[Q] Oh noes, my USB flash drive died! How to recover?

[gordonselfish]

not that I am an expert but me thinks one might clone the usb stick onto another usb stick
and then attempt recovery from usb number 2

2) There are number of threads on usb sticks and whether or not to format it as journalised or NOT journalised
my personal view is to journalise as I accept usb sticks are cheap to buy.
----when they reach their write limit number....ditch it but

3) for my internal drive, which is journalised as ext4.....I use fsarchiver to "IMAGE" the partition

partimage can not handle (currently) ext4 but can handle ext3
but
fsarchiver is super fast....much faster than partimage....in both writing and restoring images.

so to the OP, if recovery fails I suggest you record the tool you use to format and partition  (eg gparted)
the actual number you input.....whether they change to cylinder boundaries or not
------so you can always reproduce your table

b) make a backup of your MBR assuming you are don't have to  use GPT
I will always use PRIMARY and  never use LVM or extended partitions so

Code: [Select]

sudo dd if=/dev/sdx of=/pathway/mbr-backup bs=512 count=1
will be a backup, if you have more than one drive or usb stick to backup, rename mbr-backup to something more specific
change sdx to sda or sdb etc

c) once you have some data on your usb stick
use a second usb stick or internal drive to "image" the partition and then burn that image to a dvdrw
or send to cloud storage such as dropbox with its MBR

good luck

Of course specific files can be sent to cloud storage if not sensitive

NSA may have broken encryption so don't worry about it
http://www.itnews.com.au/News/355942,nsa-can-break-some-encryption-new-snowden-leak.aspx

[Misalf]

Thanks for the link to the tutorial.
I'm afraid I won't be able to recreate the partition table..
My situation seems to resemble the "sad example".

Though, I learned about PhotoRec (actually was included in the TestDisk package I have installed) which is able to recover any files (including deleted ones) without the drive need to have a valid partition.

Most of my files seem to be corrupted but PhotoRec was not yet able to copy everything because my HDD ran out of space. I will try to copy to a network shared drive where I have more free space.


Since TestDisk found my bad TinyCore partition as two overlapping partitions, could it be a bad idea to manually create a partition using TestDisk based on the start/end values it shows me?
Meaning, start sector from first overlapping partition and end sector from second overlapping partition.


thanks gordonselfish
I will backup my files in some way next time.

[genec]

Test disk is the  only of tool I know which can rewrite the partition structure whilst leaving the contents intact.

fdisk.  that said, I've only used testdisk to find info to type into fdisk.  Also used Ranish Partition Manager (before finding testdisk) as it can test some parameters.

Anyways, my hard rule of data recovery (unless it's trivial) is treat the "damaged" media as read-only (which implies never using Windows) and try to read it only once.  My first action is always ddrescue (GNU ddrescue, that is) to a raw file (typically as `ddrescue -nc 2048 /dev/sda1 sda1.i sda1.log` with a second run as `ddrescue -c 2048 /dev/sda1 sda1.i sda1.log` if any blocks need to be split down to smaller failures).  In your situation, I'd want 2-3 times the capacity of the source drive to recover since I'd keep the first raw copy, then make another copy of the raw that'd be manipulated to attempt recovery.

[coreplayer2]

At this point in the event, I'd say that recovery is very unlikely due to overwriting of any previous good backup structure

Having said that all may not be lost, at least not until you've tried the following

Best to use a spare drive to practice the recovery techniques with.  Deliberately corrupt partition tables, boot records, make partitions unreadable attempting to simulate the current conditions of your drive, then practice their recovery.  when comfortable attempt these techniques on the real drive

Use this guide http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

Looking at the notes above id say there was never any overlapping structures, only found partition structures and backups of same partition structures.

the reported geometry error is only because the software was not able to determine between what is expected and geometry being reported.

For geometry changes use this as a guide
http://www.cgsecurity.org/wiki/Data_Recovery_Examples


If ext2 is your file system then try recovery of the superblock
http://www.cgsecurity.org/wiki/Advanced_Find_ext2_ext3_Backup_SuperBlock

Best to backup what data you can, then
Be sure to  see all your expected partitions before committing the new structure

[Misalf]

Thanks everyone who tryed to help.
Thanks a lot for those links, coreplayer2.
But I think I'm doomed.

I dd'ed my flash drive as a file on a network connected drive, made another copy and tryed to mess with this for hours (replaced the copy after fail attempts). No luck.

So I let PhotoRec try to copy all the files it could find. This time with enough space on the target.
Most files it has recognized as archives are corrupted but lots of .png and .txt files where found which are actually the files I was after (exept for mydata.gz). Well, some config files and scripts have an .java extension so I might have to check every file in a text editor (even corrupted .pngs etc.) which will be an enormous task.

I'll keep my flash drive's dd copy on that hard drive just in case I want to try to improve my recovery skills some time later. (:

[whitesnow]

When the USB died and files got lost, please stop saving more files on it.
Then you can try to use Recuva or PhotoRec for recovering your lost files. The 2 are freeware that has windows version.
You can also try to recover deleted files on windows with the tool I shared. I'm using  it.