Unknown Partition Table on USB Thumb Drive

[johnrocs]

Hey all-

My friend gave me a flash drive with some important files on it that one day didn't work with his windows box. Upon plugging in the thumb drive, Windows gives a "you must format this disk before it can be used" message. I tried running a data recovery program (Easeus) on it but didn't have great results- only recovered some .wav files, a few .avi files and a .exe- none of which were very important, so I figure'd I'd try to mount it in Linux and possibly see the rest of the filesystem.

The thumbdrive is a 2GB Lexar JD Firefly

I plugged in the thumb drive and it is picked up by the system, but I can't access it. Here is the output of lsusb

[root[ at ]colbalt ~]# lsusb
Bus 007 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 006 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 005 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 004 Device 002: ID 045e:00dd Microsoft Corp.
Bus 004 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 003 Device 002: ID 0461:4d15 Primax Electronics, Ltd Dell Optical Mouse
Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 002 Device 004: ID 05dc:a731 Lexar Media, Inc.
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Output of dmesg

usb 2-2: USB disconnect, address 3
usb 2-2: new high speed USB device using ehci_hcd and address 4
usb 2-2: New USB device found, idVendor=05dc, idProduct=a731
usb 2-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-2: Product: JD FireFly
usb 2-2: Manufacturer: Lexar
usb 2-2: SerialNumber: AA04015200012313
usb 2-2: configuration #1 chosen from 1 choice
scsi8 : SCSI emulation for USB Mass Storage devices
usb-storage: device found at 4
usb-storage: waiting for device to settle before scanning
usb-storage: device scan complete
scsi 8:0:0:0: Direct-Access     Lexar    JD FireFly       1100 PQ: 0 ANSI: 0 CCS
sd 8:0:0:0: Attached scsi generic sg2 type 0
sd 8:0:0:0: [sdb] 3915776 512-byte logical blocks: (2.00 GB/1.86 GiB)
sd 8:0:0:0: [sdb] Write Protect is off
sd 8:0:0:0: [sdb] Mode Sense: 43 00 00 00
sd 8:0:0:0: [sdb] Assuming drive cache: write through
sd 8:0:0:0: [sdb] Assuming drive cache: write through
 sdb: unknown partition table
sd 8:0:0:0: [sdb] Assuming drive cache: write through
sd 8:0:0:0: [sdb] Attached SCSI removable disk

Trying to mount the thumb drive doesn't work :-\ When I ran the data recovery tool, the FS was detected as FAT32 which isn't surprising.

[root[ at ]colbalt ~]# ls /mnt
usbdrive
[root[ at ]colbalt ~]# ls /mnt/usbdrive/
[root[ at ]colbalt ~]# mount -t vfat /dev/sg2 /mnt/usbdrive/
mount: /dev/sg2 is not a block device
[root[ at ]colbalt ~]# mount -t vfat /dev/sdb /mnt/usbdrive/
mount: wrong fs type, bad option, bad superblock on /dev/sdb,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

[root[ at ]colbalt ~]# dmesg | tail
FAT: invalid media value (0x0f)
VFS: Can't find a valid FAT filesystem on dev sdb.

[ EDIT ]

Tried running chkdsk on my Windows box...

C:\Users\Johnrocs>CHKDSK E: /F /R
The type of the file system is RAW.
CHKDSK is not available for RAW drives.

Trying a couple more data recovery tools, namely "Zero Assumption Recovery" which supposedly can recover from RAW FS, then going to try CGSecurity's TestDisk. Will post results later...

[ /EDIT ]


Any help here would be greatly appreciated, thanks a bunch!
John

[yancek]

What output do you get with the flash drive attached from the "fdisk -l" command as root? Asking because of the output below:

FAT: invalid media value (0x0f)
VFS: Can't find a valid FAT filesystem on dev sdb.

[johnrocs]

Hi! Thanks for the quick response! Here is the output of fdisk -l relevant to the thumb drive...

Disk /dev/sdb: 2004 MB, 2004877312 bytes
62 heads, 62 sectors/track, 1018 cylinders
Units = cylinders of 3844 * 512 = 1968128 bytes
Disk identifier: 0x0fde0fdd

Disk /dev/sdb doesn't contain a valid partition table

I've ran "Zero Assumption Recovery" tool a few times (darn 4 folder export limits on the demo...) and recovered a bunch of files, however I'd still like to explore additional recovery options and hopefully come up with something more usable.

[rcgreen]

TestDisk - CGSecurity

[johnrocs]

Hey I just finished running TestDisk as I mentioned in an earlier post. I did a bunch of messing around, tried defining the FS and exporting an image.dd file and mounting that to no avail No matter what I do, listing files will always say "No files found, filesystem seems damaged". Am I doin it wrong?

Now when I plug the drive in, I no longer get the error message and windows shows the drive as having 1.36GB out of 1.86GB free, when I open the drive, completely empty. Running "Zero Assumption Recovery" however, still shows all the same recovery as before I messed around with TestDisk, so I know it's still on there.

I don't know what my friend actually did to this thumb drive, according to him, just one day he went to plug it in and got the "You need to format this drive before you can use it" message and that was that. I'm beginning to expect that this thing is busted

[rcgreen]

Unfortunately, you may not recover much. You have used the best tools
on it. It may work fine after formatting, if that is any consolation.

[johnrocs]

Aye, that's how it's looking right about now :-\ I'll continue playing around with TestDisk, maybe something will come out of it. Thanks a lot for your time & input, I appreciate it. If I make any progress I'll post an update.