Hi,

I unwisely lent my USB stick to a friend who desperately needed to copy some files between home and work. When she returned it, I plugged it in and found the files could not be read (I have a few things on there she was told not to delete). It appears to have become corrupted- can't say how it happened as I wasn't with her, though she was successful in using it (windows machines of some variety).

Output of ls is a succession of 'ls:cannot access <garbage> Input/output error' with the odd 'No such file or directory' interspersed between them.

I'd like to recover my files if possible, a few are latest versions and hence the backups aren't up to date.

I'm using an Acer Aspire one with the supplied Linpus linux (based on fedora 8), also have access to my old laptop and desktop with older versions of fedora on them.

On the Aspire one, kernel is 2.6.23.9lw

The usb drive is a 16GB Super-Talent (really small one) which mounts as /media/disk

Using fsck gives a response of:
fsck 1.40.2 (12-Jul-2007)
Checking all file systems.
[/sbin/fsck.ext2 (1) -- /] fsck.ext2 disk /dev/sda1

fsck.ext2 however results in:
e2fsck 1.40.2 (12-Jul-2007)
fsck.ext2: Is a directory while trying to open disk

The superblock could not be read or does not describe a correct ext2
filesystem. If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193 <device>

I've read that using e2fsck on a mounted drive is a bad idea, so am looking for suggestions. I just want to recover the files (and am hoping I can then format the disk and make it useable again).

Any suggestions would be much appreciated. Thanks for your time.

Redmittens.

If she successfully used it on Windows that would indicate that it's filesystem is probably FAT*, try using Windows data recovery tools eg. GetDataBack ...


cheers

My computers are all Linux, is there no way to recover data on a FAT filesystem without finding a windows machine?

I've never used it before but I bookmarked this page, just in case, a few months ago:

http://www.cgsecurity.org/wiki/PhotoRec

Maybe it'll work??

You may be able to use forensic tools - eg. tct, foremost etc... try netsearching for 'file carving fat linux'

cheers

Try to copy the whole filesystem to an image first then check the image with fsck.vfat or dosfsck.

You might need additional options to dosfsck to make it check file images. Just do 'man dosfsck' to read its manual.

If it gets fixed, you can mount the image to somewhere with:
You might also add -t vfat if that doesn't work.

fdisk -l
this command will list all disks partitions and their types....

You can try to get that data back but don't blame the person. Flash drives break that way more often than people wreck them.

In fact they were first sold as an almost unbreakable device. Just plug and play.

See this for ideas.

http://www.blackhat.com/presentation...-03-willis.pdf