Sandisk 16G thumb drive

How to use TestDisk to recover lost partition
Message
Author
longcaster
Posts: 13
Joined: 01 Mar 2012, 20:50

Re: Sandisk 16G thumb drive

#11 Postby longcaster » 01 Mar 2012, 23:35

Disk /dev/sdb – 16 GB / 14 GiB – CHS 1948 255 63
Partition Start End Size in sectors
P FAT32 0 0 1 1948 111 18 31301631

Sponsored links

User avatar
Fiona
Posts: 2839
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Sandisk 16G thumb drive

#12 Postby Fiona » 02 Mar 2012, 06:57

Please press p to list your data.
Did you see your data or an error message?

longcaster
Posts: 13
Joined: 01 Mar 2012, 20:50

Re: Sandisk 16G thumb drive

#13 Postby longcaster » 02 Mar 2012, 15:55

Let's see if this works, I created a word doc out of a screen shot, since I can't post a jpeg.

Rat's, that doesn't work.

Anyway, I am back to trying to "rebuild a boot sector"

It says no FAT found searching subdirectry

longcaster
Posts: 13
Joined: 01 Mar 2012, 20:50

Re: Sandisk 16G thumb drive

#14 Postby longcaster » 03 Mar 2012, 01:06

How do I rebuild the FAT data?

User avatar
Fiona
Posts: 2839
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Sandisk 16G thumb drive

#15 Postby Fiona » 03 Mar 2012, 08:21

Sry for delay!
Repeat your steps through analyze until you get to the following;

Code: Select all

Disk /dev/sdb – 16 GB / 14 GiB – CHS 1948 255 63
Partition Start End Size in sectors
P FAT32 0 0 1 1948 111 18 31301631

I assume it has been partition table type intel and not None.
None means, no partition table, so it's not possible to write any partition.
Just press enter, highlight Write and press enter and y to confirm.
Now you registererd you partition to the partition table and you should be able to diagnose your thumb drive using rebuild bs.
Please use partition table type intel!

Fiona

longcaster
Posts: 13
Joined: 01 Mar 2012, 20:50

Re: Sandisk 16G thumb drive

#16 Postby longcaster » 06 Mar 2012, 16:33

Fiona wrote:Sry for delay!
Repeat your steps through analyze until you get to the following;

Code: Select all

Disk /dev/sdb – 16 GB / 14 GiB – CHS 1948 255 63
Partition Start End Size in sectors
P FAT32 0 0 1 1948 111 18 31301631

I assume it has been partition table type intel and not None.
None means, no partition table, so it's not possible to write any partition.
Just press enter, highlight Write and press enter and y to confirm.
Now you registererd you partition to the partition table and you should be able to diagnose your thumb drive using rebuild bs.
Please use partition table type intel!

Fiona


I don't understand the "highlight" part of the instructions. I don't know how to highlight something in DOS.

User avatar
Fiona
Posts: 2839
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Sandisk 16G thumb drive

#17 Postby Fiona » 06 Mar 2012, 17:00

If you press enter at this screen;

Code: Select all

Disk /dev/sdb – 16 GB / 14 GiB – CHS 1948 255 63
Partition Start End Size in sectors
P FAT32 0 0 1 1948 111 18 31301631

The next screen appears and at the bootom of the screen you will see;
Quit...Deeper Search...Write.
I meant, highlight or choose Write using your arrow key.

Another easy solution to repeat it, is;

Confirm in testdisk through, until you see;
"Quit...Deeper Search...Write" at the bottom of the screen.
Please, close TestDisk using Quit.
In your testdisk folder, you'll find a file testdisk.log
Can you copy and paste the content here?

longcaster
Posts: 13
Joined: 01 Mar 2012, 20:50

Re: Sandisk 16G thumb drive

#18 Postby longcaster » 07 Mar 2012, 20:49

Is this what you require?




