# recover data on corrupted usb drive



## jrm@ (Oct 2, 2011)

Hello,

When I insert the drive the following is logged to /var/log/messages:


```
Oct  2 17:10:08 gly kernel: ugen4.3: <OLYMPUS CORPORATION> at usbus4 (disconnected)
Oct  2 17:10:08 gly kernel: umass1: at uhub4, port 2, addr 3 (disconnected)
Oct  2 17:10:08 gly kernel: (da4:umass-sim1:1:0:0): lost device
Oct  2 17:10:08 gly kernel: (da4:umass-sim1:1:0:0): removing device entry
Oct  2 17:10:24 gly root: Unknown USB device: vendor 0x090c product 0x3000 bus uhub7
Oct  2 17:10:24 gly kernel: ugen7.3: <Silicon Motion,Inc.> at usbus7
Oct  2 17:10:24 gly kernel: umass1: <Silicon Motion,Inc. SM3255AA MEMORY BAR, class 0/0, rev 2.00/1.00, addr 3> on usbus7
Oct  2 17:10:25 gly kernel: (probe0:umass-sim1:1:0:0): TEST UNIT READY. CDB: 0 0 0 0 0 0 
Oct  2 17:10:25 gly kernel: (probe0:umass-sim1:1:0:0): CAM status: SCSI Status Error
Oct  2 17:10:25 gly kernel: (probe0:umass-sim1:1:0:0): SCSI status: Check Condition
Oct  2 17:10:25 gly kernel: (probe0:umass-sim1:1:0:0): SCSI sense: NOT READY asc:3a,0 (Medium not present)
Oct  2 17:10:25 gly kernel: da4 at umass-sim1 bus 1 scbus4 target 0 lun 0
Oct  2 17:10:25 gly kernel: da4: < USB MEMORY BAR 1000> Removable Direct Access SCSI-0 device 
Oct  2 17:10:25 gly kernel: da4: 40.000MB/s transfers
Oct  2 17:10:25 gly kernel: da4: Attempt to query device size failed: NOT READY, Medium not present
```

When I look in /dev/ I only see
`% ls /dev/da*`

```
/dev/da0 /dev/da1 /dev/da2 /dev/da3 /dev/da4
```

when before there was an entry for /dev/da4s1.

It's actually a friend's drive and he used it mainly on Windows, so I'm guessing it's either an ntfs or fat32 filesystem.

Does anyone has any suggestions for retrieving the data.

TIA.


----------



## jb_fvwm2 (Oct 2, 2011)

1... be sure it has its own power. 2... fdisk (no parameters) it to check its filesystem 3... if it won't mount normallly, maybe with the "force" option if it applies. (depending upon the outcome of step #2).  But post much more information about the hardware if it may help others to reply?


----------



## jrm@ (Oct 3, 2011)

Sorry, I posted the message too quickly. It's actually a thumb drive, so there is no external power source.  I'm not sure what to run fsck on since there isn't an entry in /dev.


----------



## adamk (Oct 3, 2011)

Does the drive work in other computers?  Or with another operating system?

Adam


----------



## jrm@ (Oct 3, 2011)

No, I should have also mentioned that.  He came to me after it stopped working for him on windows. He was hoping I could force it to mount, but no luck.


----------



## adamk (Oct 3, 2011)

So then the hardware is busted.  Restore from backups.

Adam


----------



## jrm@ (Oct 3, 2011)

He says he has backups, but they are a few days old.  Before I turn him away I would like to rule out other possibilities like a corrupt partition table or some other problem that would allow the data to be retrieved.  This looks interesting: http://www.linuxjournal.com/article/8366


----------



## pbd (Oct 3, 2011)

Make an image of the drive, so you can't damage the original data:


```
dd if=/dev/da4 of=thumbdrive.img
```

Then try sysutils/testdisk on thumbdrive.img. Note that sysutils/testdisk contains also untility photorec, if you need to recover individual files.


----------



## jrm@ (Oct 3, 2011)

`# dd if=/dev/da4 of=thumbdrive.img`

```
dd: /dev/da4: Device not configured
```


----------



## pbd (Oct 3, 2011)

mingrone said:
			
		

> `# dd if=/dev/da4 of=thumbdrive.img`
> 
> ```
> dd: /dev/da4: Device not configured
> ```



And is it still /dev/da4? I just used the device name from your first post.


----------



## wblock@ (Oct 3, 2011)

file(1) can help to determine what's on a disk or partition:
`# file -s /dev/da4`
`# file -s /dev/da4s1`

When you're copying more than a trivial amount of data with dd(1), give it a bigger buffer to increase speed.
`# dd if=/dev/da4 of=/thumbdrive.img bs=64k`


----------



## jrm@ (Oct 3, 2011)

pbd said:
			
		

> And is it still /dev/da4? I just used the device name from your first post.



When I plug the memory stick in /dev/da4 is created and /dev/da4 is mentioned in the messages written to /var/log/messages as above.  But, no /dev/da4s1 is created.


----------



## wblock@ (Oct 3, 2011)

s1 would only appear if there is an MBR partition table on the stick.  A lot of removable media doesn't have an MBR.  See what file(1) says about /dev/da4.


----------



## jrm@ (Oct 3, 2011)

So, I just went to grab the memory stick from my friend to see what file() says and he told me he dropped it off at the campus "hardware services".  So, I guess it's out of my (our) hands now.  It would have been interesting to see if I (we) could have salvaged anything.  Now he'll spend some money to find out.

Thanks for all your suggestions.


----------

