Pen Drive Problem

Rauldinho · 10-31-2008, 01:41 PM

Hi, i'm having trouble mounting a pendrive in ubuntu 8.04. When i plug it in i get these message when i use the dmesg command. Does anyone have any idea how i can access the usb driver?? Thanks in advanced.

Code:

[   73.144825] usb 5-8: new high speed USB device using ehci_hcd and address 3
[   73.663323] usb 5-8: device not accepting address 3, error -71
[   73.779006] usb 5-8: new high speed USB device using ehci_hcd and address 4
[   73.911653] usb 5-8: configuration #1 chosen from 1 choice
[   73.912243] scsi3 : SCSI emulation for USB Mass Storage devices
[   73.912774] usb-storage: device found at 4
[   73.912780] usb-storage: waiting for device to settle before scanning
[   78.896428] usb-storage: device scan complete
[   78.896921] scsi 3:0:0:0: Direct-Access     Kode     Flash Disk       4.00 PQ: 0 ANSI: 2
[   78.904205] sd 3:0:0:0: [sdc] 996863 512-byte hardware sectors (510 MB)
[   78.905117] sd 3:0:0:0: [sdc] Write Protect is off
[   78.905123] sd 3:0:0:0: [sdc] Mode Sense: 00 00 00 00
[   78.905127] sd 3:0:0:0: [sdc] Assuming drive cache: write through
[   78.907478] sd 3:0:0:0: [sdc] 996863 512-byte hardware sectors (510 MB)
[   78.908355] sd 3:0:0:0: [sdc] Write Protect is off
[   78.908362] sd 3:0:0:0: [sdc] Mode Sense: 00 00 00 00
[   78.908365] sd 3:0:0:0: [sdc] Assuming drive cache: write through
[   78.908374]  sdc: unknown partition table
[   78.912654] sd 3:0:0:0: [sdc] Attached SCSI removable disk
[   78.912741] sd 3:0:0:0: Attached scsi generic sg3 type 0

farslayer · 10-31-2008, 03:00 PM

Is it just a standard USB flash drive ? or is it one of those 'U3' drives ?

Looks like Linux doesn't like the partition table on the flash device. if it's a standard flash disk you can repartition and reformat it. and it will probably work fine.

If it's a U3 flash drive then get the U3 removal software, and cleanse your drive of that junk.

http://www.sandisk.com/driverdownloa...p?driverId=163

http://www.u3.com/uninstall/

Rauldinho · 10-31-2008, 03:11 PM

No, it's not an U3 flash drive, it's just a normal pen drive. I was trying to recover the data from it. Do you think it can be managed?? Thanks for answering, if there is no way i guess i'll have to format it.

farslayer · 10-31-2008, 03:17 PM

Ah so you are looking for forensics on it..

in that case I would probably just use dd to create an image or two of the drive you can do your forensics on the image.

list of forensics distributions.
http://www.darknet.org.uk/2006/03/10...sics-recovery/

jschiwal · 10-31-2008, 03:32 PM

You could look at it with the file command:
sudo file -s /dev/sdc

You could look at it with fdisk to see if there is even a partition table:
sudo /sbin/fdisk -u /dev/sdc

If there was an mbr and it got wiped out, the first partition probably started on block 63. You can try attaching a loop device and if there is a partition starting there, you may be able to mount it:
sudo /sbin/losetup -fs /dev/sdc -o $((63*512))

This will respond with the loop device used such as loop0.
sudo file -s /dev/loop0
sudo mount -t vfat /dev/loop0 /mnt/mountpoint/

---
Also, there is a program called photorec that may be able to recover files from a device or image.