LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Hardware (https://www.linuxquestions.org/questions/linux-hardware-18/)
-   -   Recoving compact flash card (https://www.linuxquestions.org/questions/linux-hardware-18/recoving-compact-flash-card-349359/)

phantompgr 08-02-2005 04:48 PM

Recoving compact flash card
 
Evening all ... a small and niggly little challenge I have been posed.

A friend of mine has a 512 SDCard (Kingston 512MB Compact Flash) that he has stored lots of photos on. While taking said photos, the card appeared to corrupt in the camera and now cannot be mounted. He has turned to me to see whether linux can recover it cos (bizarrely enough) WinXP cant even spin up the card.

Alas I am suffering with a lack of knowledge of hex and where partitions should exist to really do the problem justice so any help would be much appreciated.

The card is placed in a card reader and connected through USB.

On connection the following is displayed in /var/log/messages (using FC3):

Aug 2 18:33:30 falcon kernel: sda: Write Protect is off
Aug 2 18:33:30 falcon kernel: sda: assuming drive cache: write through
Aug 2 18:33:30 falcon kernel: SCSI device sda: 1006992 512-byte hdwr sectors (516 MB)
Aug 2 18:33:30 falcon kernel: sda: Write Protect is off
Aug 2 18:33:30 falcon kernel: sda: assuming drive cache: write through
Aug 2 18:33:30 falcon kernel: sda:<6>sda: Current: sense key: No Sense
Aug 2 18:33:30 falcon kernel: Additional sense: No additional sense information
Aug 2 18:33:30 falcon kernel: unknown partition table
Aug 2 18:33:30 falcon kernel: Attached scsi removable disk sda at scsi2, channel 0, id 0, lun 0
Aug 2 18:33:30 falcon scsi.agent[6074]: disk at /devices/pci0000:00/0000:00:03.2/usb1/1-1/1-1:1.0/host2/target2:0:0/2:0:0:0

This appears okay except for the "Current sense key" message and the unknown partition table.

Seeing as it is a dev, I have dd'ed a backup off of the card to play with but not necessarily got much further. I did try running gpart on it to see whether that would scan okay and got the output shown at the bottom of this post. I admit I got tired of waiting for gpart to finish and exited it, especially due to these messages appearing every 20 seconds or so. These also appeared during the dd copying (which took about 12 hours to complete).

Aug 2 15:12:28 falcon kernel: sda: Current: sense key: No Sense
Aug 2 15:12:28 falcon kernel: Additional sense: No additional sense information

Is the hardware screwed and no playing with partitions will cure it?
Can I recover by staring at the hex etc... using od for instance like the guy did at this address -> http://www.linuxjournal.com/node/8366/print ??

Any ideas, thoughts, more knowledge on the subject would be much appreciated and I know recoving the photos on the disk will be worth its weight in gold...

Many thanks

ThePhantom


### sfdisk output ####
Disk /dev/sda: 1015 cylinders, 16 heads, 62 sectors/track

### GPART OUTPUT ####
/sbin/gpart -vvvv /dev/sda

dev(/dev/sda) mss(512) chs(1015/16/62) #s(1006880) size(491mb)

* Warning: strange partition table magic 0x0012.
Primary partition(1)
type: 013(0x0D)(UNKNOWN)
size: 320704mb #s(656801823) s(488374290-1145176112)
chs: (6/0/7)-(12/0/13)d (492312/12/43)-(1154411/6/29)r
hex: 11 00 07 06 0D 00 0D 0C 12 00 1C 1D 1F 00 26 27

Primary partition(2)
type: 038(0x26)(UNKNOWN)
size: 312288mb #s(639565862) s(639565864-1279131725)
chs: (41/0/39)-(43/0/40)d (644723/10/29)-(1289447/4/54)r
hex: 27 00 27 29 26 00 28 2B 28 00 1F 26 26 00 1F 26

Primary partition(3)
type: 051(0x33)(UNKNOWN)
size: 781120mb #s(1599733810) s(386990140-1986723949)
chs: (35/0/28)-(35/0/29)d (390111/0/29)-(2002745/14/42)r
hex: 2C 00 1C 23 33 00 1D 23 3C 00 11 17 32 00 5A 5F

