LinuxQuestions.org
Go Job Hunting at the LQ Job Marketplace
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices



Reply
 
Search this Thread
Old 01-25-2010, 12:22 AM   #1
zenofronia
Member
 
Registered: Nov 2009
Posts: 33

Rep: Reputation: 0
how to retrieve lost data on a usb stick


My wifes computer, IBM desktop, running XP, was hit by malware. I managed to save the data and tarred it and copied to a USB memory stick using my Linux box Ubu 9.1). I checked and saw it had been truly saved. Two days later I put stick in USB port and it was not recognized (usually any hot plugable device shows up immediately on desktop). I have tried plugging it into a windows machine and nothing was found. We are both very desperate at this apparent loss but because something similar happened with an Iomega zip disk, I still have hope. Let me know what, if any, info I should post that would help solve this problem.

Thank you,

zeno
 
Old 01-25-2010, 01:14 AM   #2
Simon Bridge
Guru
 
Registered: Oct 2003
Location: Waiheke NZ
Distribution: Ubuntu
Posts: 9,211

Rep: Reputation: 197Reputation: 197
before plugging the drive in:

dmesg > before.log

plug the drive in

dmesg > after.log

diff before.log after.log > change.log

cat change.log

copy and paste here with:

lsusb
 
Old 01-25-2010, 10:07 PM   #3
zenofronia
Member
 
Registered: Nov 2009
Posts: 33

Original Poster
Rep: Reputation: 0
Results of following your suggestion

Thanks for responding to my plea for help. The USB stick is 4gb. The files included two tarred files with all of the wifes data.
I did "dmesg" and then plugged in USB stick and got the following when I redid "dmesg":

OS=0x00 PREC=0x00 TTL=64 ID=17494 DF PROTO=TCP SPT=51067 DPT=80 WINDOW=316 RES=0x00 ACK FIN URGP=0 OPT (0101080A0002863CBF03FEF3)
[ 1035.224029] usb 1-1: new high speed USB device using ehci_hcd and address 5
[ 1035.358704] usb 1-1: New USB device found, idVendor=0930, idProduct=6544
[ 1035.358716] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1035.358724] usb 1-1: Product: USB Flash Memory
[ 1035.358729] usb 1-1: Manufacturer:
[ 1035.358735] usb 1-1: SerialNumber: 001D92AD6BA2C930E3CB04E4
[ 1035.358907] usb 1-1: configuration #1 chosen from 1 choice
[ 1035.359984] scsi2 : SCSI emulation for USB Mass Storage devices
[ 1035.360292] usb-storage: device found at 5
[ 1035.360297] usb-storage: waiting for device to settle before scanning
[ 1036.360690] scsi 2:0:0:0: Direct-Access USB Flash Memory 1.00 PQ: 0 ANSI: 2
[ 1036.361030] sd 2:0:0:0: Attached scsi generic sg2 type 0
[ 1036.364667] sd 2:0:0:0: [sdb] 7827392 512-byte logical blocks: (4.00 GB/3.73 GiB)
[ 1036.365514] sd 2:0:0:0: [sdb] Write Protect is off
[ 1036.365534] sd 2:0:0:0: [sdb] Mode Sense: 65 44 09 30
[ 1036.365541] sd 2:0:0:0: [sdb] Assuming drive cache: write through
[ 1036.366210] usb-storage: device scan complete
[ 1036.368071] sd 2:0:0:0: [sdb] Assuming drive cache: write through
[ 1036.368091] sdb: sdb1
[ 1036.370908] sd 2:0:0:0: [sdb] Assuming drive cache: write through
[ 1036.370929] sd 2:0:0:0: [sdb] Attached SCSI removable disk

I was unable to find change.log file quickly so I copied the result of the plugging in of USB stick.

Then I did "lsusb" and got:


Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 004: ID 03f0:2012 Hewlett-Packard OfficeJet Pro K5400
Bus 001 Device 005: ID 0930:6544 Toshiba Corp. Kingston DataTraveler 2.0 Stick (2GB)
Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 002 Device 002: ID 045e:0053 Microsoft Corp. Optical Mouse
Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 003 Device 002: ID 0451:2046 Texas Instruments, Inc. TUSB2046 Hub
Bus 003 Device 003: ID 04b8:0104 Seiko Epson Corp. Perfection 1200
Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 005 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub

What does "lsusb" actually do? And what is the significance of the output? I await further exhortations.

