Raw Flash Disk Recover

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
diogogc
Posts: 2
Joined: 10 Mar 2016, 19:01

Raw Flash Disk Recover

#1 Post by diogogc »

Hi!

I'm trying to recover a USB Flash Diskfrom a friend that gone Raw and need some help. By this far, i managed to access the disk and obtain a disk image with TestDisk and recover some files with PhotoRec, but i really need to recover this files with the original folder and filename structure and PhotoRec is not helping me with it. So i really need some thoughts of what to do to restore filesystem and partitions.
By using Testsdisk and considering the flash disk as a non partitioned media, the program managed to find the disk, but the filesystem was tagged as UNKNOWN. All attempts to find a partition by quick or deep search returned no partitions found. With the advanced options, i changed the filesystem type to FAT32 but the program says that the disk has a Bad Boot sector and Bad Backup Boot Sector. The attempts to rebuild Bootsector returned the message of incorrect values on the extrapolated boot sectors.
So... i really need some help from the experts here. Is there something that i can still try to recover this Flash Drive? Or there is some way to recover my files preserving the filename and folder structure?

Thanks!

Below there is some sections of the TestDisk log:

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.2.0-27-generic (#32-Ubuntu SMP Fri Jan 22 04:49:08 UTC 2016) x86_64
Compiler: GCC 4.9
Compilation date: 2015-04-03T09:01:54
ext2fs lib: 1.42.12, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 1953525168 sectors
/dev/sda: user_max 1953525168 sectors
/dev/sda: native_max 1953525168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 1 sectors, sector size=512
Hard disk list
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - ST1000LM024 HN-M101MBB, S/N:S32SJ5CF103685, FW:2BA30001
Disk /dev/sdb - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - Samsung M3 Portable, FW:1301
Disk /dev/sdc - 16 GB / 14 GiB - CHS 15296 64 32, sector size=512 - SMI USB DISK, FW:1100
Disk /dev/sdd - 8022 MB / 7651 MiB - CHS 1023 247 62, sector size=512 - General USB Flash Disk, FW:1.00

Partition table type default to Intel
Disk /dev/sdd - 8022 MB / 7651 MiB - General USB Flash Disk
Partition table type: None

Analyse Disk /dev/sdd - 8022 MB / 7651 MiB - CHS 1023 247 62
Current partition structure:
P Unknown 0 0 1 1023 48 50 15669248

search_part()
Disk /dev/sdd - 8022 MB / 7651 MiB - CHS 1023 247 62

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdd - 8022 MB / 7651 MiB - CHS 1023 247 62

Results

interface_write()

No partition found or selected for recovery

Interface Advanced
P Unknown 0 0 1 1023 48 50 15669248
Change partition type:
P FAT32 0 0 1 1023 48 50 15669248

fat32_boot_sector
P FAT32 0 0 1 1023 48 50 15669248
Boot sector
Bad

Backup boot sector
Bad

First sectors (Boot code and partition information) are not identical.
Second sectors (cluster information) are not identical.
Third sectors (Second part of boot code) are not identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.
Change partition type:
P Unknown 0 0 1 1023 48 50 15669248
Partition table type default to Intel
Disk /dev/sdd - 8022 MB / 7651 MiB - General USB Flash Disk
Partition table type: Intel
Partition table type default to Intel
Disk /dev/sdd - 8022 MB / 7651 MiB - General USB Flash Disk
Partition table type: None
Partition table type default to Intel
Disk /dev/sdd - 8022 MB / 7651 MiB - General USB Flash Disk
Partition table type: None

Analyse Disk /dev/sdd - 8022 MB / 7651 MiB - CHS 1023 247 62
Current partition structure:
P Unknown 0 0 1 1023 48 50 15669248

search_part()
Disk /dev/sdd - 8022 MB / 7651 MiB - CHS 1023 247 62
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery

Interface Advanced
P Unknown 0 0 1 1023 48 50 15669248

Interface Advanced
P Unknown 0 0 1 1023 48 50 15669248
Change partition type:
P FAT32 0 0 1 1023 48 50 15669248

fat32_boot_sector
P FAT32 0 0 1 1023 48 50 15669248
Boot sector
Bad

Backup boot sector
Bad

First sectors (Boot code and partition information) are not identical.
Second sectors (cluster information) are not identical.
Third sectors (Second part of boot code) are not identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.

P FAT32 0 0 1 1023 48 50 15669248
rebuild_FAT_BS p_fat12 0, p_fat16 0, p_fat32 1

Search root cluster failed
0 ?--------- 0 0 0 DIR00001
0 ?--------- 0 0 0 DIR00002
0 ?--------- 0 0 0 DIR00003
0 ?--------- 0 0 0 DIR00004
0 ?--------- 0 0 0 DIR00005
0 ?--------- 0 0 0 DIR00006
0 ?--------- 0 0 0 DIR00007
0 ?--------- 0 0 0 DIR00008
0 ?--------- 0 0 0 DIR00009
0 ?--------- 0 0 0 DIR00010
0 ?--------- 0 0 0 DIR00011
0 ?--------- 0 0 0 DIR00012
0 ?--------- 0 0 0 DIR00013
New / Current boot sector
FAT32
sector_size 512 47934
cluster_size 8 134
reserved 32 63176
fats 2 230
dir_entries 0 11005
sectors 0 61200
media F8 C6
fat_length 0 34980
secs_track 62 54169
heads 247 29687
hidden 0 1098526564
total_sect 15669248 1985384146
fat32_length 15292 3508451446
flags 0000 2BFF
version 0.0 248.172
root_cluster 0 1811290056
info_sector 1 22441
backup_boot 6 60912
free_count 18446744073709551615 18446744072317035948
next_free 18446744073709551615 18446744072661412073
Extrapolated boot sector and current boot sector are different.
Warning: Extrapolated boot sector have incorrect values.


dir_partition inode=0
P FAT32 0 0 1 1023 48 50 15669248
FAT32: Can't list files, bad root cluster.
Directory /
Warning: Extrapolated boot sector have incorrect values.
Don't write new boot!

P FAT32 0 0 1 1023 48 50 15669248

fat32_boot_sector
P FAT32 0 0 1 1023 48 50 15669248
Boot sector
Bad

Backup boot sector
Bad

First sectors (Boot code and partition information) are not identical.
Second sectors (cluster information) are not identical.
Third sectors (Second part of boot code) are not identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Raw Flash Disk Recover

#2 Post by cgrenier »

Choose Intel (as recommended by TestDisk) when scanning the disk.
If a FAT is listed, try Advanced, Boot, RebuildBS, List. Choose Write, confirm, Quit if you can see the files.

diogogc
Posts: 2
Joined: 10 Mar 2016, 19:01

Re: Raw Flash Disk Recover

#3 Post by diogogc »

Hi!
I already tried to recover by chosing Intel Partition Table but it didn't worked.
When chosing Intel, the first screen shows the message "Partition sector doesn't have the endmark 0xAA55Partition sector doesn't have the endmark 0xAA55" and the quick and deeper search for partitions return nothing.
Any guess?

Thanks

Locked