Partition table corrupted (USB flash drive)

Question

It's an 8 GB Patriot thumb drive, which I've used extensively with lots of data. Today, it is detected, but all data is gone: (EDIT at least some data is still there, but the partition table is gone)

---

EDIT @Sathya (thanks) here's the relevant output from sudo fdisk -l:

Disk /dev/sdc: 8019 MB, 8019509248 bytes
247 heads, 62 sectors/track, 1022 cylinders
Units = cylinders of 15314 * 512 = 7840768 bytes

Disk /dev/sdc doesn't contain a valid partition table

It looks like it is /dev/sdc, with that 8 GB... and no partition table.

I tried to mount /dev/sdc (and then dmesg | tail):

/media> sudo mount /dev/sdc mytmp
mount: wrong fs type, bad option, bad superblock on /dev/sdc,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

/media> dmesg | tail
[   24.300000]  sdc: unknown partition table
[   24.320000] sd 2:0:0:0: Attached scsi removable disk sdc
[   24.370000] usb-storage: device scan complete
[   26.870000] EXT2-fs error (device sdc): ext2_check_descriptors: Block bitmap for group 1 not in group (block 0)!
[   26.870000] EXT2-fs: group descriptors corrupted!
[   50.420000] unhashed dentry being revalidated: .DCOPserver_eeepc-brendanma__0
[   50.430000] unhashed dentry being revalidated: .DCOPserver_eeepc-brendanma__0
[   50.430000] unhashed dentry being revalidated: .DCOPserver_eeepc-brendanma__0
[ 5565.470000] EXT2-fs error (device sdc): ext2_check_descriptors: Block bitmap for group 1 not in group (block 0)!
[ 5565.470000] EXT2-fs: group descriptors corrupted!

---

EDIT @Col: results from testdisk

Disk /dev/sdc - 8013 MB / 7642 MiB - CHS 1022 247 62
Current partition structure:
     Partition                  Start        End    Size in sectors

Partition sector doesn't have the endmark 0xAA55

After I hit [proceed], it says:

Structure: Ok.


Keys A: add partition, L: load backup, Enter: to continue

The "Structure: Ok." seems reassuring... will "A: add partition" make my old data accessible (if it's still there), or will it make a new, fresh partition?

Another option is "[ MBR Code ] Write TestDisk MBR code to first sector" - would it be better to do this?

---

EDIT I found that at least some of my data is still on the flash drive, by using the below, and searching for English text in less (like " the "):

cat /dev/sde | tr -cd '\11\12\40\1540-\176' | less

(The drive changed from "/dev/sdb" to "/dev/sde" because I connected some extra drives today). I've learnt that "/dev/sde1" would be the first partition; and "/dev/sde" is the whole drive. Because unix treats these devices just like files, you can use all the ordinary unix file commands on them, like cat, and then process them like any other stream of data. The tr above removes non-printable characters ("\40" is space, which I wanted to preserve). In less, you can use "/" to search, similar to Vim.

How can I get my data back (assuming it's still there)? If only the partition table is corrupted, is there a standard "partition recovery tool"? Is there a way to "repartition" without deleting everything?

Answer 1

It may be worth running testdisk over the device, it sounds like your partition table may have gone pop. Testdisk should be able to recover your data.

Answer 2

While it's possible to rebuild the partition table, the first thing you should do it to take an image of the device. You can do this with dd if=/dev/sdb of=~/memstick.img - changing paths as needed.

Once you've done that, run PhotoRec, which should be able to pull out any files that are on there. If you've got everything you need, format the stick and start again, if not, you can try further data recovery.

Answer 3

Don't worry, your data is not gone --- you are right about the disk not being mounted, regardless of what the graphical interface says.

You can mount it by doing (as root) something like:

mount /dev/sdb1 /media/Patriot\ Memory

Where I think that sdb1 refers to your usb stick--it might be sdc1 or sdd1

Answer 4

ddrescue is the tool you need. I don't think you'll be able to salvage the partition table and access the data any other way, based on the output you've posted from testdisk etc.

http://www.forensicswiki.org/wiki/Ddrescue

ddrescue is a data recovery tool. It copies data from one file or block device (hard disc, cdrom, etc) to another, trying hard to rescue data in case of read errors.

The basic operation of ddrescue is fully automatic. That is, you don't have to wait for an error, stop the program, read the log, run it in reverse mode, etc.

If you use the logfile feature of ddrescue, the data is rescued very efficiently, (only the needed blocks are read). Also you can interrupt the rescue at any time and resume it later at the same point.

Ddrescue does not write zeros to the output when it finds bad sectors in the input, and does not truncate the output file if not asked to. So, every time you run it on the same output file, it tries to fill in the gaps without wiping out the data already rescued.

If you have two or more damaged copies of a file, cdrom, etc, and run ddrescue on all of them, one at a time, with the same output file, you will probably obtain a complete and error-free file. This is because the probability of having damaged areas at the same places on different input files is very low. Using the logfile, only the needed blocks are read from the second and successive copies.