With Thanks,

Geoffrey (zenofronia)


Quote:
Originally Posted by Simon Bridge View Post
before plugging the drive in:

dmesg > before.log

plug the drive in

dmesg > after.log

diff before.log after.log > change.log

cat change.log

copy and paste here with:

lsusb

Last edited by zenofronia; 01-25-2010 at 10:09 PM. Reason: More stuff
 
Old 01-25-2010, 10:42 PM   #4
zenofronia
Member
 
Registered: Nov 2009
Posts: 33

Original Poster
Rep: Reputation: 0
Update following last posting re: USB stick and dmesg

Hello Simon,

I redid the process and this time got a rather different dmesg (tail):


[ 1897.557789] scsi 3:0:0:0: Direct-Access USB Flash Memory 1.00 PQ: 0 ANSI: 2
[ 1897.558094] sd 3:0:0:0: Attached scsi generic sg2 type 0
[ 1897.562690] sd 3:0:0:0: [sdb] 7827392 512-byte logical blocks: (4.00 GB/3.73 GiB)
[ 1897.563294] sd 3:0:0:0: [sdb] Write Protect is off
[ 1897.563310] sd 3:0:0:0: [sdb] Mode Sense: 65 44 09 30
[ 1897.563315] sd 3:0:0:0: [sdb] Assuming drive cache: write through
[ 1897.567109] usb-storage: device scan complete
[ 1897.567721] sd 3:0:0:0: [sdb] Assuming drive cache: write through
[ 1897.567761] sdb: sdb1
[ 1897.572812] sd 3:0:0:0: [sdb] Assuming drive cache: write through
[ 1897.572832] sd 3:0:0:0: [sdb] Attached SCSI removable disk
[ 2016.371530] FAT: invalid media value (0x00)
[ 2016.371544] VFS: Can't find a valid FAT filesystem on dev sdb.
[ 2026.999303] VFS: Can't find ext3 filesystem on dev sdb.
[ 2036.551507] VFS: Can't find an ext2 filesystem on dev sdb.
[ 2047.575713] FAT: invalid media value (0x00)
[ 2047.575725] VFS: Can't find a valid FAT filesystem on dev sdb.
[ 2690.571473] npviewer.bin[2892]: segfault at ff999ed8 ip ff999ed8 sp bfa6063c error 4
[ 2718.833053] npviewer.bin[3445]: segfault at ff999ed8 ip ff999ed8 sp bf868c3c error 4
linux-r1c5:/ #


So here we have segfault reported whereas before, not.
Please decipher. It seems grim. Note: I hadn't formatted the stick before using it and it seemed, previously, to just work fine.

Thanks again,

Geoffrey (zenofronia)
 
Old 01-26-2010, 12:28 AM   #5
Simon Bridge
Guru
 
Registered: Oct 2003
Location: Waiheke NZ
Distribution: Ubuntu
Posts: 9,211

Rep: Reputation: 197Reputation: 197
the usb stick partition is /dev/sdb1
the kernel did not find an ext or fat file system - usb sticks are usually formatted at the factory to fat16 so this suggests that the file system has became corrupt. It is probably possible to recover it.

I'd suggest running magicrescue or testdisk on /dev/sdb
 
1 members found this post helpful.
Old 01-26-2010, 05:50 AM   #6
H_TeXMeX_H
Guru
 
Registered: Oct 2005
Location: $RANDOM
Distribution: slackware64
Posts: 12,928
Blog Entries: 2

Rep: Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269
I would first try to dump an image to a HDD using dd. Then, if that succeeds I would use testdisk or foremost on that image. If it fails, then all hope is lost, sorry (that's why a USB stick is not a backup).
 
1 members found this post helpful.
Old 01-26-2010, 07:38 AM   #7
theYinYeti
Senior Member
 
Registered: Jul 2004
Location: France
Distribution: Arch Linux
Posts: 1,897

Rep: Reputation: 61
Yes. Testdisk is, to my knowledge, the tool to use in such situation.

Yves.
 
1 members found this post helpful.
Old 01-26-2010, 11:52 AM   #8
zenofronia
Member
 
Registered: Nov 2009
Posts: 33

Original Poster
Rep: Reputation: 0
retrieve lost data on a usb stick reply

Quote:
Originally Posted by Simon Bridge View Post
the usb stick partition is /dev/sdb1
the kernel did not find an ext or fat file system - usb sticks are usually formatted at the factory to fat16 so this suggests that the file system has became corrupt. It is probably possible to recover it.

