cgsecurity.org

TestDisk & PhotoRec forum
https://forum.cgsecurity.org/phpBB3/

USB flash drive looks RAW

https://forum.cgsecurity.org/phpBB3/viewtopic.php?t=2223

Page 1 of 1

USB flash drive looks RAW

Posted: 10 Apr 2013, 20:27
by LightspeedStillness
Hello,
I need some help with a problem I have been trying to solve for a couple of days without success.
I have a 4GB flash drive which is not accessible anymore since it looks unformatted (RAW).
Everytime I try to open it I get the "Disk is not formatted - Do you want to format it?" message.
My OS is Windows XP SP3.
Several years have been passed since I formatted it and I can't even recall if it was FAT or NTFS (but I think FAT probably).
In the Windows Disk Manager the drive is there but no filesystem detected.
I tried TestDisk without success but I am no expert and maybe it could work if properly set.
Is there a way to recover the data inside the drive or are they lost?
Any help will be appreciated.
Thank You.

Re: USB flash drive looks RAW

Posted: 11 Apr 2013, 06:29
by Fiona
Would it be possible to upload a screen from TestDisk / Analyse to judge your current partition table?
Alternatively, you can copy and paste the content of your testdisk.log.
You'll find it in your testdisk folder.
This information helps to determine a boot sector diagnose.
Info will follow.

Fiona

Re: USB flash drive looks RAW

Posted: 11 Apr 2013, 19:35
by LightspeedStillness
Hi Fiona and thanks for replying.
I hope this is what you asked for, anyway here it is (quick + deep analysis):
Drive H: - 3998 MB / 3813 MiB - CHS 7809856 1 1, sector size=512

Partition table type (auto): Intel
Drive H: - 3998 MB / 3813 MiB
Partition table type: Intel

Analyse Drive H: - 3998 MB / 3813 MiB - CHS 7809856 1 1
Current partition structure:

Partition sector doesn't have the endmark 0xAA55
Ask the user for vista mode
Allow partial last cylinder : No
search_vista_part: 0

search_part()
Drive H: - 3998 MB / 3813 MiB - CHS 7809856 1 1
BAD_RS LBA=48582282 997
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 48582282 194565873 145983592
This partition ends after the disk limits. (start=48582282, size=145983592, end=194565873, disk end=7809856)
BAD_RS LBA=2624028647 975
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
FAT16 <32M 2624028647 3541437553 917408907
This partition ends after the disk limits. (start=2624028647, size=917408907, end=3541437553, disk end=7809856)
BAD_RS LBA=1323300785 432
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0B
FAT32 1323300785 3052228983 1728928199
This partition ends after the disk limits. (start=1323300785, size=1728928199, end=3052228983, disk end=7809856)
BAD_RS LBA=1641673248 237
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
FAT32 LBA 1641673248 3607330813 1965657566
This partition ends after the disk limits. (start=1641673248, size=1965657566, end=3607330813, disk end=7809856)
BAD_RS LBA=3122086662 1057
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0B
FAT32 3122086662 4669507813 1547421152
This partition ends after the disk limits. (start=3122086662, size=1547421152, end=374540517, disk end=7809856)
BAD_RS LBA=3315842482 632
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 3315842482 6526464449 3210621968
This partition ends after the disk limits. (start=3315842482, size=3210621968, end=2231497153, disk end=7809856)
BAD_RS LBA=1367092518 941
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0B
FAT32 1367092518 5318800771 3951708254
This partition ends after the disk limits. (start=1367092518, size=3951708254, end=1023833475, disk end=7809856)
BAD_RS LBA=3931007910 83
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0B
FAT32 3931007910 8180649928 4249642019
This partition ends after the disk limits. (start=3931007910, size=4249642019, end=3885682632, disk end=7809856)
file_win32_pread(328,11,buffer,7809846(7809846/0/1)) read err: read after end of file
file_win32_pread(328,6,buffer,7809852(7809852/0/1)) read err: read after end of file
file_win32_pread(328,11,buffer,7809848(7809848/0/1)) read err: read after end of file
file_win32_pread(328,8,buffer,7809852(7809852/0/1)) read err: read after end of file
file_win32_pread(328,11,buffer,7809851(7809851/0/1)) read err: read after end of file
file_win32_pread(328,8,buffer,7809849(7809849/0/1)) read err: read after end of file
file_win32_pread(328,3,buffer,7809855(7809855/0/1)) read err: read after end of file
file_win32_pread(328,8,buffer,7809853(7809853/0/1)) read err: read after end of file
file_win32_pread(328,8,buffer,7809849(7809849/0/1)) read err: read after end of file
file_win32_pread(328,3,buffer,7809855(7809855/0/1)) read err: read after end of file
file_win32_pread(328,8,buffer,7809851(7809851/0/1)) read err: read after end of file
file_win32_pread(328,5,buffer,7809855(7809855/0/1)) read err: read after end of file
file_win32_pread(328,8,buffer,7809854(7809854/0/1)) read err: read after end of file
file_win32_pread(328,8,buffer,7809855(7809855/0/1)) read err: read after end of file
file_win32_pread(328,8,buffer,7809851(7809851/0/1)) read err: read after end of file
file_win32_pread(328,8,buffer,7809854(7809854/0/1)) read err: read after end of file
Drive H: - 3998 MB / 3813 MiB - CHS 7809856 1 1
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (3998 MB / 3813 MiB) seems too small! (< 4188 GB / 3900 GiB)
The following partitions can't be recovered:
FAT12 48582282 194565873 145983592
FAT32 1323300785 3052228983 1728928199
FAT32 1367092518 5318800771 3951708254
FAT32 LBA 1641673248 3607330813 1965657566
FAT16 <32M 2624028647 3541437553 917408907
FAT32 3122086662 4669507813 1547421152
FAT12 3315842482 6526464449 3210621968
FAT32 3931007910 8180649928 4249642019

