LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 07-30-2010, 06:56 PM   #1
idlehands
Member
 
Registered: Mar 2010
Distribution: zLinux, RHEL, Ubuntu, SUSE
Posts: 50

Rep: Reputation: 16
Data recovery/forensics


A friend has korg d3200/d32xd music recording device that has an ata 80gb drive in it.

The boot program failed and he has a ton of music on the drive he wants recovered. I'm having issues recovering it as the corrupted drive, and new drives put into the thing all show up in gparted as unallocated space.

plus libparted 2.2 says this on scanning the drive:
The sector size stored in the journal is not 512 bytes. Parted only supports 512 bytes length sectors.


I'm at a loss as to where to begin. I was going to try test disk, photorec and gnu ddrescue but new "control" drives also show up as unallocated space. This is amazingly bizzare. Please help
thanks
 
Old 07-30-2010, 07:08 PM   #2
pljvaldez
LQ Guru
 
Registered: Dec 2005
Location: Somewhere on the String
Distribution: Debian Wheezy (x86)
Posts: 6,094

Rep: Reputation: 281Reputation: 281Reputation: 281
The first thing I would do is use dd to create an image of the drive. That way if the drive is failing, you won't damage it further by accessing it over and over.

Do you know what filesystem is on the drive? You might just be able to mount the image if you know the filesystem.

Anyway, once you have the image file, you can try running foremost on the image.

EDIT: Apparently foremost doesn't do mp3 by default. You'd have to fiddle around and create your own signatures. But it should be fine if they're wave files or one of the supported types (see man foremost).

But photorec should work on the entire image, regardless of filesystem. photorec myimage.img as root should do the trick...

Last edited by pljvaldez; 07-30-2010 at 07:21 PM.
 
Old 07-30-2010, 07:21 PM   #3
kilgoretrout
Senior Member
 
Registered: Oct 2003
Posts: 2,988

Rep: Reputation: 388Reputation: 388Reputation: 388Reputation: 388
The user manual indicates the drive is formatted FAT16. Windows data recovery tools are probably your best bet. One good free one is PCInspector:

http://www.pcinspector.de/default.htm?language=1
 
0 members found this post helpful.
Old 07-30-2010, 07:28 PM   #4
pljvaldez
LQ Guru
 
Registered: Dec 2005
Location: Somewhere on the String
Distribution: Debian Wheezy (x86)
Posts: 6,094

Rep: Reputation: 281Reputation: 281Reputation: 281
If it is really fat16, you should be able to just
Code:
mount -t vfat -o loop,defaults,user,exec,uid=1000,gid=100,umask=000 /path/to/myimage.img /mnt/recover
You might have to use fat or msdos as the filesystem type.
 
Old 07-30-2010, 08:28 PM   #5
idlehands
Member
 
Registered: Mar 2010
Distribution: zLinux, RHEL, Ubuntu, SUSE
Posts: 50

Original Poster
Rep: Reputation: 16
when i pull up file system support in gparted it shows that it supports fat16; why would the drive show up as unallocated in gparted if its fat16 and why the sector size error?
 
Old 07-30-2010, 08:45 PM   #6
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 21,140

Rep: Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123Reputation: 4123
gparted expects the drive to be partitioned. If your device uses the drive as-is (i.e as /dev/sda rather than using a partition /dev/sda1 in Linux speak) gparted is unable to figure it out. A mount of an image as per post #4 should work if it is a standard filesystem, and not something "munged" deliberately by the vendor.
 
Old 07-31-2010, 11:44 AM   #7
kilgoretrout
Senior Member
 
Registered: Oct 2003
Posts: 2,988

Rep: Reputation: 388Reputation: 388Reputation: 388Reputation: 388
The user manual indicates there are several folders on the drive - Backup, WAV, and D3200 are listed as existeng under "Root". The pdf manual can be downloaded here:

http://www.google.com/url?sa=t&sourc...ilpKuI5L6ooCFQ

In the manual, go to Appendices>More about drives and files>Drives. See also, pg 93.

Definitely, do the dd backup as suggested by syg00 and try mounting the image file. As to why gparted doesn't see any partitions, it may be that the partition table is corrupted. With the device hooked up to your pc, what does the command:

# fdisk -l

show with respect to that drive?
 
Old 07-31-2010, 12:00 PM   #8
idlehands
Member
 
Registered: Mar 2010
Distribution: zLinux, RHEL, Ubuntu, SUSE
Posts: 50

Original Poster
Rep: Reputation: 16
vfat and msdos both come up with :

mount: wrong fs type, bad option, bad superblock on /dev/sdb1,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so

FAT: invalid media value (0xa5)
[62037.021719] VFS: Can't find a valid FAT filesystem on dev sdb1.
[62072.550049] FAT: invalid media value (0xa5)
[62072.550589] VFS: Can't find a valid FAT filesystem on dev sdb1.
[62080.010681] FAT: invalid media value (0xa5)
[62080.011708] VFS: Can't find a valid FAT filesystem on dev sdb1.

ugh


trying foremost but i am not convinced anything is going to come off this thing

frown
help
thanks!
 
Old 08-01-2010, 11:11 AM   #9
idlehands
Member
 
Registered: Mar 2010
Distribution: zLinux, RHEL, Ubuntu, SUSE
Posts: 50

Original Poster
Rep: Reputation: 16
Quote:
Originally Posted by kilgoretrout View Post
The user manual indicates there are several folders on the drive - Backup, WAV, and D3200 are listed as existeng under "Root". The pdf manual can be downloaded here:

http://www.google.com/url?sa=t&sourc...ilpKuI5L6ooCFQ

In the manual, go to Appendices>More about drives and files>Drives. See also, pg 93.

Definitely, do the dd backup as suggested by syg00 and try mounting the image file. As to why gparted doesn't see any partitions, it may be that the partition table is corrupted. With the device hooked up to your pc, what does the command:

# fdisk -l

show with respect to that drive?
Disk /dev/sdc: 82.0 GB, 81964302336 bytes
255 heads, 63 sectors/track, 9964 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000

Device Boot Start End Blocks Id System
/dev/sdc1 1 1 0 0 Empty
Partition 1 does not end on cylinder boundary.
 
Old 08-01-2010, 12:30 PM   #10
jiml8
Senior Member
 
Registered: Sep 2003
Posts: 3,171

Rep: Reputation: 116Reputation: 116
Run this command and print the results here:

dd if=/dev/sdc bs=512, count=1 | hexdump -C
 
Old 08-01-2010, 02:27 PM   #11
idlehands
Member
 
Registered: Mar 2010
Distribution: zLinux, RHEL, Ubuntu, SUSE
Posts: 50

Original Poster
Rep: Reputation: 16
Quote:
Originally Posted by jiml8 View Post
Run this command and print the results here:

dd if=/dev/sdc bs=512, count=1 | hexdump -C
/dev/sdb1 is a ddrescue copy from the drive to that partition on another drive