I'd suggest running magicrescue or testdisk on /dev/sdb
>>>

I ran testdisk on /dev/sdb and came up with:


"Analyze" produced:

Disk /dev/sdb - 4007 MB / 3821 MiB - CHS 1018 124 62
Partition Start End Size in sectors


"Deeper.." produced:


The harddisk (4007 MB / 3821 MiB) seems too small! (< 4509 MB / 4301 MiB)
Check the harddisk size: HD jumpers settings, BIOS detection...

The following partitions can't be recovered:
Partition Start End Size in sectors
FAT32 717 1 62 1145 92 52 3296097 [SYSTEM_SAVE]
FAT32 717 2 6 1145 92 58 3296097 [SYSTEM_SAVE]


Does this mean what it implies?? Calamity??


Geoffrey (zenofronia)
 
Old 01-26-2010, 11:55 AM   #9
zenofronia
Member
 
Registered: Nov 2009
Posts: 33

Original Poster
Rep: Reputation: 0
retrieve lost data on a usb stick reply

Quote:
Originally Posted by H_TeXMeX_H View Post
I would first try to dump an image to a HDD using dd. Then, if that succeeds I would use testdisk or foremost on that image. If it fails, then all hope is lost, sorry (that's why a USB stick is not a backup).
I was unable to run a test on the file that was created from 'dd /dev/sdb'
The results from running testdisk on the USB stick are in my previous post. So how do I run a test on the file itself which is on my HD?

Geoffrey (zenofronia)
 
Old 01-26-2010, 01:05 PM   #10
H_TeXMeX_H
Guru
 
Registered: Oct 2005
Location: $RANDOM
Distribution: slackware64
Posts: 12,928
Blog Entries: 2

Rep: Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269
How big is the file that was created ? Is it close to 4 GB ?

The command would be something like:

Code:
dd if=/dev/sdb of=imagefile
or '/dev/sdb1'.

You can also use ddrescue which is specifically for this purpose:
http://www.gnu.org/software/ddrescue...ue_manual.html

As for running testdisk on an image file, see:
http://www.cgsecurity.org/wiki/Media_Image

basically:

Code:
testdisk imagefile

Last edited by H_TeXMeX_H; 01-26-2010 at 01:12 PM.
 
1 members found this post helpful.
Old 01-26-2010, 10:13 PM   #11
zenofronia
Member
 
Registered: Nov 2009
Posts: 33

Original Poster
Rep: Reputation: 0
retrievinf lost data on a usb stick reply reply

The file produced with "dd if=/dev/sdb of=imagefile" is 3.87gb, equal to the available space on the memdisk. (Isn't it wonderful how the name of this nefariously useful gadget is so manifold?) Thanks very much for your suggestions; I will rtfm, acquaint self with text, and proceed.

Cheers,

Geo zenofronia


Animals will acquire position and status heirarchically like umans when they have money. Money: magic symbols on paper that create suffering.
Three cheers for Linus Torvald and Linux commune.
G.Z.




Quote:
Originally Posted by H_TeXMeX_H View Post
How big is the file that was created ? Is it close to 4 GB ?

The command would be something like:

Code:
dd if=/dev/sdb of=imagefile
or '/dev/sdb1'.

You can also use ddrescue which is specifically for this purpose:
http://www.gnu.org/software/ddrescue...ue_manual.html

As for running testdisk on an image file, see:
http://www.cgsecurity.org/wiki/Media_Image

basically:

Code:
testdisk imagefile
 
Old 01-27-2010, 04:35 AM   #12
H_TeXMeX_H
Guru
 
Registered: Oct 2005
Location: $RANDOM
Distribution: slackware64
Posts: 12,928
Blog Entries: 2

Rep: Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269
Also note that if testdisk fails to recover anything, try foremost as well, I've found it to be more capable in many cases.
 
1 members found this post helpful.
Old 01-28-2010, 09:52 PM   #13
zenofronia
Member
 
Registered: Nov 2009
Posts: 33

Original Poster
Rep: Reputation: 0
Solved...Nearly Retrieving lost data on USB stick

Quote:
Originally Posted by H_TeXMeX_H View Post
Also note that if testdisk fails to recover anything, try foremost as well, I've found it to be more capable in many cases.



First off, my thanks to all the people who offered suggestions/help with retrieving files when I thought that all was truly lost. This is why I love Linux, the o.s. and the community.

