rehabbing a flash drive

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
JoeBausch
Posts: 9
Joined: 11 Sep 2013, 14:05

rehabbing a flash drive

#1 Post by JoeBausch »

I smile as I find myself again using TestDisk/Photorec. A few months ago Photorec saved my bacon when I 'lost' some photos on a SD card.

The other day I was backing up an older 8 GB flash drive (FAT32?) on my OS X 10.5.x machine using Disk Utility by creating a disk image. This is something I had done previously on this flash drive (and many others) as a way to back up my data. I never expected running Disk Utility to creat a disk image could somehow crap out a drive! And my last backup of this flash drive was months ago so I would like to rehab it.

But the disk image creation did not finish successfully and now the flash drive won't mount. Disk Utility won't see it and Disk Warrior won't fix it.

I started data recovery yesterday using PhotoRec (on a different Mac, this one running something really old, 10.4.x!) and it was finding lots of files, but the time estimate for the I think what could be 7 GB of data was over 60 hours, so I abandoned that until later today when I can let it run over the weekend.

But I'm still hopeful to 'fix' whatever happened to it. I'll copy and paste most of what I've done so far using TestDisk.

Here is what shows initially:


Select a media (use Arrow keys, then press Enter):
Disk /dev/disk2 - 500 GB / 465 GiB (RO)
Disk /dev/disk3 - 500 GB / 465 GiB (RO)
Disk /dev/disk5 - 500 GB / 465 GiB (RO)
>Disk /dev/disk6 - 8086 MB / 7711 MiB
Disk /dev/rdisk2 - 500 GB / 465 GiB (RO)
Disk /dev/rdisk3 - 500 GB / 465 GiB (RO)
Disk /dev/rdisk4 - 499 GB / 465 GiB
Disk /dev/rdisk5 - 500 GB / 465 GiB (RO)
Disk /dev/rdisk6 - 8086 MB / 7711 MiB

Where disk6 seems to be showing with the correct size of the 8GB flash drive.

TestDisk seems to think this is a Humax, as shown below:


Please select the partition table type, press Enter when done.
[Intel ] Intel/PC partition
[EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
>[Humax ] Humax partition table
[Mac ] Apple partition map
[None ] Non partitioned media
[Sun ] Sun Solaris partition
[XBox ] XBox partition
[Return ] Return to disk selection



Hint: Humax partition table type has been detected.


I don't think that is correct, so I select Intel/PC partition and hit enter, and do an analyze, giving this:

Disk /dev/disk6 - 8086 MB / 7711 MiB
15794175 sectors - sector size=512

>[ Analyse ] Analyse current partition structure and search for lost partitions
[ Advanced ] Filesystem Utils
[ Geometry ] Change disk geometry
[ Options ] Modify options
[ MBR Code ] Write TestDisk MBR code to first sector
[ Delete ] Delete all data in the partition table
[ Quit ] Return to disk selection


Disk /dev/disk6 - 8086 MB / 7711 MiB - 15794175 sectors
Current partition structure:
Partition Start End Size in sectors

Warning: number of heads/cylinder mismatches 249 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 62 (FAT) != 1 (HD)
1 * FAT32 63 15794174 15794112 [JWB_THUMB]

Warning: Bad ending sector (CHS and LBA don't match)


It is here where I'm not quite sure how to proceed (assuming I've gotten to a good point on my own!).

Seeking guidance.

Joe

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: rehabbing a flash drive

#2 Post by Fiona »

Might be possible, if you have a faulty MBR that TestDisk displays your partition table as humax.
Normally should be Intel?
Would it be possible to run Intel partition table and Quick and in case nothing is found Deeper Search?
Please copy and paste the testdisk.log into your next log.