Primary partition(4)
type: 006(0x06)(Primary 'big' DOS (> 32MB))
size: 132416mb #s(271187986) s(271187986-542375971)
chs: (0/0/0)-(16/0/42)d (273374/15/49)-(546749/15/34)r
hex: 74 00 00 00 06 00 2A 10 12 00 2A 10 12 00 2A 10

dev(/dev/sda) master boot record (w/o partition table):
0000: 58 60 8c 00 5a 61 8d 00 5b 63 8f 00 5b 63 8f 00
X ` . . Z a . . [ c . . [ c . .
0010: 5a 61 8d 00 57 5f 8a 00 5a 5e 8c 00 5a 5e 8c 00
Z a . . W _ . . Z ^ . . Z ^ . .
0020: 59 5d 8b 00 58 5c 8a 00 56 5a 88 00 55 5a 87 00
Y ] . . X \ . . V Z . . U Z . .
0030: 55 59 87 00 55 59 87 00 4e 55 85 00 4c 53 83 00
U Y . . U Y . . N U . . L S . .
0040: 4a 50 82 00 47 4c 80 00 46 4b 80 00 46 4b 80 00
J P . . G L . . F K . . F K . .
0050: 47 4b 82 00 47 4c 82 00 43 4a 7c 00 42 48 7a 00
G K . . G L . . C J | . B H z .
0060: 44 4a 7c 00 4a 4e 80 00 4d 50 82 00 4d 4f 82 00
D J | . J N . . M P . . M O . .
0070: 4d 4f 82 00 51 51 84 00 49 4c 7d 00 4c 4f 82 00
M O . . Q Q . . I L } . L O . .
0080: 49 4d 83 00 3f 44 7e 00 30 3a 74 00 24 33 6c 00
I M . . ? D ~ . 0 : t . $ 3 l .
0090: 24 37 6f 00 31 47 7d 00 3d 4b 7c 00 41 50 80 00
$ 7 o . 1 G } . = K | . A P . .
00A0: 32 43 73 00 1a 2d 5d 00 10 25 55 00 10 26 56 00
2 C s . . - ] . . % U . . & V .
00B0: 18 30 5f 00 2a 43 72 00 41 52 7c 00 41 50 7c 00
. 0 _ . * C r . A R | . A P | .
00C0: 3d 4a 79 00 38 42 73 00 37 3d 73 00 3a 3d 76 00
= J y . 8 B s . 7 = s . : = v .
00D0: 3a 3b 76 00 38 37 74 00 32 3a 6b 00 32 37 6f 00
: ; v . 8 7 t . 2 : k . 2 7 o .
00E0: 34 39 74 00 3d 44 74 00 22 29 47 00 00 05 11 00
4 9 t . = D t . " ) G . . . . .
00F0: 06 08 0f 00 0c 08 10 00 06 0a 0c 00 06 08 0a 00
. . . . . . . . . . . . . . . .
0100: 0d 0b 0d 00 0a 07 08 00 12 0f 10 00 0d 0f 0d 00
. . . . . . . . . . . . . . . .
0110: 07 0d 0a 00 33 3c 38 00 62 69 67 00 56 5d 5b 00
. . . . 3 < 8 . b i g . V ] [ .
0120: 51 58 54 00 5a 5e 5b 00 5a 5e 5a 00 41 46 40 00
Q X T . Z ^ [ . Z ^ Z . A F @ .
0130: 1f 23 1c 00 17 1b 14 00 1a 1c 16 00 1c 1f 19 00
. # . . . . . . . . . . . . . .
0140: 24 29 24 00 29 30 2e 00 1f 26 29 00 09 10 19 00
$ ) $ . ) 0 . . . & ) . . . . .
0150: 01 06 14 00 07 0b 1d 00 06 0e 38 00 07 11 41 00
. . . . . . . . . . 8 . . . A .
0160: 06 15 4b 00 06 17 54 00 03 15 57 00 01 15 58 00
. . K . . . T . . . W . . . X .
0170: 01 14 55 00 01 14 53 00 00 12 55 00 00 12 56 00
. . U . . . S . . . U . . . V .
0180: 00 12 56 00 00 13 57 00 00 14 59 00 00 14 5b 00
. . V . . . W . . . Y . . . [ .
0190: 00 15 5d 00 01 16 5d 00 01 15 5d 00 03 14 59 00
. . ] . . . ] . . . ] . . . Y .
01A0: 08 17 5b 00 05 17 5f 00 00 14 5e 00 02 17 57 00
. . [ . . . _ . . . ^ . . . W .