Results

interface_write()

No partition found or selected for recovery

search_part()
Drive H: - 3998 MB / 3813 MiB - CHS 7809856 1 1
BAD_RS LBA=48582282 997
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 48582282 194565873 145983592
This partition ends after the disk limits. (start=48582282, size=145983592, end=194565873, disk end=7809856)
BAD_RS LBA=2624028647 975
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 04
FAT16 <32M 2624028647 3541437553 917408907
This partition ends after the disk limits. (start=2624028647, size=917408907, end=3541437553, disk end=7809856)
BAD_RS LBA=1323300785 432
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0B
FAT32 1323300785 3052228983 1728928199
This partition ends after the disk limits. (start=1323300785, size=1728928199, end=3052228983, disk end=7809856)
BAD_RS LBA=1641673248 237
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
FAT32 LBA 1641673248 3607330813 1965657566
This partition ends after the disk limits. (start=1641673248, size=1965657566, end=3607330813, disk end=7809856)
BAD_RS LBA=3122086662 1057
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0B
FAT32 3122086662 4669507813 1547421152
This partition ends after the disk limits. (start=3122086662, size=1547421152, end=374540517, disk end=7809856)
BAD_RS LBA=3315842482 632
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 3315842482 6526464449 3210621968
This partition ends after the disk limits. (start=3315842482, size=3210621968, end=2231497153, disk end=7809856)
BAD_RS LBA=1367092518 941
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0B
FAT32 1367092518 5318800771 3951708254
This partition ends after the disk limits. (start=1367092518, size=3951708254, end=1023833475, disk end=7809856)
BAD_RS LBA=3931007910 83
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0B
FAT32 3931007910 8180649928 4249642019
This partition ends after the disk limits. (start=3931007910, size=4249642019, end=3885682632, disk end=7809856)
file_win32_pread(328,11,buffer,7809851(7809851/0/1)) read err: read after end of file
file_win32_pread(328,8,buffer,7809850(7809850/0/1)) read err: read after end of file
file_win32_pread(328,8,buffer,7809854(7809854/0/1)) read err: read after end of file
file_win32_pread(328,8,buffer,7809849(7809849/0/1)) read err: read after end of file
file_win32_pread(328,3,buffer,7809855(7809855/0/1)) read err: read after end of file
file_win32_pread(328,8,buffer,7809851(7809851/0/1)) read err: read after end of file
file_win32_pread(328,5,buffer,7809855(7809855/0/1)) read err: read after end of file
file_win32_pread(328,8,buffer,7809853(7809853/0/1)) read err: read after end of file
file_win32_pread(328,7,buffer,7809855(7809855/0/1)) read err: read after end of file
file_win32_pread(328,6,buffer,7809853(7809853/0/1)) read err: read after end of file
Drive H: - 3998 MB / 3813 MiB - CHS 7809856 1 1
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (3998 MB / 3813 MiB) seems too small! (< 4188 GB / 3900 GiB)
The following partitions can't be recovered:
FAT12 48582282 194565873 145983592
FAT32 1323300785 3052228983 1728928199
FAT32 1367092518 5318800771 3951708254
FAT32 LBA 1641673248 3607330813 1965657566
FAT16 <32M 2624028647 3541437553 917408907
FAT32 3122086662 4669507813 1547421152
FAT12 3315842482 6526464449 3210621968
FAT32 3931007910 8180649928 4249642019

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
Store new MBR code
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

Re: USB flash drive looks RAW

Posted: 12 Apr 2013, 09:42
by Fiona
In TestDisk, if the Disk selection appears, would it be possible to select your USB thumb instead of your drive?
Disk and Drive is different!

Please let me know.

Fiona

Re: USB flash drive looks RAW

Posted: 12 Apr 2013, 18:09
by LightspeedStillness
I am not sure I understood your question.
This is what I see in TestDisk:
Disk /dev/sda - 500 GB / 465 GiB
Disk /dev/sdb - 4003 MB / 3817 MiB
Drive H: - 3998 MB / 3813 MiB
The first entry is my HDD, the second one is the physical USB flash drive.
The third entry (Drive H) is an encrypted partition within the flash drive. The data should be in this partition but for some reason the partition looks gone and the system keeps asking me if I want to format the drive (H) since it is seen as unformatted.

Re: USB flash drive looks RAW

Posted: 12 Apr 2013, 20:12
by Fiona
Sry I didn't know that you have an encrypted drive.
What kind of software did you use?
Please note, as long as your drive is encrypted, either TestDisk nor windows will recognize it as a valid file system.
Has it been possible to decrypt your drive?
If you used TrueCrypt, simpson 474 might be able to help?

Fiona

Re: USB flash drive looks RAW

Posted: 12 Apr 2013, 20:32
by LightspeedStillness
My fault.
I didn't mention it since once the device is mounted it looks (better, looked) like a normal (unencrypted) drive so I thought it was irrelevant.
Fiona wrote:Please note, as long as your drive is encrypted, either TestDisk nor windows will recognize it as a valid file system.
That's exactly why I used TestDisk on H: drive and not on the physical USB drive. Once mounted, H: should be perfectly detectable as a FAT partition (as far as I understand).
I used TrueCrypt.
simpson 474? What (or who) is it?

Re: USB flash drive looks RAW

Posted: 17 Apr 2013, 18:04
by LightspeedStillness
Still waiting here.
All times are UTC+01:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited