Sandisk 16G thumb drive
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
- Posts: 13
- Joined: 01 Mar 2012, 20:50
Re: Sandisk 16G thumb drive
Disk /dev/sdb – 16 GB / 14 GiB – CHS 1948 255 63
Partition Start End Size in sectors
P FAT32 0 0 1 1948 111 18 31301631
Partition Start End Size in sectors
P FAT32 0 0 1 1948 111 18 31301631
Re: Sandisk 16G thumb drive
Please press p to list your data.
Did you see your data or an error message?
Did you see your data or an error message?
-
- Posts: 13
- Joined: 01 Mar 2012, 20:50
Re: Sandisk 16G thumb drive
Let's see if this works, I created a word doc out of a screen shot, since I can't post a jpeg.
Rat's, that doesn't work.
Anyway, I am back to trying to "rebuild a boot sector"
It says no FAT found searching subdirectry
Rat's, that doesn't work.
Anyway, I am back to trying to "rebuild a boot sector"
It says no FAT found searching subdirectry
-
- Posts: 13
- Joined: 01 Mar 2012, 20:50
Re: Sandisk 16G thumb drive
How do I rebuild the FAT data?
Re: Sandisk 16G thumb drive
Sry for delay!
Repeat your steps through analyze until you get to the following;
I assume it has been partition table type intel and not None.
None means, no partition table, so it's not possible to write any partition.
Just press enter, highlight Write and press enter and y to confirm.
Now you registererd you partition to the partition table and you should be able to diagnose your thumb drive using rebuild bs.
Please use partition table type intel!
Fiona
Repeat your steps through analyze until you get to the following;
Code: Select all
Disk /dev/sdb – 16 GB / 14 GiB – CHS 1948 255 63
Partition Start End Size in sectors
P FAT32 0 0 1 1948 111 18 31301631
None means, no partition table, so it's not possible to write any partition.
Just press enter, highlight Write and press enter and y to confirm.
Now you registererd you partition to the partition table and you should be able to diagnose your thumb drive using rebuild bs.
Please use partition table type intel!
Fiona
-
- Posts: 13
- Joined: 01 Mar 2012, 20:50
Re: Sandisk 16G thumb drive
I don't understand the "highlight" part of the instructions. I don't know how to highlight something in DOS.Fiona wrote:Sry for delay!
Repeat your steps through analyze until you get to the following;I assume it has been partition table type intel and not None.Code: Select all
Disk /dev/sdb – 16 GB / 14 GiB – CHS 1948 255 63 Partition Start End Size in sectors P FAT32 0 0 1 1948 111 18 31301631
None means, no partition table, so it's not possible to write any partition.
Just press enter, highlight Write and press enter and y to confirm.
Now you registererd you partition to the partition table and you should be able to diagnose your thumb drive using rebuild bs.
Please use partition table type intel!
Fiona
Re: Sandisk 16G thumb drive
If you press enter at this screen;
The next screen appears and at the bootom of the screen you will see;
Quit...Deeper Search...Write.
I meant, highlight or choose Write using your arrow key.
Another easy solution to repeat it, is;
Confirm in testdisk through, until you see;
"Quit...Deeper Search...Write" at the bottom of the screen.
Please, close TestDisk using Quit.
In your testdisk folder, you'll find a file testdisk.log
Can you copy and paste the content here?
Code: Select all
Disk /dev/sdb – 16 GB / 14 GiB – CHS 1948 255 63
Partition Start End Size in sectors
P FAT32 0 0 1 1948 111 18 31301631
Quit...Deeper Search...Write.
I meant, highlight or choose Write using your arrow key.
Another easy solution to repeat it, is;
Confirm in testdisk through, until you see;
"Quit...Deeper Search...Write" at the bottom of the screen.
Please, close TestDisk using Quit.
In your testdisk folder, you'll find a file testdisk.log
Can you copy and paste the content here?
-
- Posts: 13
- Joined: 01 Mar 2012, 20:50
Re: Sandisk 16G thumb drive
Is this what you require?
