LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 04-05-2009, 01:44 PM   #1
ef3ktd
LQ Newbie
 
Registered: Apr 2009
Posts: 2

Rep: Reputation: 0
Data recovery on a vfs


Hi all, and thanks in advance for a helping hand.

I lost some data on my phone, I am attempting to recover. The file was deleted by Microsoft's Activsync without asking me. (big surprise). The file was not in a memory card, but on the phone's internal memory.

I realize this means a few bytes of the header were wiped only, so it will be a snap to recover the files as long as I can get the phone's filesystem mounted correctly.

Successfully got FUSE up and running - was able to mount and access my Windows Mobile smartphone's internal filesystem. (not the memory card, but the phone's internal memory)

Using fusermount, got it mounted on /media/myphone.

Now that I have a mount, my next step would be to scrub the fs for my lost files, using Cristophe Grenier's photorec/testdisk recovery program.

However...the program does not recognize the vfs, only my primary and logical partitions /dev/sda1-5 /dev/sdb etcetera.

So then my next avenue of approach is to make a raw data dump/disk image of the phone. Have tried to dd if=/media/myphone of=~/Desktop/phonefs.img, dd returns 0 bytes copied b/c /media/myphone is a directory. I can't dd from /dev/fuse as root either, that returns operation not permitted.

Tried to hexdump too, no luck. I feel like I'm close, but not quite there -- can anyone help?

Thanks again.

Last edited by ef3ktd; 04-06-2009 at 02:47 PM.
 
Old 04-06-2009, 09:01 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,332
Blog Entries: 55

Rep: Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533
"/media/myphone" is a mountpoint. Does it point to any physical device in /dev? What FUSE FS are you using?
 
Old 04-06-2009, 02:40 PM   #3
ef3ktd
LQ Newbie
 
Registered: Apr 2009
Posts: 2

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by unSpawn View Post
"/media/myphone" is a mountpoint. Does it point to any physical device in /dev? What FUSE FS are you using?
Correct. Mountpoint is /media/myphone. The phone is physically connected via usb port.

lsusb returns

Bus 007 Device 003: ID 04f2:b036 Chicony Electronics Co., Ltd
Bus 007 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 005 Device 002: ID 0a5c:2101 Broadcom Corp. A-Link BlueUsbA2 Bluetooth
Bus 005 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 004 Device 003: ID 04e8:6662 Samsung Electronics Co., Ltd
Bus 004 Device 002: ID 04b3:3108 IBM Corp. 800dpi Optical Mouse w/ Scroll Point
Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 006 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub

mount returns

/dev/sda2 on / type ext3 (rw,relatime,errors=remount-ro)
tmpfs on /lib/init/rw type tmpfs (rw,nosuid,mode=0755)
/proc on /proc type proc (rw,noexec,nosuid,nodev)
sysfs on /sys type sysfs (rw,noexec,nosuid,nodev)
varrun on /var/run type tmpfs (rw,nosuid,mode=0755)
varlock on /var/lock type tmpfs (rw,noexec,nosuid,nodev,mode=1777)
udev on /dev type tmpfs (rw,mode=0755)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
devpts on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=620)
fusectl on /sys/fs/fuse/connections type fusectl (rw)
lrm on /lib/modules/2.6.27-11-generic/volatile type tmpfs (rw,mode=755)
/dev/sda6 on /home type ext2 (rw,relatime)
securityfs on /sys/kernel/security type securityfs (rw)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noexec,nosuid,nodev)
gvfs-fuse-daemon on /home/user/.gvfs type fuse.gvfs-fuse-daemon (rw,nosuid,nodev,user=user)
Fur on /media/myphone type fuse.Fur (rw,nosuid,nodev)


Fur is FUSE using the librapi library. The phone is Bus 004 Dev 003. I also found a /dev/fuse, but cannot perform operations on it...tried to dd and hexdump from there as well.

dd if=/media/myphone of=/home/user/Desktop/imagefile.img
returns:

dd: reading `/media/myphone': Is a directory
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.000711962 s, 0.0 kB/s

As root:
dd if=/dev/fuse of=/home/user/Desktop/imagefile.img
returns

dd: reading `/dev/fuse': Operation not permitted
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.000706026 s, 0.0 kB/s


So /media/myphone doesn't point to a device node at all...any ideas?

Last edited by ef3ktd; 04-06-2009 at 02:53 PM.
 
Old 04-06-2009, 05:54 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,332
Blog Entries: 55

Rep: Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533
I don't know how to explain it proper but I doubt 'dd' cares much for representations of filesystems, which I think LibRAPI provides. Unfortunately the only ideas I can come up with would require access to a mcrsft workstation and commercial forensics hardware.
 
Old 04-06-2009, 05:57 PM   #5
Quakeboy02
Senior Member
 
Registered: Nov 2006
Distribution: Debian Squeeze 2.6.32.9 SMP AMD64
Posts: 3,277

Rep: Reputation: 126Reputation: 126
You can't get a "raw data" dump of a mounted filesystem. You can only get that if you have access to the raw device.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Data recovery sibtay Linux - General 2 07-17-2007 05:06 PM
Data Recovery HELP!!!!!!! hallows1 Linux - General 2 04-19-2007 06:53 AM
LXer: Linux Data Recovery on Windows - Is possible through Disk Doctors Linux Recovery Software LXer Syndicated Linux News 0 10-22-2006 01:21 PM
data recovery batev Slackware 7 04-10-2006 03:14 PM
Data recovery - help please smartjafo Linux - Newbie 1 02-03-2006 04:57 PM


All times are GMT -5. The time now is 09:16 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration