mounting a camera with no partition table

phantom_cyph · 01-13-2008, 06:33 PM

Howdy! I need a considerable amount of help here...

I have an Olympus Stylus 740 (xD picture card) that had an allergy towards a computer and wiped it clean. I know the pictures are there, I'm just hoping I can somehow recover them in Linux via free software instead of lots of money for windows programs.

My first problem is mounting it. This is the error I get:

Code:

phantomcyph@ubuntu:~$ fdisk -l

Disk /dev/sda: 1048 MB, 1048481280 bytes
33 heads, 61 sectors/track, 1017 cylinders
Units = cylinders of 2013 * 512 = 1030656 bytes
Disk identifier: 0x00000000

Disk /dev/sda doesn't contain a valid partition table
phantomcyph@ubuntu:~$ mount /dev/sda
mount: can't find /dev/sda in /etc/fstab or /etc/mtab
phantomcyph@ubuntu:~$

So, how do I mount it? (obvious next step is recovery)

Thanks!

syg00 · 01-13-2008, 06:58 PM

Start with testdisk - if it is merely the partition table that was trashed, that should restore it.
That's the easy option out of the way. Next is photorec from the same site.

After that you're into serious forensics - search on that ...

phantom_cyph · 01-13-2008, 10:53 PM

OK. I have looked up some man pages, but I'm afraid it will overwrite my drive. This is what I'm at right now, I'm just gonna leave this till I know what to do. I want to make sure I'm bringing everything back, not deleting it.

Heres the screenshot.

MyHeartPumpsFreon · 01-13-2008, 11:02 PM

In my limited recovery experience, you can still recover data as long as new data hasn't been written over it. I've been able to recover data after a drive has been formatted over.

I have zero experience recovering from memory cards. Hard drives, yes. I'm not quite sure how they would differ though. If they do, please tell.

Regards,

Brandon

tredegar · 01-14-2008, 03:06 AM

If using testdisk worries you, try making a copy of the card, and then pointing testdisk at that:
dd if=/dev/sda of=~/disk-image

Now run testdisk, but instead of pointing it at /dev/sda point it at ~/disk-image
photorec is another application that might help you, I have read encouraging reports about it.

MyHeartPumpsFreon · 01-14-2008, 07:56 AM

Good job pointing that out Tred. The first rule of computer forensics is ALWAYS MAKE AN IMAGE. Then you work on that. Not sure why I didn't think of that.

Brandon

phantom_cyph · 01-14-2008, 06:09 PM

photorec recovered everything. Thanks everyone!

(and, xD cards were not even tested with it, so I am happily surprised)

syg00 · 01-14-2008, 06:53 PM

Quote:

Originally Posted by phantom_cyph

(and, xD cards were not even tested with it, so I am happily surprised)

Let the developer know.
For future reference, defining partition(s) doesn't affect the data. For a card (or USB key) I'd just define a partition to cover the entire thing, then see if it is mountable.

Glad you got your data back. Refer to my sig line...

MyHeartPumpsFreon · 01-14-2008, 07:28 PM

Very good to know. Out of curiosity and laziness, Photorec only recovers data from flash drives or is it for hard drives too?

Thanks,

Brandon

phantom_cyph · 01-14-2008, 08:24 PM

Quote:

Originally Posted by MyHeartPumpsFreon

Very good to know. Out of curiosity and laziness, Photorec only recovers data from flash drives or is it for hard drives too?

Thanks,

Brandon

It appears to be mainly for removable devices, camera cards in particular.

pljvaldez · 01-15-2008, 07:41 PM

It works on hard disks, usb drives, zip drives (as long as the disk will still spin), cards, CD's, DVD's, etc. Basically any media with that had contained a supported filesystem (though I think it would work on unsupported filesystems as well since it's looking directly at raw data, not partition tables).

Typically I'll use dd to make an image file from the drive/media, then run photorec on it. But I have used it directly from hard disks when I didn't have enough storage space to make an image and recover files from a drive.