Mon Mar 5 10:58:28 2012
Command line: TestDisk
TestDisk 6.14-WIP, Data Recovery Utility, January 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-02-26T19:38:17
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=16026435072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=16026435072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=155737451520
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=0
Fix disk size using CHS
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - ST9160314AS, FW:D005DEM1
Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63, sector size=512 - SanDisk Cruzer, FW:8.02
Partition table type default to Intel
Disk /dev/sdb - 16 GB / 14 GiB - SanDisk Cruzer
Partition table type: Intel
Analyse Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63
Current partition structure:
No partition is bootable
Ask the user for vista mode
search_vista_part: 1
search_part()
Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63
file_pread(5,2,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,1,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,7,buffer,31301633(1948/111/21)) lseek err Invalid argument
file_pread(5,8,buffer,31301640(1948/111/28)) lseek err Invalid argument
file_pread(5,3,buffer,31301648(1948/111/36)) lseek err Invalid argument
file_pread(5,3,buffer,31301695(1948/112/20)) lseek err Invalid argument
file_pread(5,8,buffer,31301711(1948/112/36)) lseek err Invalid argument
file_pread(5,11,buffer,31301758(1948/113/20)) lseek err Invalid argument
file_pread(5,2,buffer,31303680(1948/143/52)) lseek err Invalid argument
Results
interface_write()
No partition found or selected for recovery
search_part()
Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63
file_pread(5,2,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,1,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,1,buffer,31301631(1948/111/19)) ReadFile The request could not be performed because of an I/O device error.
Results
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
A new copy of MBR code has been written.
You have to reboot for the change to take effect.
Analyse Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63
Current partition structure:
No partition is bootable
Ask the user for vista mode
search_vista_part: 1
search_part()
Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63
file_pread(5,2,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,1,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,7,buffer,31301633(1948/111/21)) lseek err Invalid argument
file_pread(5,8,buffer,31301640(1948/111/28)) lseek err Invalid argument
file_pread(5,3,buffer,31301648(1948/111/36)) lseek err Invalid argument
file_pread(5,3,buffer,31301695(1948/112/20)) lseek err Invalid argument
file_pread(5,8,buffer,31301711(1948/112/36)) lseek err Invalid argument
file_pread(5,11,buffer,31301758(1948/113/20)) lseek err Invalid argument
file_pread(5,2,buffer,31303680(1948/143/52)) lseek err Invalid argument
Results
interface_write()
No partition found or selected for recovery
Mon Mar 5 10:58:28 2012
Command line: TestDisk
TestDisk 6.14-WIP, Data Recovery Utility, January 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-02-26T19:38:17
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=16026435072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=16026435072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=155737451520
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=0
Fix disk size using CHS
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - ST9160314AS, FW:D005DEM1
Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63, sector size=512 - SanDisk Cruzer, FW:8.02
Partition table type default to Intel
Disk /dev/sdb - 16 GB / 14 GiB - SanDisk Cruzer
Partition table type: Intel
Analyse Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63
Current partition structure:
No partition is bootable
Ask the user for vista mode
search_vista_part: 1
search_part()
Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63
file_pread(5,2,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,1,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,7,buffer,31301633(1948/111/21)) lseek err Invalid argument
file_pread(5,8,buffer,31301640(1948/111/28)) lseek err Invalid argument
file_pread(5,3,buffer,31301648(1948/111/36)) lseek err Invalid argument
file_pread(5,3,buffer,31301695(1948/112/20)) lseek err Invalid argument
file_pread(5,8,buffer,31301711(1948/112/36)) lseek err Invalid argument
file_pread(5,11,buffer,31301758(1948/113/20)) lseek err Invalid argument
file_pread(5,2,buffer,31303680(1948/143/52)) lseek err Invalid argument
Results
interface_write()
No partition found or selected for recovery
search_part()
Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63
file_pread(5,2,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,1,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,1,buffer,31301631(1948/111/19)) ReadFile The request could not be performed because of an I/O device error.
Results
interface_write()
No partition found or selected for recovery
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Interface Advanced
A new copy of MBR code has been written.
You have to reboot for the change to take effect.
Analyse Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63
Current partition structure:
No partition is bootable
Ask the user for vista mode
search_vista_part: 1
search_part()
Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63
file_pread(5,2,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,1,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,7,buffer,31301633(1948/111/21)) lseek err Invalid argument
file_pread(5,8,buffer,31301640(1948/111/28)) lseek err Invalid argument
file_pread(5,3,buffer,31301648(1948/111/36)) lseek err Invalid argument
file_pread(5,3,buffer,31301695(1948/112/20)) lseek err Invalid argument
file_pread(5,8,buffer,31301711(1948/112/36)) lseek err Invalid argument
file_pread(5,11,buffer,31301758(1948/113/20)) lseek err Invalid argument
file_pread(5,2,buffer,31303680(1948/143/52)) lseek err Invalid argument
Results
interface_write()
No partition found or selected for recovery
Re: Sandisk 16G thumb drive
Yes, it's exactly what I required.