Fiona

JoeBausch
Posts: 9
Joined: 11 Sep 2013, 14:05

Re: rehabbing a flash drive

#3 Post by JoeBausch »

(love the kitty/duck pic Fiona, grin)

Here is the log file:


Wed Sep 11 09:10:12 2013
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 8.11.0 (Darwin Kernel Version 8.11.0: Wed Oct 10 18:26:00 PDT 2007; root:xnu-792.24
Compiler: GCC 4.0
Compilation date: 2013-07-30T14:08:32
ext2fs lib: 1.41.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: none
User is not root!
Hard disk list
Disk /dev/disk2 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/disk3 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/disk5 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/disk6 - 8086 MB / 7711 MiB - 15794175 sectors, sector size=512
Disk /dev/rdisk2 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/rdisk3 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/rdisk4 - 499 GB / 465 GiB - 976509120 sectors, sector size=512
Disk /dev/rdisk5 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/rdisk6 - 8086 MB / 7711 MiB - 15794175 sectors, sector size=512

Partition table type (auto): Humax
Disk /dev/disk6 - 8086 MB / 7711 MiB
Partition table type: Intel

Analyse Disk /dev/disk6 - 8086 MB / 7711 MiB - 15794175 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=63 1
FAT32 at 63/0/1
Info: size boot_sector 15794112, partition 15794112
FAT1 : 32-3886
FAT2 : 3887-7741
start_rootdir : 7742 root cluster : 2
Data : 7742-15794109
sectors : 15794112
cluster_size : 32
no_of_cluster : 493324 (2 - 493325)
fat_length 3855 calculated 3855
FAT differs, FAT sectors=624-640/3855
heads/cylinder 249 (FAT) != 1 (HD)
sect/track 62 (FAT) != 1 (HD)
set_FAT_info: name from BS used
get_geometry_from_list_part_aux head=1 nbr=2
Current partition structure:
Warning: number of heads/cylinder mismatches 249 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 62 (FAT) != 1 (HD)
1 * FAT32 63 15794174 15794112 [JWB_THUMB]

Warning: Bad ending sector (CHS and LBA don't match)
SIGHUP detected! TestDisk has been killed.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: rehabbing a flash drive

#4 Post by Fiona »

Warning: Bad ending sector (CHS and LBA don't match)
SIGHUP detected! TestDisk has been killed.
I usually ignore messages like bad ending sectors and any other messages related to the geometry of your USB-thumb.
I've rarely seen USB-thumbs which fulfilled Intel-MBR standard.
If something is not Intel-Standard or any otherpartition table type standard, testdisk generates such kind of messages.

But the strange thing is, that your terminal or console got killed.
It's the message SIGHUP!
Did you run TestDisk as root or superuser?
Info fromn TestDisk documentation;
Mac OS X (PowerPC)
[edit] Starting TestDisk or PhotoRec

Open the Terminal program found in the /Applications/Utilities folder.
Using terminal commands such as cd (change directory), navigate to the folder where you downloaded or installed TestDisk.
The only sure-fire way of doing this is typing cd(space) and then dragging the folder containing TestDisk into the Terminal window. This will copy the location of the TestDisk directory after the current command on the terminal command line.
If you have the TestDisk folder on your desktop, the command would look something like: cd ~/Desktop/testdisk-6.4
Move into the folder inside the TestDisk folder, where the binary executables are stored (in darwin/ on OS X ports). The command for this would look something like: cd darwin.
Now it's time to run TestDisk (or PhotoRec). To do this, type sudo ./testdisk (or sudo ./photorec). The sudo command tells your system to run testdisk as root ("administrator", or superuser). You will be required to enter your password (no echo of the characters will be apparent on the screen), then press the enter key to validate .
Fiona

JoeBausch
Posts: 9
Joined: 11 Sep 2013, 14:05

Re: rehabbing a flash drive

#5 Post by JoeBausch »

I might have quit the program as I was not sure about which step to take next. But I can't quite remember. I'm trying to recover files from it now, so when that is done I'll rerun TestDisk as root. Then post the log file again. :)

JoeBausch
Posts: 9
Joined: 11 Sep 2013, 14:05

Re: rehabbing a flash drive

#6 Post by JoeBausch »