Matir 08-02-2005 08:13 PM

Yeah, it looks like the partition table is screwed up... although SOME solid-state drives have been known to run without a partition table. You could try directly mounting the image.

Failing that, can you post a hexdump of the first 512 bytes of the disk? Might give me some idea of how badly corrupted the partition table is.

I've done a few of these recoveries just 'for play', but never for real, to be honest.

maroonbaboon 08-02-2005 08:24 PM

I did some research on recovering deleted files on CF a while ago. It pains me to say it but the best tools are all Windows based. The most effective for me was ZAR (just google 'zero assumption recovery'). It's free too.

I don't recall if ZAR needed to have the device recognised by Windows. To fix the partition table you could try just deleting and recreating the partition in fdisk. My understanding is that this does not affect the data, so ZAR should still find the pics. Absolutely essential to have a backup image of course!

phantompgr 08-03-2005 04:10 PM

Here would be the hexdump, no more success so far I am afraid...

Any ideas gratefully received

0000000 0401 0006 0603 0008 0b08 000d 0d0d 0011
0000010 0101 0004 0000 0001 0201 0005 0100 0001
0000020 0000 0001 0000 0001 1312 0013 0503 0008
0000030 0000 0002 0000 0003 0000 0003 0605 000a
0000040 0301 0006 0705 000a 0503 0008 0401 0006
0000050 0a07 000c 0000 0001 0300 0005 0805 000a
0000060 0000 0002 0100 0003 100d 0012 0101 0004
0000070 0000 0001 0f0f 0010 0000 0000 0000 0000
0000080 0001 0000 0304 0003 0001 0000 0000 0000
0000090 0301 0004 0201 0003 0000 0000 0100 0001
00000a0 0000 0000 0000 0000 0102 0003 0000 0000
00000b0 0100 0001 0100 0001 0000 0000 0000 0000
00000c0 0100 0001 0100 0001 0000 0000 0100 0001
00000d0 0000 0000 0000 0000 0000 0000 0100 0001
00000e0 0302 0003 0000 0000 0000 0000 0002 0000
00000f0 0102 0000 0001 0000 0101 0000 0000 0000
0000100 0201 0000 0000 0000 0000 0000 0302 0005
0000110 0000 0001 0100 0003 0000 0001 0000 0001
0000120 0000 0001 0504 0007 0303 0006 0100 0000
0000130 0301 0001 0000 0000 0302 0001 0000 0000
0000140 0000 0000 0001 0000 0103 0001 0003 0000
0000150 0003 0000 0003 0000 0105 0002 0105 0002
0000160 0003 0000 0004 0001 0003 0000 0101 0000
0000170 0101 0000 0101 0000 0101 0000 0101 0000
0000180 0101 0000 0101 0000 0202 0000 0103 0000
0000190 0002 0000 0002 0000 0103 0000 0404 0000
00001a0 0404 0000 0101 0000 0201 0000 0103 0000
00001b0 0002 0000 0002 0000 0002 0000 0002 0000
00001c0 0103 0000 0305 0000 0002 0000 0100 0004
00001d0 0301 0006 0100 0005 0000 0002 0000 0002
00001e0 0000 0002 0000 0002 0100 0004 0000 0000
00001f0 0000 0001 0000 0001 0000 0000 0000 0000
0000200

Much obliged

Electro 08-03-2005 05:14 PM

Do not run gpart on the card. If you trash the card from using disk utilities, you will never get it revived. Only run disk utilities on the image that you got from dd. Use the command below.

dd if=/dev/sda of=flashdisk.img bs=512 conv=noerror,sync

Next use losetup to create a loop device. Then run gpart on the loop device. Hopefully it will guess it faster. You can run fdisk or cfdisk to create a partition table. You will have to discnnect and re-connect the loop device after you write the partition table.


All times are GMT -5. The time now is 04:17 PM.