[PANTUGGeneral] Re: [PLUG] FS recovery tools?
JP Vossen
> From: "Greg Lopp" <lo...@pobox.com>
> Subject: [PLUG] FS recovery tools?
>
> A friend had a U3 thumbdrive go "bad" on him. This badness manifested in
> different ways on different flavors of Windows and thinking that it might
> just be some simple partition table or fat corruption, I offered to take a
> look. Knowing that it could also be completely toes up, I made no promises.
>
> When I plug it in, it enumerates as expected, presenting itself as two
> devices, one writable, one not (as a CD ROM)(where it would keep its U3
> autorun and apps). This is followed by a message about an unrecognized
> partition table type.
>
> When I use dd to repeatedly to read the device, I get the same values each
> time.
> Looking at the contents with hexdump, I find a strange, repeating bit
> pattern, all over the place :
> df f2 05 a6 74 c7 55 71 76 b1 2d 3f 59 f0 e1 7f
> This fills spaces that I would suspect are otherwise unwritten to.
> Normally, I would expect FF or 00 in those spaces, but I don't know NAND
> flash like I should. Additionally, I don't know partition table
> formats/offsets like I should.
>
> I've used the end of that bit pattern as an indicator of "interesting
> locations" on the data image and tried to "mount -o loop,offset=${offset}
> backupImage /mnt" at each location. The kernel looks for ext2, vfat and
> iso9660 at each offset, but it never finds a recognizable file system.
>
> "strings backupImage" does not reveal anything that looks like files or
> filenames.
>
> It appears I can still write to the device and read it back.
>
> Can anybody recommend other things to try or recovery packages to play
> with?
I know we had a thread on the PANTUG list that had some good answers for
this, but I can't find it now. It may have been pre-Google archive.
Here is what I've found, can anyone elaborate?
---- cut here ----
>> From: Bill Tomon
>> Sent: Saturday, February 18, 2006 4:28 PM
>> To: pantug...@pantug.org
>> Subject: [PANTUGGeneral] Disk recovery tool
>>
>> [Can anyone] suggest a good free FAT recovery tool?
Troy Sorzano wrote:
> Put drive in another pc as the slave drive .
> PC Inspector File Recovery software [pcinspector.de] (Free)
> http://www.pcinspector.de/file_recovery/UK/welcome.htm
>
> Other programs are:
> file scavenger cheap but not free
> http://www.quetek.com/
> http://www.winhex.com/
________________________________
(JP thread re: XP Undelete)
http://groups.google.com/group/pantug/browse_thread/thread/8fb047f166b342ed
http://www.theabsolute.net/sware/diskinv.html looks really
interesting--kind of like the old Norton Disk Utility.
________________________________
(JP thread re: hard drive recovery service)
http://groups.google.com/group/pantug/browse_thread/thread/7788193bc4b15e10/2aee2de8e682d82f?lnk=gst&q=fat&rnum=3#2aee2de8e682d82f
http://www.grc.com/sr/spinrite.htm
Recover2000.com
http://www.runtime.org/
---- cut here ----
Thanks,
JP
----------------------------|:::======|-------------------------------
JP Vossen, CISSP |:::======| jp{at}jpsdomain{dot}org
My Account, My Opinions |=========| http://www.jpsdomain.org/
----------------------------|=========|-------------------------------
Microsoft has single-handedly nullified Moore's Law.
Innate design flaws of Windows make a personal firewall, anti-virus
and anti-malware software mandatory. The resulting software arms race
has effectively flattened Moore's Law on hardware running Windows.
To unsubscribe from this list, send an e-mail to pantug...@pantug.org with the subject: Unsubscribe
