Après une manip inconnue la clé usb d'un ami est devenue illisible, windows7 demande de formater. Si je le crois il ne l'a pas fait, et en effet sa clé ne se montait plus ni sous xp ni sous linux.
J'ai essayé plein de récupérations, mais comme nombre de fichiers n'étaient pas retrouvés avec photorec j'ai essayé avec testdisk. Comme j'avais un warning sur le nombre de têtes j'ai essayé 255, mais alors j'ai eu d'autres erreurs.
Toujours est-il que j'ai fini par faire un write, mais je ne sais plus si j'avais fait une copie avant ou après et si mes copies sont exploitables (là j'ai honte, ça m'apprendra, mais je n'ai pas trouvé facilement comment faire un backup avec photorec/testdisk)
Code: Select all
sudo dd if=/dev/sdh of=verbatim_sansoptions.dd
sudo dd if=/dev/sdh of=verbatim_bs512_conv_noerror,sync.dd bs=512 conv=noerror,sync
Code: Select all
# Rescue Logfile. Created by GNU ddrescue version 1.14
# Command line: ddrescue /dev/sdh ./verbatim.ddrescue ddrescue.log
# current_pos current_status
0x1DE2F0000 +
# pos size status
0x00000000 0x1DE300000 +

Je vous livre le début et la fin, c'est une une clé 8Go Verbatim
Code: Select all
dmesg
...
[948894.577354] sd 28:0:0:0: [sdh] 15669248 512-byte logical blocks: (8.02 GB/7.47 GiB)
...
Code: Select all
Sat Apr 5 22:34:04 2014
Command line: TestDisk
TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.2.0-60-lowlatency (#62-Ubuntu SMP PREEMPT Tue Feb 25 00:11:53 UTC 2014) x86_64
Compiler: GCC 4.6
Compilation date: 2012-02-05T07:15:52
ext2fs lib: 1.42, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
.....
/dev/sdc: dco 312581808 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
...
Disk /dev/sdh - 8022 MB / 7651 MiB - CHS 1023 247 62, sector size=512 - Verbatim STORE N GO, FW:1100
Partition table type (auto): Intel
Disk /dev/sdh - 8022 MB / 7651 MiB - Verbatim STORE N GO
Partition table type: Intel
Analyse Disk /dev/sdh - 8022 MB / 7651 MiB - CHS 1023 247 62
Current partition structure:
No partition is bootable
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdh - 8028 MB / 7657 MiB - CHS 1024 247 62
Allow partial last cylinder : Yes
search_vista_part: 1
search_part()
Disk /dev/sdh - 8028 MB / 7657 MiB - CHS 1024 247 62
FAT32 at 0/0/33
FAT1 : 38-15310
FAT2 : 15311-30583
start_rootdir : 30584 root cluster : 2
Data : 30584-15669215
sectors : 15669216
cluster_size : 8
no_of_cluster : 1954829 (2 - 1954830)
fat_length 15273 calculated 15273
FAT differs, FAT sectors=16-32/15273
heads/cylinder 255 (FAT) != 247 (HD)
sect/track 63 (FAT) != 62 (HD)
set_FAT_info: name from BS used
FAT32 at 0/0/33
FAT32 0 0 33 1023 48 50 15669216 [NO NAME]
FAT32, 8022 MB / 7650 MiB
Warning: the current number of heads per cylinder is 247 but the correct value may be 255.
Results
* FAT32 0 0 33 1023 246 62 15681504 [NO NAME]
FAT32, 8028 MB / 7656 MiB
interface_write()
1 * FAT32 0 0 33 1023 246 62 15681504 [NO NAME]
search_part()
Disk /dev/sdh - 8028 MB / 7657 MiB - CHS 1024 247 62
FAT32 at 0/0/33
FAT1 : 38-15310
FAT2 : 15311-30583
start_rootdir : 30584 root cluster : 2
Data : 30584-15669215
sectors : 15669216
cluster_size : 8
no_of_cluster : 1954829 (2 - 1954830)
fat_length 15273 calculated 15273
FAT differs, FAT sectors=16-32/15273
heads/cylinder 255 (FAT) != 247 (HD)
sect/track 63 (FAT) != 62 (HD)
set_FAT_info: name from BS used
FAT32 at 0/0/33
FAT32 0 0 33 1023 48 50 15669216 [NO NAME]
FAT32, 8022 MB / 7650 MiB
Search for partition aborted
Warning: the current number of heads per cylinder is 247 but the correct value may be 255.
Results
* FAT32 0 0 33 1023 246 62 15681504 [NO NAME]
FAT32, 8028 MB / 7656 MiB
interface_write()
1 * FAT32 0 0 33 1023 246 62 15681504 [NO NAME]
simulate write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
TestDisk exited normally.
Y'à un truc qui semble louche, mais c'est peut-être normal? Il y a du code entre 0x0 et 0x1BD ... un virus?
La partition devrait être type 0c (FAT32-lba) en 0x1C2, elle était vue *FAT32 dans le quicksearch
Code: Select all
>* FAT32 0 0 33 1023 246 62 15681504 [NO NAME]
Code: Select all
sudo dd if=/dev/sdi count=16500000 | hexdump -C > ../hexdump.bin (elle a changé de lettre entre temps)
less ../hexdump.bin
00000000 fc 31 c0 8e d0 31 e4 8e d8 8e c0 be 00 7c bf 00 |.1...1.......|..|
00000010 06 b9 00 01 f3 a5 be ee 07 b0 08 ea 20 06 00 00 |............ ...|
00000020 80 3e b3 07 ff 75 04 88 16 b3 07 80 3c 00 74 04 |.>...u......<.t.|
00000030 08 06 af 07 83 ee 10 d0 e8 73 f0 90 90 90 90 90 |.........s......|
00000040 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 |................|
*
00000070 90 90 90 90 90 90 90 90 90 90 90 90 90 90 be be |................|
00000080 07 b0 00 b9 04 00 80 3c 00 75 6e fe c0 83 c6 10 |.......<.un.....|
00000090 e2 f4 31 db b4 0e be 9d 07 8a 0e af 07 ac d0 e9 |..1.............|
000000a0 73 02 cd 10 08 c9 75 f5 b0 3a cd 10 31 c0 cd 16 |s.....u..:..1...|
000000b0 3c 00 74 f8 be 8b 07 b9 02 00 e8 ba 00 3c 0d 74 |<.t..........<.t|
000000c0 b4 3c 61 72 06 3c 7a 77 02 2c 20 88 c3 be 9d 07 |.<ar.<zw., .....|
000000d0 8a 0e af 07 ac d0 e9 73 04 38 c3 74 06 08 c9 75 |.......s.8.t...u|
000000e0 f3 eb af b8 0d 0e 31 db cd 10 8d 84 62 00 3c 07 |......1.....b.<.|
000000f0 75 07 b0 1f a2 af 07 eb 99 31 d2 b9 01 00 3c 04 |u........1....<.|
00000100 74 11 73 f3 30 e4 b1 04 d2 e0 be be 07 01 c6 8a |t.s.0...........|
00000110 16 b3 07 bf 05 00 56 f6 c2 80 74 31 b4 41 bb aa |......V...t1.A..|
00000120 55 52 cd 13 5a 5e 56 72 1e 81 fb 55 aa 75 18 f6 |UR..Z^Vr...U.u..|
00000130 c1 01 74 13 8b 44 08 8b 5c 0a be 8d 07 89 44 08 |..t..D..\.....D.|
00000140 89 5c 0a b4 42 eb 0c 8a 74 01 8b 4c 02 b8 01 02 |.\..B...t..L....|
00000150 bb 00 7c 50 c6 06 8f 07 01 cd 13 58 5e 73 05 4f |..|P.......X^s.O|
00000160 75 b4 eb 93 81 3e fe 7d 55 aa 75 f6 ea 00 7c 00 |u....>.}U.u...|.|
00000170 00 be 83 07 b9 0a 00 50 b4 0e 31 db ac cd 10 e2 |.......P..1.....|
00000180 fb 58 c3 54 65 73 74 44 69 73 6b 0d 0a 10 00 01 |.X.TestDisk.....|
00000190 00 00 7c 00 00 00 00 00 00 00 00 00 00 31 32 33 |..|..........123|
000001a0 34 46 00 00 41 4e 44 54 6d 62 72 00 02 02 02 1f |4F..ANDTmbr.....|
000001b0 c7 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.|
00000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00004000 eb 58 90 4d 53 57 49 4e 34 2e 31 00 02 08 26 00 |.X.MSWIN4.1...&.|
00004010 02 00 00 00 00 f8 00 00 3f 00 ff 00 20 00 00 00 |........?... ...|
00004020 e0 17 ef 00 a9 3b 00 00 00 00 00 00 02 00 00 00 |.....;..........|
00004030 01 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00004040 80 00 29 87 d6 12 00 4e 4f 20 4e 41 4d 45 20 20 |..)....NO NAME |
00004050 20 20 46 41 54 33 32 20 20 20 00 00 00 00 00 00 | FAT32 ......|
00004060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
000041f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.|
00004200 52 52 61 41 00 00 00 00 00 00 00 00 00 00 00 00 |RRaA............|
00004210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
000043e0 00 00 00 00 72 72 41 61 b0 a2 1d 00 2c 00 00 00 |....rrAa....,...|
000043f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.|
00004400 fa 66 0f b6 46 10 66 8b 4e 24 66 f7 e1 66 03 46 |.f..F.f.N$f..f.F|
00004410 1c 66 0f b7 56 0e 66 03 c2 33 c9 66 89 46 fc 66 |.f..V.f..3.f.F.f|
00004420 c7 46 f8 ff ff ff ff fa 66 8b 46 2c 66 83 f8 02 |.F......f.F,f...|
00004430 0f 82 cf fc 66 3d f8 ff ff 0f 0f 83 c5 fc 66 0f |....f=........f.|
....
1d7ffffb0 e6 c7 ff de b8 fd bb 59 3f 1c 8f 3c f6 84 e3 b3 |.......Y?..<....|
1d7ffffc0 79 d8 fe c3 ac 2b 75 56 6c b3 b9 59 7e fc 87 d9 |y....+uVl..Y~...|
1d7ffffd0 3e 7c 3e fc 5d 9b e6 f6 28 2a d0 6c 6f dd fa bb |>|>.]...(*.lo...|
1d7ffffe0 36 8b d5 ba bd de 82 8f 7f 18 cf f1 f0 71 69 e6 |6............qi.|
1d7fffff0 b3 63 19 5e e2 eb 76 fb 60 8a 56 2b c4 b6 c3 a3 |.c.^..v.`.V+....|
1d8000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
1d8002000 f8 ba ad cc a1 7a c5 9a 24 7f 6a c6 80 b4 9c 65 |.....z..$.j....e|
1d8002010 d2 f1 39 66 df 43 ab d6 ff a5 3c bc d8 be 18 d9 |..9f.C....<.....|
1d8002020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
1de300000
(END)