Ther is no difference.
Partition table type intel didn't find anything.
Also, your thumb drive is available but RAW (unformatted).
To have a check for better results, you could test Deeper Search and partition table type None.
If a partition is found and your data are listed, you could copy them.
But I've seen an error also;
Please scan your complete disk.
http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
Ther is no difference.
Partition table type intel didn't find anything.
Also, your thumb drive is available but RAW (unformatted).
To have a check for better results, you could test Deeper Search and partition table type None.
If a partition is found and your data are listed, you could copy them.
But I've seen an error also;
In case, try PhotoRec to recover your data.ReadFile The request could not be performed because of an I/O device error.
Please scan your complete disk.
http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
-
- Posts: 13
- Joined: 01 Mar 2012, 20:50
Re: Sandisk 16G thumb drive
Norton 360 has a program called "Sonar" that doesn't like PhotoRec. When I tried to run the program, it would shut me down and get rid of the program.
With persistance, I was able to accept PhotoRec as a program safe to run, here is the log file result;
<?xml version="1.0" encoding="UTF-8" ?>
- <dfxml xmloutputversion="1.0">
- <metadata xmlns="http://www.forensicswiki.org/wiki/Categ ... ensics_XML" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/">
<dc:type>Carve Report</dc:type>
</metadata>
- <creator>
<package>PhotoRec</package>
<version>6.14-WIP</version>
- <build_environment>
<compiler>GCC 4.6, Cygwin 1007.9</compiler>
<compilation_date>2012-03-05T23:17:37</compilation_date>
<library name="libext2fs" version="1.41.8" />
<library name="libewf" version="20100226" />
<library name="libjpeg" version="80" />
<library name="libntfs" version="10:0:0" />
</build_environment>
- <execution_environment>
<os_sysname>Windows</os_sysname>
<os_release>Windows XP SP3</os_release>
<os_version>Windows XP SP3</os_version>
<host>D9F9DCD1</host>
<arch>i686</arch>
<uid>0</uid>
<start_time>2012-03-09T11:55:37-0500</start_time>
</execution_environment>
</creator>
- <source>
<image_filename>/dev/sdb</image_filename>
<sectorsize>512</sectorsize>
<device_model>SanDisk Cruzer</device_model>
<image_size>16026435072</image_size>
- <volume>
- <byte_runs>
<byte_run offset="0" img_offset="0" len="16026435072" />
</byte_runs>
</volume>
</source>
<configuration />
</dfxml>
With persistance, I was able to accept PhotoRec as a program safe to run, here is the log file result;
<?xml version="1.0" encoding="UTF-8" ?>
- <dfxml xmloutputversion="1.0">
- <metadata xmlns="http://www.forensicswiki.org/wiki/Categ ... ensics_XML" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/">
<dc:type>Carve Report</dc:type>
</metadata>
- <creator>
<package>PhotoRec</package>
<version>6.14-WIP</version>
- <build_environment>
<compiler>GCC 4.6, Cygwin 1007.9</compiler>
<compilation_date>2012-03-05T23:17:37</compilation_date>
<library name="libext2fs" version="1.41.8" />
<library name="libewf" version="20100226" />
<library name="libjpeg" version="80" />
<library name="libntfs" version="10:0:0" />
</build_environment>
- <execution_environment>
<os_sysname>Windows</os_sysname>
<os_release>Windows XP SP3</os_release>
<os_version>Windows XP SP3</os_version>
<host>D9F9DCD1</host>
<arch>i686</arch>
<uid>0</uid>
<start_time>2012-03-09T11:55:37-0500</start_time>
</execution_environment>
</creator>
- <source>
<image_filename>/dev/sdb</image_filename>
<sectorsize>512</sectorsize>
<device_model>SanDisk Cruzer</device_model>
<image_size>16026435072</image_size>
- <volume>
- <byte_runs>
<byte_run offset="0" img_offset="0" len="16026435072" />
</byte_runs>
</volume>
</source>
<configuration />
</dfxml>