wrong geometry on flash disk

[yaser]

<I originally sent this question to the support email and the reply asked me to post it in the forum>

My friend has a flash disk which it is not working because it was removed without using "safely remove" in Windows. When I connected it to my pc (linux), it was not able to detect the partition table. I assumed it was corrupted. I opened Testdisk and chose the first item "Analyse" then it warned me that the number of heads is incorrect and should be 255. I ignored this warning and continued. As I remember, it found two extended and logical partitions. I wrote the discovered partitions to the flash drive and closed test disk and reconnected it, but it was still unable to see any partitions. I opened testdisk again and chose "Geometry" section and changed heads to 255 but Analysing disk was giving errors and warning and no parition was recoverable. I tried to change the geometry several times, but niether seemed to work.
Anytime In analyse section I get this: "Warning: Bad ending cylinder (CHS and LBA don't match)"
this log reflects last geometry I was trying:

Code: Select all

Sat Apr 21 07:13:34 2012
Command line: TestDisk /log /dev/sdb

TestDisk 6.12, Data Recovery Utility, May 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.34.9-69.fc13.i686 (#1 SMP Tue May 3 09:20:30 UTC 2011) i686
Compiler: GCC 4.4
Compilation date: 2011-05-12T19:49:35
ext2fs lib: 1.41.10, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: 20100226
Hard disk list
Disk /dev/sdb - 4009 MB / 3824 MiB - CHS 487 255 63, sector size=512 - hp v125w

Partition table type (auto): Intel
Disk /dev/sdb - 4009 MB / 3824 MiB - hp v125w
Partition table type: Intel

Analyse Disk /dev/sdb - 4009 MB / 3824 MiB - CHS 487 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 0C
Current partition structure:
Invalid FAT boot sector
 1 P FAT32 LBA                0  33 58   488 254 63    7853649
 1 P FAT32 LBA                0  33 58   488 254 63    7853649

Warning: Bad ending cylinder (CHS and LBA don't match)
No partition is bootable
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 4013 MB / 3827 MiB - CHS 488 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 4013 MB / 3827 MiB - CHS 488 255 63
BAD_RS LBA=2136 63
check_part_i386 failed for partition type 0C
     FAT32 LBA                0  33 58   487 141 22    7830424

interface_write()
 1 E extended                 0  33  1   487 254 63    7837641
 5 L FAT32 LBA                0  33 58   487 254 63    7837584

search_part()
Disk /dev/sdb - 4013 MB / 3827 MiB - CHS 488 255 63
BAD_RS LBA=2136 63
check_part_i386 failed for partition type 0C
     FAT32 LBA                0  33 58   487 141 22    7830424

interface_write()
 1 E extended                 0  33  1   487 254 63    7837641
 5 L FAT32 LBA                0  33 58   487 254 63    7837584
simulate write!

TestDisk exited normally.

Any hope to recover data in this case ?

[Fiona]

On Linux, you should execute testdisk as root.

It's true your geometry doesn't look Intel-Standard.
That's why TestDisk has problems to determine the right partition, just as primary or logical and an extended.
Would it be possible to repeat your diagnose and if testdisk lists your partition as green colored, to set it to P for primary only?
It works, when your partition is checked, use the left or right arrow key to set it to P for primary only.
Heve another try to write your partition into your partition table.

[yaser]

Thanks for your advice.

I wrote the partition table. but it's also unmountable.
In dmesg log I can see this statement whenever I plug in the flash:

sdb: p1 size 7837584 exceeds device capacity, limited to end of disk

note: I have messed up the geometry a few times earlier

Code: Select all

Sat Apr 21 15:07:11 2012
Command line: TestDisk /log /dev/sdb

TestDisk 6.12, Data Recovery Utility, May 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.34.9-69.fc13.i686 (#1 SMP Tue May 3 09:20:30 UTC 2011) i686
Compiler: GCC 4.4
Compilation date: 2011-05-12T19:49:35
ext2fs lib: 1.41.10, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: 20100226
Hard disk list
Disk /dev/sdb - 4009 MB / 3824 MiB - CHS 487 255 63, sector size=512 - hp v125w

Partition table type (auto): Intel
Disk /dev/sdb - 4009 MB / 3824 MiB - hp v125w
Partition table type: Intel

Analyse Disk /dev/sdb - 4009 MB / 3824 MiB - CHS 487 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 0C
Current partition structure:
Invalid FAT boot sector
 1 P FAT32 LBA                0  33 58   488 254 63    7853649
 1 P FAT32 LBA                0  33 58   488 254 63    7853649

Warning: Bad ending cylinder (CHS and LBA don't match)
No partition is bootable
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 4013 MB / 3827 MiB - CHS 488 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 4013 MB / 3827 MiB - CHS 488 255 63
BAD_RS LBA=2136 63
check_part_i386 failed for partition type 0C
     FAT32 LBA                0  33 58   487 141 22    7830424

interface_write()
 1 P FAT32 LBA                0  33 58   487 254 63    7837584
write!
No extended partition
You will have to reboot for the change to take effect.

TestDisk exited normally.

