advice request - flashdrive resurrection

[Lee]

I boot TC from a USB flash drive and I seem to have misplaced the MBR.  Is there an easy way to recover that, short of simply re-fdisk-ing the drive and starting from scratch?

The stick has a single FAT32 partition with grub-0.97-splash and Micro Core under /boot and extensions and backup under /tce.  I have a good and recent copy of mydata.tgz but there are a bunch of data files in other subdirectories on the stick ("big home files" and some windows stuff.)

I think it was something to do with using it on Win7 that fouled up the MBR.  I don't suspect a hardware problem (so far) as the stick is new enough to be "young", old enough to be "reliable" and hasn't been physically abused.  I also don't suspect any kind of malware (*) attack, though I haven't authoritatively ruled that out.  Micro Core recognizes the stick as sdd (as it should) but fdisk doesn't see any partitions, says I've got no partition table.

I've got a spare USB flash drive so I've got a functioning system to work with.


* - not counting Windows as "malware" in this context.

[curaga]

Try the testdisk extension, perhaps it can recreate your partition table. In any case, create a backup of the whole drive before any operations (dd the full sdX device to a file).

[Lee]

Thanks.  I'll try that.

Lee

[Rich]

Hi Lee
The fact that there is only one partition on the stick will make this easier. Use fdisk to restore the
partition table, then copy the directories off of the stick, re-install grub and copy the directories back.
As curaga said, backup the drive before doing anything.
Start fdisk and choose  n  and then  p  and then  1
If the original partition occupied the entire stick use the default values for start and size. Tell it to
write the partition table and exit. You should now be able to mount and access the stick. If you did
not partition the entire stick, this link should help.

http://tldp.org/HOWTO/Partition/recovering.html

EDIT: Since it's the only partition on there use the default size and start values and you'll be fine.

[tinypoodle]

I for one would consider it much safer and prone to success to examine the device with testdisk, rather than blindly write to it with fdisk, just throwing my $0.02 in.

[Lee]

There's a nice current article about testdisk here:

http://maketecheasier.com/recover-data-and-partitions-for-free-with-testdisk/2011/05/19/

It didn't turn out to help me  much - looks like the filesystems's pretty well shot.

Hmmm - I thought I had mentioned the latest here yesterday but I must have never posted it.
Testdisk detected the correct size of the device and I was able to rebuild the MBR but the filesystem was not recoverable so far.  I haven't given up on it, still have the backup image file around.

[tinypoodle]

Once you have restored your partition table, did you run 'dosfsck'?

[Lee]

dosfsck - yes, thanks.  It turns out that while that didn't fix the whole mess it did happen to recover the files that weren't backed up elsewhere.  Yay

Having retrieved the data I then put the stick back into service by:

1) whacked the MBR (on purpose this time) using dd
2) fdisk  the stick to a single FAT32 partition
3) mkdosfs the partition to a usable filesystem
4) install TC / MC 3.6 and 3.7rc1
5) set the whole mess up with grub4dos (native) instead of grub-0.97-splash.  I like g4d but that bit where it searches for the boot files can make it tricky if you're booting from a usb stick and the internal HD has an older version of TC on it.  I worked around that by having it search for a marker file that is unique to the stick instead.

Works like a charm.  I'm thinking about one- or two-pass full disk test to verify the media just to rule out any hardwaare related failure on the stick.  I suppose SpinRite would pretty much shoot the lifetime of the flash memory.   

[tinypoodle]

You can use

Code: [Select]

dosfsck -vtr
Of course that would exclude the MBR, you might want to look into 'badblocks' and search how to use it on specifically chosen sectors.