[gentoo-user] flash drive FAT partition disappears
Alan E. Davis
A student handed me a USB flash drive with a video file on it he wanted to offer to me to watch. It mounted automatically, I copied the file, then I took the disk out of the drive and gave it to him. I cannot say with 100% certainty that I unmounted it. The file was completely copied. I am pretty careful, so I think I unmounted it.
Today he came back to me, asking what happened to his disk. He said nothing it there anymore. I checked. Gparted says this drive (4 GB I think) has 2 Terabytes of unallocated space. None of the Windoze gurus (so to speak) around here know what to do.
Any ideas? I'm afraid the little bit of progress I've made over the past 13 years in advocating GNU/Linux and Free Softwrae, will be lost if this problem isn't solved.
Thanks,
Alan
Jesús Guerrero
point, not as an universal truth. I am by no means specialist in this kind
of toys.
On Thu, 19 Nov 2009 02:46:36 +0000, "Alan E. Davis" <lng...@gmail.com>
wrote:
> I can't think of a specific place to look for this, so will try the
> eclectics at gentoo-user.
>
> A student handed me a USB flash drive with a video file on it he wanted
to
> offer to me to watch. It mounted automatically, I copied the file, then
I
> took the disk out of the drive and gave it to him. I cannot say with
100%
> certainty that I unmounted it. The file was completely copied. I am
> pretty
> careful, so I think I unmounted it.
Even if you didn't, in my understanding, all that could cause (normally)
is a broken file system. The effects will usually depends on whatever was
happening at the moment, and at the fs you are using. Some mount options
can influence this as well. To palliate the effects of a catastrophic plug
off without having umounted before you can use the -osync mount option,
which will enable synchronous writes (making your device seems slower,
because writes will no longer be deferred/cached for a later oportunity).
But, that's not a substitute for a true umount, or a sync. It's just a way
to shorten the scope of any possible problem if you accidentelly unplug the
drive without having used umount first.
As a note, FAT is not precisely known for being too solid.
> Today he came back to me, asking what happened to his disk. He said
> nothing
> it there anymore. I checked. Gparted says this drive (4 GB I think)
has 2
> Terabytes of unallocated space. None of the Windoze gurus (so to speak)
> around here know what to do.
>
> Any ideas? I'm afraid the little bit of progress I've made over the
past
> 13 years in advocating GNU/Linux and Free Softwrae, will be lost if this
> problem isn't solved.
Your problem with the size of the drive is a bit more alarming. It could
be a problem in your partition table. In that case, the chance is high that
testdisk can guess a valid partition table and restore the drive to a
working state. However, it could also be a fortuitous electric accident
that fried the unit, that happens sometimes, and it has nothing to do with
you or linux. In any case, and to max the chance to recover anything, the
first thing you should be doing is an image of the device, using dd, just
in case.
All this, assuming that the student didn't already mess up the drive.
Anyway, if s/he truly saved the only copy of anything important in a
pendrive and then sent it around the world, s/he almost deserves any pain
that could derive from that action.
--
Jesús Guerrero
Philip Webb
> A student handed me a USB flash drive with a video file on it
> he wanted to offer to me to watch. It mounted automatically,
> I cannot say with 100% certainty that I unmounted it.
> The file was completely copied.
> I checked. Gparted says this drive (4 GB I think)
> has 2 Terabytes of unallocated space.
A few quick suggestions: (1) you told it 'mv', not 'cp' (I've done that);
(2) he did something with it after he got it back (people do);
(3) he brought back a different USB stick (people mix them up);
(3) why don't you simply reformat the drive as Vfat for him
& copy the video file back onto it ? did it contain other items too ?
-- Surely, nothing you can have done would have deleted a partition !
--
========================,,============================================
SUPPORT ___________//___, Philip Webb
ELECTRIC /] [] [] [] [] []| Cities Centre, University of Toronto
TRANSIT `-O----------O---' purslowatchassdotutorontodotca
Neil Bothwick
> Even if you didn't, in my understanding, all that could cause (normally)
> is a broken file system. The effects will usually depends on whatever
> was happening at the moment, and at the fs you are using.
As he was only reading from the drive, I doubt he could have corrupted
the filesystem, let alone the partition table.
> Some mount
> options can influence this as well. To palliate the effects of a
> catastrophic plug off without having umounted before you can use the
> -osync mount option, which will enable synchronous writes (making your
> device seems slower, because writes will no longer be deferred/cached
> for a later oportunity).
However, these increase writes to the device, particularly to the FAT,
shortening the life of the drive.
I suspect you did nothing wrong and that the problem is either a
coincidental hardware failure or something the owner did to the stick
after you returned it. Convincing the owner of that is another matter.
--
Neil Bothwick
Of all the people I've met you're certainly one of them
Stroller
On 19 Nov 2009, at 03:30, Jesús Guerrero wrote:
> ... In any case, and to max the chance to recover anything, the
> first thing you should be doing is an image of the device, using dd,
> just
> in case.
This.
Then run Photorec on the image.
http://www.cgsecurity.org/wiki/PhotoRec
Stroller.
Marcus Wanner
> I suspect you did nothing wrong and that the problem is either a
> coincidental hardware failure or something the owner did to the stick
> after you returned it. Convincing the owner of that is another matter.
>
table is no longer valid is very interesting, and I would be interested
in seeing the first 512 bytes (I believe that is where the partition
table resides) of the dd image, if you can make one, just to see if it's
corrupt or has been correctly erased. The fact that there is 2 TB left
according to gparted leads me to believe that it is corrupt, which would
mean that it is probably a hardware failure, and nothing to do with
Linux, as someone else said.
Good luck with that student, here's hoping there was nothing important
on that drive when it died!
Marcus
Paul Hartman
On the bright side, if ONLY the partition table was corrupt, maybe
re-creating it with fdisk might make the data accessible again. You
might also try a tool like dfsee which might be able to analyse or
extract some partiton/FAT data from it.