Ok, I've started running TestDisk again with sudo. Note, early on the output says this drive can't be written to, but I continued on. Here is what the log file says up to this point of the run (which I haven't completed yet as I don't want to misstep!):


Thu Sep 12 10:57:52 2013
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 8.11.0 (Darwin Kernel Version 8.11.0: Wed Oct 10 18:26:00 PDT 2007; root:xnu-792.24
Compiler: GCC 4.0
Compilation date: 2013-07-30T14:08:32
ext2fs lib: 1.41.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: none
Hard disk list
Disk /dev/disk0 - 300 GB / 279 GiB - 586072368 sectors (RO), sector size=512
Disk /dev/disk1 - 320 GB / 298 GiB - 625142448 sectors (RO), sector size=512
Disk /dev/disk2 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/disk3 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/disk5 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/disk6 - 8086 MB / 7711 MiB - 15794175 sectors (RO), sector size=512
Disk /dev/rdisk0 - 300 GB / 279 GiB - 586072368 sectors (RO), sector size=512
Disk /dev/rdisk1 - 320 GB / 298 GiB - 625142448 sectors (RO), sector size=512
Disk /dev/rdisk2 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/rdisk3 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/rdisk4 - 499 GB / 465 GiB - 976509120 sectors, sector size=512
Disk /dev/rdisk5 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/rdisk6 - 8086 MB / 7711 MiB - 15794175 sectors (RO), sector size=512

Partition table type (auto): Humax
Media is opened in read-only.
Disk /dev/disk6 - 8086 MB / 7711 MiB (RO)
Partition table type: Intel

Analyse Disk /dev/disk6 - 8086 MB / 7711 MiB - 15794175 sectors (RO)
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=63 1
FAT32 at 63/0/1
Info: size boot_sector 15794112, partition 15794112
FAT1 : 32-3886
FAT2 : 3887-7741
start_rootdir : 7742 root cluster : 2
Data : 7742-15794109
sectors : 15794112
cluster_size : 32
no_of_cluster : 493324 (2 - 493325)
fat_length 3855 calculated 3855
FAT differs, FAT sectors=624-640/3855
heads/cylinder 249 (FAT) != 1 (HD)
sect/track 62 (FAT) != 1 (HD)
set_FAT_info: name from BS used
get_geometry_from_list_part_aux head=1 nbr=2
Current partition structure:
Warning: number of heads/cylinder mismatches 249 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 62 (FAT) != 1 (HD)
1 * FAT32 63 15794174 15794112 [JWB_THUMB]

Warning: Bad ending sector (CHS and LBA don't match)


Ok, me again. Now I'm sitting at this point with the following on the screen and I'm not sure what to do next!

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/disk6 - 8086 MB / 7711 MiB - 15794175 sectors (RO)
Partition Start End Size in sectors
>* FAT32 LBA 63 15794174 15794112 [JWB_THUMB]


Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
FAT32, blocksize=16384, 8086 MB / 7711 MiB

JoeBausch
Posts: 9
Joined: 11 Sep 2013, 14:05

Re: rehabbing a flash drive

#7 Post by JoeBausch »

I'm going to re-start the PhotoRec to get the hopefully almost 7 GB of files over the weekend, then try to fix this drive from advice on this site on Monday!

When I fire up TestDisk and choose the first place the flash drive shows in the list below (/dev/disk6):

Hard disk list
Disk /dev/disk0 - 300 GB / 279 GiB - 586072368 sectors (RO), sector size=512
Disk /dev/disk1 - 320 GB / 298 GiB - 625142448 sectors (RO), sector size=512
Disk /dev/disk2 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/disk3 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/disk5 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/disk6 - 8086 MB / 7711 MiB - 15794175 sectors, sector size=512
Disk /dev/rdisk0 - 300 GB / 279 GiB - 586072368 sectors (RO), sector size=512
Disk /dev/rdisk1 - 320 GB / 298 GiB - 625142448 sectors (RO), sector size=512
Disk /dev/rdisk2 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/rdisk3 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/rdisk4 - 499 GB / 465 GiB - 976509120 sectors, sector size=512
Disk /dev/rdisk5 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/rdisk6 - 8086 MB / 7711 MiB - 15794175 sectors, sector size=512

The program says something about not being able to write stuff. But if I instead select the "risk6" above (last entry), I don't get that message. I continue along and choose the Intel type (not the recommended HUMAX). I then do an analyze and deeper search but I don't know what I should no next. Help!

The log file up to this point is pasted below:

Fri Sep 13 13:43:06 2013
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Darwin, kernel 8.11.0 (Darwin Kernel Version 8.11.0: Wed Oct 10 18:26:00 PDT 2007; root:xnu-792.24
Compiler: GCC 4.0
Compilation date: 2013-07-30T14:08:32
ext2fs lib: 1.41.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: none
Hard disk list
Disk /dev/disk0 - 300 GB / 279 GiB - 586072368 sectors (RO), sector size=512
Disk /dev/disk1 - 320 GB / 298 GiB - 625142448 sectors (RO), sector size=512
Disk /dev/disk2 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/disk3 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/disk5 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/disk6 - 8086 MB / 7711 MiB - 15794175 sectors, sector size=512
Disk /dev/rdisk0 - 300 GB / 279 GiB - 586072368 sectors (RO), sector size=512
Disk /dev/rdisk1 - 320 GB / 298 GiB - 625142448 sectors (RO), sector size=512
Disk /dev/rdisk2 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/rdisk3 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/rdisk4 - 499 GB / 465 GiB - 976509120 sectors, sector size=512
Disk /dev/rdisk5 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/rdisk6 - 8086 MB / 7711 MiB - 15794175 sectors, sector size=512

Partition table type (auto): Humax
Disk /dev/rdisk6 - 8086 MB / 7711 MiB
Partition table type: Intel

Analyse Disk /dev/rdisk6 - 8086 MB / 7711 MiB - 15794175 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=63 1
FAT32 at 63/0/1
Info: size boot_sector 15794112, partition 15794112
FAT1 : 32-3886
FAT2 : 3887-7741
start_rootdir : 7742 root cluster : 2
Data : 7742-15794109
sectors : 15794112
cluster_size : 32
no_of_cluster : 493324 (2 - 493325)
fat_length 3855 calculated 3855
FAT differs, FAT sectors=624-640/3855
heads/cylinder 249 (FAT) != 1 (HD)
sect/track 62 (FAT) != 1 (HD)
set_FAT_info: name from BS used
get_geometry_from_list_part_aux head=1 nbr=2
Current partition structure:
Warning: number of heads/cylinder mismatches 249 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 62 (FAT) != 1 (HD)
1 * FAT32 63 15794174 15794112 [JWB_THUMB]

Warning: Bad ending sector (CHS and LBA don't match)

search_part()
Disk /dev/rdisk6 - 8086 MB / 7711 MiB - 15794175 sectors
FAT32 at 63/0/1
FAT1 : 32-3886
FAT2 : 3887-7741
start_rootdir : 7742 root cluster : 2
Data : 7742-15794109
sectors : 15794112
cluster_size : 32
no_of_cluster : 493324 (2 - 493325)
fat_length 3855 calculated 3855
FAT differs, FAT sectors=624-640/3855
heads/cylinder 249 (FAT) != 1 (HD)
sect/track 62 (FAT) != 1 (HD)
set_FAT_info: name from BS used

FAT32 at 63/0/1
FAT32 LBA 63 15794174 15794112 [JWB_THUMB]
FAT32, blocksize=16384, 8086 MB / 7711 MiB
get_geometry_from_list_part_aux head=1 nbr=2

Results
* FAT32 LBA 63 15794174 15794112 [JWB_THUMB]
FAT32, blocksize=16384, 8086 MB / 7711 MiB

interface_write()
1 * FAT32 LBA 63 15794174 15794112 [JWB_THUMB]

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: rehabbing a flash drive

#8 Post by cgrenier »

The FAT table is damaged. Run TestDisk, Intel, select the partition, Advanced, Boot.
The boot sector need to match its backup. If it's the case, you will see Repair FAT, try it.
Does it solve your problem ?

JoeBausch
Posts: 9
Joined: 11 Sep 2013, 14:05

Re: rehabbing a flash drive

#9 Post by JoeBausch »

Christophe, thanks for trying to help this user that clearly has little understanding of how these things work. I just reran TestDisk and choose Intel but I'm confused about this 'select the partition'. What I got was to a selection of "Quick Search" and "Backup" and I choose QuickSearch. But this started to work with some errors message and the testlog file started to grow enormously with sort of the same error message. So I control c'ed the process and started again and am at the same "QuickSearch" and "Backup" choice. Here are the contents of the log file:


OS: Darwin, kernel 8.11.0 (Darwin Kernel Version 8.11.0: Wed Oct 10 18:26:00 PDT 2007; root:xnu-792.24
Compiler: GCC 4.0
Compilation date: 2013-07-30T14:08:32
ext2fs lib: 1.41.8, ntfs lib: libntfs-3g, reiserfs lib: 0.3.1-rc8, ewf lib: none
Hard disk list
Disk /dev/disk0 - 300 GB / 279 GiB - 586072368 sectors (RO), sector size=512
Disk /dev/disk1 - 320 GB / 298 GiB - 625142448 sectors (RO), sector size=512
Disk /dev/disk2 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/disk3 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/disk5 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/disk7 - 8086 MB / 7711 MiB - 15794175 sectors, sector size=512
Disk /dev/rdisk0 - 300 GB / 279 GiB - 586072368 sectors (RO), sector size=512
Disk /dev/rdisk1 - 320 GB / 298 GiB - 625142448 sectors (RO), sector size=512
Disk /dev/rdisk2 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/rdisk3 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/rdisk4 - 499 GB / 465 GiB - 976509120 sectors, sector size=512
Disk /dev/rdisk5 - 500 GB / 465 GiB - 976773168 sectors (RO), sector size=512
Disk /dev/rdisk7 - 8086 MB / 7711 MiB - 15794175 sectors, sector size=512

Partition table type (auto): Humax
Disk /dev/rdisk7 - 8086 MB / 7711 MiB
Partition table type: Intel

Analyse Disk /dev/rdisk7 - 8086 MB / 7711 MiB - 15794175 sectors
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=63 1
FAT32 at 63/0/1
Info: size boot_sector 15794112, partition 15794112
FAT1 : 32-3886
FAT2 : 3887-7741
start_rootdir : 7742 root cluster : 2
Data : 7742-15794109
sectors : 15794112
cluster_size : 32
no_of_cluster : 493324 (2 - 493325)
fat_length 3855 calculated 3855
FAT differs, FAT sectors=624-640/3855
heads/cylinder 249 (FAT) != 1 (HD)
sect/track 62 (FAT) != 1 (HD)
set_FAT_info: name from BS used
get_geometry_from_list_part_aux head=1 nbr=2
Current partition structure:
Warning: number of heads/cylinder mismatches 249 (FAT) != 1 (HD)
Warning: number of sectors per track mismatches 62 (FAT) != 1 (HD)
1 * FAT32 63 15794174 15794112 [JWB_THUMB]

Warning: Bad ending sector (CHS and LBA don't match)



Do I still choose QuickSearch?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: rehabbing a flash drive

#10 Post by cgrenier »

The FAT table is damaged. Run TestDisk, Intel, Advanced, select the partition, Boot. (The previous order was wrong)
The boot sector need to match its backup. If it's the case, you will see Repair FAT, try it.
Does it solve your problem ?

Locked