[Returntolive]

It´s seems to be a bad config of the partition table by some app under Windows (WinImage and some usblive makers often cause this problems mounting pendrives). Have you tried to use it in Windows and format it?

[Fiona]

After Quick Search that partition ends after disk limit.
Would it be possible to increase your disk 2 cylinder in the menu geometry so that your partition gets as recoverable.
But now, it's not intended to write your partition table, but to use TestDisk to copy data, if avilable or listed.

Repeat your diagnose.
Confirm in TestDisk through until you see Analyse.
Don't confirm at Analyse but Geometry.
Increase the value of your Cylinder from 487 to 489.
Leave the menu geometry with ok.
Confirm at Analyse and Quick Search.
Your FAT32-partition should be listed.
List your files, pressing p.
In case you see an error message, please let me know.
Otherwise have a try to copy your data.
When you list files, at the bottom of the screen you'll find all the commands.
To get into any folder just check it and use your right arror key on your keyboard.
To get a directory up, check that two dots and press enter.

Please copy/backup your files.
Afterwards you should create another new partition which fits on your flash disk.
In case I can write you instructions how to add an Intel-partition manually using TestDisk.

Fiona

[yaser]

I have followed your instructions.
when I pressed P to list files
It reported "No file found, filesystem may be damaged."
Please remember that I have also changed the head number. It was not 255 in its origin state.

Code: Select all

Sat Apr 21 21:33:31 2012
Command line: TestDisk /log /dev/sdb

TestDisk 6.12, Data Recovery Utility, May 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.34.9-69.fc13.i686 (#1 SMP Tue May 3 09:20:30 UTC 2011) i686
Compiler: GCC 4.4
Compilation date: 2011-05-12T19:49:35
ext2fs lib: 1.41.10, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: 20100226
Hard disk list
Disk /dev/sdb - 4009 MB / 3824 MiB - CHS 487 255 63, sector size=512 - hp v125w

Partition table type (auto): Intel
Disk /dev/sdb - 4009 MB / 3824 MiB - hp v125w
Partition table type: Intel
New geometry
Disk /dev/sdb - 4022 MB / 3835 MiB - CHS 489 255 63 sector_size=512

Analyse Disk /dev/sdb - 4022 MB / 3835 MiB - CHS 489 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 0C
Current partition structure:
Invalid FAT boot sector
 1 P FAT32 LBA                0  33 58   487 254 63    7837584
 1 P FAT32 LBA                0  33 58   487 254 63    7837584
No partition is bootable
Ask the user for vista mode
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdb - 4022 MB / 3835 MiB - CHS 489 255 63
BAD_RS LBA=2136 63
check_part_i386 failed for partition type 0C
     FAT32 LBA                0  33 58   487 141 22    7830424

FAT 1x: Can't read root directory.
Directory /

interface_write()
 1 E extended                 0  33  1   487 254 63    7837641
 5 L FAT32 LBA                0  33 58   487 254 63    7837584
simulate write!

TestDisk exited normally.

[yaser]

It´s seems to be a bad config of the partition table by some app under Windows (WinImage and some usblive makers often cause this problems mounting pendrives). Have you tried to use it in Windows and format it?

As I remember, the partition doesn't even appear in My Computer.
Do you think that data can be recovered after formatting the drive in Windows ?

[Fiona]

Formatting easily does the following job.
It overwrites your current file system and makes datarecovery more difficult.
Practically useless.
If you use normal formatting under Win7 / Vista, it will safe erase all data (writung zeros to each sector).
So no data recovery will be possible anymore.
If you quick format you need datarecovery software.
The feature to recover data from a formatted disk is called unformat (like PhotoRec does it).
But you can use datarecovery software without formatting also.
In rare cases, I've seen users where formatted their partition.
Reason has been, corrupted file system and Computer didn't boot or OS hung (disk status has been good).
But in datarecovery, I never suggest to change anything to your data nor file system.
Lots of users made situation worse.
If your computer starts and your OS doesn't hang, then there will be no necessity to format something.

If you already edited and changed something, please use TestDisk and Deper Search.
It's intended to have a try to find your previuos partition?
Do you have any idea about your previous geometry (would be worth another try, to get your previous situation back)?
Normally before someone uses TestDisk to edit something, he should use TestDisk Analyse / Backup, to save the current situation.
But almost nobody uses this marvellous feature!

My suggestion is, Deeper Search or can you remember about your previous situation, to diagnose it?
If it doesn't work, you should use data recovery software.
Information will follow.

Fiona

[yaser]

I've tried Deeper Search and it has the same result.
Unfortunately, I don't remember anything about the previous geometry.
Is there any technique to know the original geometry ?
What if I try to get another flash with the same brand and capacity ?

One more question, Does writing the partition table while using wrong geometry make data unrecoverable ?
Thank you for your efforts to help me.

[Fiona]

You can have a try to scan your flash disk using partition table type none.
It's possible that it scans each sector.
If None finds something, please copy the content and paste it here.
I'll compare the values about Disk and the partition.
If you choose None, your not able to write any partition to the partition table because None hasn't any.
But it would be possible to get the values and add it manually using Intel as partition table.

Fiona