sudo dd if=/dev/sdb1 bs=512 count=1 |hexdump -C
[sudo] password for johann:
1+0 records in
1+0 records out
512 bytes (512 B) copied, 0.0119573 s, 42.8 kB/s
00000000 fc 31 c0 8e d0 31 e4 8e d8 8e c0 be 00 7c bf 00 |.1...1.......|..|
00000010 06 b9 00 01 f3 a5 be ee 07 b0 08 ea 20 06 00 00 |............ ...|
00000020 80 3e b3 07 ff 75 04 88 16 b3 07 80 3c 00 74 04 |.>...u......<.t.|
00000030 08 06 af 07 83 ee 10 d0 e8 73 f0 90 90 90 90 90 |.........s......|
00000040 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 |................|
*
00000070 90 90 90 90 90 90 90 90 90 90 90 90 90 90 be be |................|
00000080 07 b0 00 b9 04 00 80 3c 00 75 6e fe c0 83 c6 10 |.......<.un.....|
00000090 e2 f4 31 db b4 0e be 9d 07 8a 0e af 07 ac d0 e9 |..1.............|
000000a0 73 02 cd 10 08 c9 75 f5 b0 3a cd 10 31 c0 cd 16 |s.....u..:..1...|
000000b0 3c 00 74 f8 be 8b 07 b9 02 00 e8 ba 00 3c 0d 74 |<.t..........<.t|
000000c0 b4 3c 61 72 06 3c 7a 77 02 2c 20 88 c3 be 9d 07 |.<ar.<zw., .....|
000000d0 8a 0e af 07 ac d0 e9 73 04 38 c3 74 06 08 c9 75 |.......s.8.t...u|
000000e0 f3 eb af b8 0d 0e 31 db cd 10 8d 84 62 00 3c 07 |......1.....b.<.|
000000f0 75 07 b0 1f a2 af 07 eb 99 31 d2 b9 01 00 3c 04 |u........1....<.|
00000100 74 11 73 f3 30 e4 b1 04 d2 e0 be be 07 01 c6 8a |t.s.0...........|
00000110 16 b3 07 bf 05 00 56 f6 c2 80 74 31 b4 41 bb aa |......V...t1.A..|
00000120 55 52 cd 13 5a 5e 56 72 1e 81 fb 55 aa 75 18 f6 |UR..Z^Vr...U.u..|
00000130 c1 01 74 13 8b 44 08 8b 5c 0a be 8d 07 89 44 08 |..t..D..\.....D.|
00000140 89 5c 0a b4 42 eb 0c 8a 74 01 8b 4c 02 b8 01 02 |.\..B...t..L....|
00000150 bb 00 7c 50 c6 06 8f 07 01 cd 13 58 5e 73 05 4f |..|P.......X^s.O|
00000160 75 b4 eb 93 81 3e fe 7d 55 aa 75 f6 ea 00 7c 00 |u....>.}U.u...|.|
00000170 00 be 83 07 b9 0a 00 50 b4 0e 31 db ac cd 10 e2 |.......P..1.....|
00000180 fb 58 c3 54 65 73 74 44 69 73 6b 0d 0a 10 00 01 |.X.TestDisk.....|
00000190 00 00 7c 00 00 00 00 00 00 00 00 00 00 31 32 33 |..|..........123|
000001a0 34 46 00 00 41 4e 44 54 6d 62 72 00 02 02 02 1f |4F..ANDTmbr.....|
000001b0 c7 00 00 80 00 00 00 00 00 00 00 00 a5 01 00 00 |................|
000001c0 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 00 |................|
000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.|
00000200
 
Old 08-01-2010, 02:45 PM   #12
jiml8
Senior Member
 
Registered: Sep 2003
Posts: 3,171

Rep: Reputation: 116Reputation: 116
You have a nonstandard boot manager that I do not recognize. It does look like testdisk has done something; at least, the boot sector contains the string "testdisk".

Your partition table is also non-standard. Based upon the standard definition, no filesystem is set for it (that value is zero) and the size of the partition is not correctly defined. However, the signature on the end of the sector is a standard signature. It looks like possibly something has overwritten part of the partition table. I would prefer to see the MBR from the actual disk and not something that any rescue tool has generated.

I am not sure what is supposed to be there, or whether you have a hosed up partition table or your device uses non-standard partitions even with a standard file system.

If testdisk cannot identify a standard partition, we might get away with manually setting one up and see what happens.
 
1 members found this post helpful.
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Data Recovery jeopardyracing Fedora 4 06-27-2009 02:12 PM
Are there any data recovery or... DAVE666 Linux - Newbie 3 01-27-2008 07:22 AM
LXer: Linux Data Recovery on Windows - Is possible through Disk Doctors Linux Recovery Software LXer Syndicated Linux News 0 10-22-2006 12:21 PM
Need help with data recovery. A.C. Helm Linux - Newbie 2 10-15-2005 10:58 AM
Helix Data Forensics/System Repair iso AwesomeMachine Linux - Software 2 09-21-2005 05:53 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 10:21 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration