Re: Salvaging data from USB flash disk

Hi Henrik,

I misunderstood one of your earlier posts (I didn't realize xxd is a
linux/unix tool and went looking for it at that page you pointed me to,
where I couldn't find any kind of a download link). :)
Now I got it.

Henrik Carlqvist wrote:
"OtisUsenet" <otis_usenet@xxxxxxxxx> wrote:
Thanks for all the help and pointers, Henrik. Unfortunately, I am
still unable to mount the copy of the disk. :(

What if you try to look on the image with xxd? Something like:

xxd /tmp/lana-disk | less

Does it seem to contain any data at all?

This is what I see:

$ xxd lana-disk | head
0000000: 5365 6375 7269 7479 4672 6f6d 4d69 6e67 SecurityFromMing
0000010: 92db 7240 8941 770d 92db 7240 8941 770d ..r@.Aw...r@.Aw.
0000020: 2b09 f13d 7861 b1c6 ece6 f4be b5f3 7763 +..=xa........wc
0000030: ece6 f4be b5f3 7763 ece6 f4be b5f3 7763 ......wc......wc
0000040: ece6 f4be b5f3 7763 ece6 f4be b5f3 7763 ......wc......wc
0000050: ece6 f4be b5f3 7763 ece6 f4be b5f3 7763 ......wc......wc
....

$ xxd lana-disk | tail
....
3e2fffa0:ffff ffff ffff ffff ffff ffff ffff ffff ................
3e2fffb0:ffff ffff ffff ffff ffff ffff ffff ffff ................
3e2fffc0:ffff ffff ffff ffff ffff ffff ffff ffff ................
3e2fffd0:ffff ffff ffff ffff ffff ffff ffff ffff ................
3e2fffe0:ffff ffff ffff ffff ffff ffff ffff ffff ................
3e2ffff0:ffff ffff ffff ffff ffff ffff ffff ffff ................

Are you able to recognize any strings? You could try:

strings /tmp/lana-disk

To see if the disk image contains any of your text data.

Here is something:

$ strings lana-disk

SecurityFromMing
Invalid partition table
Error loading operating system
Missing operating system
MSDOS5.0
NO NAME FAT16 3
|8N$}$
|&f;
r9&8-t
at2Nt
NTLDR
Remove disks or other media.
Disk error
Press any key to restart
....

I'm not sure why information about the invalid partition table, etc.
would be _written_ on the disk. I don't understand when that _write_
occurred... but that's not so important now.

But this does look like FAT16 there, right?
In that case, I might be able to mount it with "-t fat16", except that
it looks like I don't have fat16 support compiled into kernel:

# mount -t fat16 -o loop /tmp/lana-disk /mnt/lanadisk
mount: fs type fat16 not supported by kernel

Unfortunately, find /usr/ -name \*fat16\* yielded nothing.

Idea: Knopix must have fat16 support. If I boot with Knopix I could
try mounting my flash disk copy from there, no?

Back to strings /tmp/lana-disk -- the data is there, I see references
to a lot of TIFF, JPEG, and other files, I even see complete chunks of
text, probably from Word files, etc.

Thank you!


I'm not sure what file system type was on the disk. My mount thinks
it's not vfat, and it looks like I don't have fat* support, so I can't
use -t fat32, for example.

Fat12, fat16 and fat32 could all be seen as different versions of fat
where the difference is how big file systems they are able to handle.
Fat12 is still used for floppies, fat16 had to be replaced when harddisks
got bigger than 2GB and fat32 has a file system size limit of 2TB.

Vfat was a backwards compatible extension to fat which made it possible to
have file names that was longer than 8+3. If you mount a fat partition as
vfat you will use that extension, if you mount it as msdos all file names
will be limited to 8+3.

(I'm looking at another, working flash disk now, and it uses vfat, so I
assume the corrupt one also used vfat)

Most flash disks do use vfat unless someone has put another file system on
them.

Is the only way I can get to this data through mounting the disk first?

You could try my suggestions with xxd and strings also.

Could I recover anything with Partition Magic or some such tool? (I'm
wondering if P.M. might still be able to see the flash disk and let me
copy its data onto a new valid partition on, say, a regular HDD)

It seems as if you would need a tool that is able to recreate a partition
table. However, it is probably not much hope for such a tool to succeed.

regards Henrik
--
The address in the header is only to prevent spam. My real address is:
hc8(at)uthyres.com Examples of addresses which go to spammers:
root@xxxxxxxxxxxxx root@localhost

.

Relevant Pages

  • Re: Salvaging data from USB flash disk
    ... What if you try to look on the image with xxd? ... To see if the disk image contains any of your text data. ... Vfat was a backwards compatible extension to fat which made it possible to ... Most flash disks do use vfat unless someone has put another file system on ...
    (comp.os.linux.hardware)
  • Re: my mac formatted USB memory stick in a PC ?
    ... Windows PC that will read my Mac formatted USB memory stick? ... I use FAT16 as a _lingua franca_ ... That's for a 512MB m/s. ... Ah, okay, if you're not into the inscrutabilities of disk formats ...
    (uk.comp.sys.mac)
  • Re: Salvaging data from USB flash disk
    ... The first rows contain executable code on a bootable disk. ... NO NAME FAT16 3 ... I'm not sure why information about the invalid partition table, ... it's not vfat, and it looks like I don't have fat* support, so I ...
    (comp.os.linux.hardware)
  • Re: Question about linux filesystems
    ... disk, since each file takes up at least one block on the disk. ... That was a problem ten years ago with fat16. ... Wasting 2K on the average is nothing like wasting 32K of the ... The claim was that "FAT32 doesn't have that ...
    (comp.os.linux.misc)
  • Re: Question about linux filesystems
    ... On Windows, with the fat32 file system, you loose a lot of space ... on the disk, since each file takes up at least one block on the ... That was a problem ten years ago with fat16. ...
    (comp.os.linux.misc)