Mon Mar 5 10:58:28 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, January 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP3
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-02-26T19:38:17
ext2fs lib: 1.41.8, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20100226
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=16026435072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=160041885696
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=16026435072
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=155737451520
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=0
Fix disk size using CHS
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
Hard disk list
Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - ST9160314AS, FW:D005DEM1
Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63, sector size=512 - SanDisk Cruzer, FW:8.02

Partition table type default to Intel
Disk /dev/sdb - 16 GB / 14 GiB - SanDisk Cruzer
Partition table type: Intel

Analyse Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63
Current partition structure:
No partition is bootable
Ask the user for vista mode
search_vista_part: 1

search_part()
Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63
file_pread(5,2,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,1,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,7,buffer,31301633(1948/111/21)) lseek err Invalid argument
file_pread(5,8,buffer,31301640(1948/111/28)) lseek err Invalid argument
file_pread(5,3,buffer,31301648(1948/111/36)) lseek err Invalid argument
file_pread(5,3,buffer,31301695(1948/112/20)) lseek err Invalid argument
file_pread(5,8,buffer,31301711(1948/112/36)) lseek err Invalid argument
file_pread(5,11,buffer,31301758(1948/113/20)) lseek err Invalid argument
file_pread(5,2,buffer,31303680(1948/143/52)) lseek err Invalid argument

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63
file_pread(5,2,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,1,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,1,buffer,31301631(1948/111/19)) ReadFile The request could not be performed because of an I/O device error.


Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
A new copy of MBR code has been written.
You have to reboot for the change to take effect.

Analyse Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63
Current partition structure:
No partition is bootable
Ask the user for vista mode
search_vista_part: 1

search_part()
Disk /dev/sdb - 16 GB / 14 GiB - CHS 1948 255 63
file_pread(5,2,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,1,buffer,31301632(1948/111/20)) lseek err Invalid argument
file_pread(5,7,buffer,31301633(1948/111/21)) lseek err Invalid argument
file_pread(5,8,buffer,31301640(1948/111/28)) lseek err Invalid argument
file_pread(5,3,buffer,31301648(1948/111/36)) lseek err Invalid argument
file_pread(5,3,buffer,31301695(1948/112/20)) lseek err Invalid argument
file_pread(5,8,buffer,31301711(1948/112/36)) lseek err Invalid argument
file_pread(5,11,buffer,31301758(1948/113/20)) lseek err Invalid argument
file_pread(5,2,buffer,31303680(1948/143/52)) lseek err Invalid argument

Results

interface_write()

No partition found or selected for recovery

User avatar
Fiona
Posts: 2839
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Sandisk 16G thumb drive

#19 Postby Fiona » 09 Mar 2012, 08:45

Yes, it's exactly what I required.
Ther is no difference.
Partition table type intel didn't find anything.
Also, your thumb drive is available but RAW (unformatted).
To have a check for better results, you could test Deeper Search and partition table type None.
If a partition is found and your data are listed, you could copy them.

But I've seen an error also;
ReadFile The request could not be performed because of an I/O device error.


In case, try PhotoRec to recover your data.
Please scan your complete disk.
http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step

longcaster
Posts: 13
Joined: 01 Mar 2012, 20:50

Re: Sandisk 16G thumb drive

#20 Postby longcaster » 09 Mar 2012, 18:18

Norton 360 has a program called "Sonar" that doesn't like PhotoRec. When I tried to run the program, it would shut me down and get rid of the program.

With persistance, I was able to accept PhotoRec as a program safe to run, here is the log file result;

<?xml version="1.0" encoding="UTF-8" ?>
- <dfxml xmloutputversion="1.0">
- <metadata xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/">
<dc:type>Carve Report</dc:type>
</metadata>
- <creator>
<package>PhotoRec</package>
<version>6.14-WIP</version>
- <build_environment>
<compiler>GCC 4.6, Cygwin 1007.9</compiler>
<compilation_date>2012-03-05T23:17:37</compilation_date>
<library name="libext2fs" version="1.41.8" />
<library name="libewf" version="20100226" />
<library name="libjpeg" version="80" />
<library name="libntfs" version="10:0:0" />
</build_environment>
- <execution_environment>
<os_sysname>Windows</os_sysname>
<os_release>Windows XP SP3</os_release>
<os_version>Windows XP SP3</os_version>
<host>D9F9DCD1</host>
<arch>i686</arch>
<uid>0</uid>
<start_time>2012-03-09T11:55:37-0500</start_time>
</execution_environment>
</creator>
- <source>
<image_filename>/dev/sdb</image_filename>
<sectorsize>512</sectorsize>
<device_model>SanDisk Cruzer</device_model>
<image_size>16026435072</image_size>
- <volume>
- <byte_runs>
<byte_run offset="0" img_offset="0" len="16026435072" />
</byte_runs>
</volume>
</source>
<configuration />
</dfxml>


Return to “Partition Recovery”

Who is online

Users browsing this forum: No registered users and 1 guest