffer,15697616(977/33/33)) lseek err Invalid argument
file_pread(5,14,buffer,15695874(977/5/55)) lseek err Invalid argument
file_pread(5,3,buffer,15695888(977/6/6)) lseek err Invalid argument
file_pread(5,3,buffer,15695935(977/6/53)) lseek err Invalid argument
file_pread(5,8,buffer,15695951(977/7/6)) lseek err Invalid argument
file_pread(5,11,buffer,15695998(977/7/53)) lseek err Invalid argument
file_pread(5,2,buffer,15697920(977/38/22)) lseek err Invalid argument
Results
interface_write()
No partition found or selected for recovery
search_part()
Disk /dev/sdb - 8036 MB / 7663 MiB - CHS 977 255 63
file_pread(5,2,buffer,15695871(977/5/52)) ReadFile The request could not be performed because of an I/O device error.
file_pread(5,1,buffer,15695871(977/5/52)) ReadFile The request could not be performed because of an I/O device error.
file_pread(5,2,buffer,15695872(977/5/53)) lseek err Invalid argument
file_pread(5,2,buffer,15697552(977/32/32)) lseek err Invalid argument
file_pread(5,1,buffer,15697552(977/32/32)) lseek err Invalid argument
file_pread(5,2,buffer,15697553(977/32/33)) lseek err Invalid argument
file_pread(5,2,buffer,15697616(977/33/33)) lseek err Invalid argument
file_pread(5,1,buffer,15697616(977/33/33)) lseek err Invalid argument
file_pread(5,1,buffer,15695871(977/5/52)) ReadFile The request could not be performed because of an I/O device error.
file_pread(5,1,buffer,15695872(977/5/53)) lseek err Invalid argument
Results
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition
Interface Advanced
TestDisk exited normally.
Re: RAW file system of a USB flash drive
Well - any further suggestions, please?
Re: RAW file system of a USB flash drive
Hmm, so nothing at all to do here, then?
- cgrenier
- Site Admin
- Posts: 5432
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: RAW file system of a USB flash drive
You should clone the USB disk using ddrescue as described in https://www.cgsecurity.org/testdisk.pdf
Once it's done, use PhotoRec on the clone.
Once it's done, use PhotoRec on the clone.
Re: RAW file system of a USB flash drive
Thanks - I will see what I can do.
Admittedly, I haven't looked much at PhotoRec, but isn't it mostly meant to work with image files, though?
Admittedly, I haven't looked much at PhotoRec, but isn't it mostly meant to work with image files, though?
Re: RAW file system of a USB flash drive
On a Linux Mint Cinnamon 18.3 system, trying to execute the suggested installation command (apt install ddrescue), I get an 'Unable to locate package' message, and the Software Manager doesn't seem to have it listed; there is, however, something called Gddrescue - would it be the same software, or could it be used in lieu?
Thanks.
Thanks.
Re: RAW file system of a USB flash drive
Hmm, ok - trying to follow the testdisk.pdf instructions and those here: http://www.gnu.org/software/ddrescue/ma ... .html#Top
, from the terminal:
ddrescue /dev/sdb usb.dd usb.log
ddrescue: Can't open input file: Permission denied
Would I be doing something wrong, or would there be another problem?
Also, from the same link (DDRescue manual):
ddrescue /dev/sdb usb.dd usb.log
ddrescue: Can't open input file: Permission denied
Would I be doing something wrong, or would there be another problem?
Also, from the same link (DDRescue manual):
Thanks again.3 Using ddrescue safely
Ddrescue is like any other power tool. You need to understand what it does, and you need to understand some things about the machines it does those things to, in order to use it safely.
Never try to rescue a r/w mounted partition. The resulting copy may be useless. It is best that the device or partition to be rescued is not mounted at all, not even read-only. Then how is it to be detected?
Never try to repair a file system on a drive with I/O errors; you will probably lose even more data.Is this not exactly the case, by the logfile I pasted above?
If you use a device or a partition as destination, any data stored there will be overwritten. How to assign, then, a path for the output file?
Some systems may change device names on reboot (e.g. udev enabled systems). If you reboot, check the device names before restarting ddrescue.
If you interrupt the rescue and then reboot, any partially copied partitions should be hidden before allowing them to be touched by any operating system that tries to mount and "fix" the partitions it sees.