TexMex: 'foremost' was the golden key. Admittedly, I didn't rtfm but plunged ahead intuitively, as it seemed rather intuitive. It ran along, produced output and two very large files. I've not yet sorted it all out but it seems that all the data has been saved, except that the filenames were replaced with numbers and an appropriate extension, i.e., jpg, doc, and so on.

The head of the output from the foremost audit log was:

======================================================================


Foremost version 1.5.6 by Jesse Kornblum, Kris Kendall, and Nick Mikus
Audit File

Foremost started at Thu Jan 28 19:44:12 2010
Invocation: foremost -v -i dump.dd -o dumpty
Output directory: /home/zeno/dumpty
Configuration file: /etc/foremost.conf
------------------------------------------------------------------
File: dump.dd
Start: Thu Jan 28 19:44:12 2010
Length: 3 GB (4007624704 bytes)

Num Name (bs=512) Size File Offset Comment

0: 00062564.jpg 800 KB 32032768
1: 00064166.jpg 4 KB 32853446
2: 00067215.jpg 181 KB 34414080
3: 00067588.jpg 5 KB 34605068
4: 00071639.jpg 1 MB 36679168
5: 00073721.jpg 3 MB 37745152
6: 00080313.jpg 729 KB 41120256
7: 00081773.jpg 262 KB 41867776
8: 00082300.jpg 683 KB 42137600
9: 00085030.jpg 3 KB 43535524
10: 00085669.jpg 1 MB 43862528
11: 00112166.jpg 768 KB 57428992
12: 00113704.jpg 1 MB 58216448
13: 00117286.jpg 716 KB 60050432
14: 00118720.jpg 792 KB 60784640
15: 00120307.jpg 688 K


>> The tail of the audit was so:


14164: 07712369.jpg 5 KB 3948732940
14165: 07716420.jpg 4 KB 3950807462
14166: 07756559.jpg 693 KB 3971358208
14167: 07757947.jpg 260 KB 3972068864
14168: 07758887.jpg 46 KB 3972550144
14169: 07758981.jpg 113 KB 3972598272
14170: 07764487.jpg 430 KB 3975417344
14171: 07765349.jpg 24 KB 3975858688
14172: 07766214.jpg 743 KB 3976301568
14173: 07767702.jpg 316 KB 3977063424
14174: 07768337.jpg 43 KB 3977388544
14175: 07680717.htm 5 KB 3932527104
Finish: Thu Jan 28 19:47:57 2010

14176 FILES EXTRACTED

jpg:= 4450
gif:= 1011
bmp:= 26
wmv:= 2
rif:= 59
htm:= 2611
ole:= 2612
zip:= 1774
exe:= 9
png:= 1251
pdf:= 371
------------------------------------------------------------------



We can proceed by going through the files and renaming them unless there is a more reasonable path. There wasn't any documentation I could find on 'foremost'. Is there any? Anyways, tomorrow is another day.

Once again, Thank you all,

Geoffrey (zenofronia)
 
Old 01-29-2010, 05:27 AM   #14
H_TeXMeX_H
Guru
 
Registered: Oct 2005
Location: $RANDOM
Distribution: slackware64
Posts: 12,928
Blog Entries: 2

Rep: Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269
The only documentation is the man page and maybe in the config file.

http://linux.die.net/man/1/foremost

Options to note are:

'-t all' this means look for all known types of files
'-a' Enables write all headers, perform no error detection in terms of corrupted files. (this will extract files even if they appear corrupted, may be useful because you will be able to recover even broken files, if that's what you want)
 
1 members found this post helpful.
Old 07-28-2013, 09:49 PM   #15
liiiily
LQ Newbie
 
Registered: Jul 2013
Posts: 1

Rep: Reputation: Disabled
When you lost your data of USB Flash Driver, donít worry, if you didnít write any new contents to overwrite them, you can certainly get them back. The Data Recovery can help you with it. because the deleted data still remain in it, the Data Recovery can extract the lost data after scanning the card, you can retrieve them in a few minutes if you follow the instructions.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Lost data on USB Memory Stick mallangong Linux - Hardware 1 03-08-2008 05:39 PM
USB data stick problem wootletootle Slackware 4 11-12-2006 03:05 AM
Problem installing USB Data Stick djsunny Linux - Hardware 8 04-10-2006 08:42 AM
Can I retrieve my data lost after installing Linux? alanell712 Red Hat 6 03-05-2006 07:35 AM
lost settings for usb camera (memory stick) Slack 10 tireseas Linux - Hardware 2 12-03-2004 12:42 PM


All times are GMT -5. The time now is 11:38 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration