0

A friend of mine gave me a USB key with the following history:

  • He has a lot of important data on it
  • It used to work fine
  • The key stayed on his desk and cannot think of a scenario where it might have been - - - physically damaged
  • He has no idea why this happened. Like, zero.

The key does indeed look fine from a physical standpoint. After pluging in, the key's theoretical location in /dev is /dev/sdb, but there is also a /dev/sg1 that pops up. No idea what it is.

I'm backing the key's content with sudo dd if=/dev/sdb of=./usbkey-backup.img, it's gonna take a while.

Output of sudo parted -l :

Error: /dev/sdb: unrecognised disk label
Model: Intenso Alu Line (scsi)                                            
Disk /dev/sdb: 63.4GB
Sector size (logical/physical): 512B/512B
Partition Table: unknown
Disk Flags: 

[...] other volumes [...]

So there's no partition on that key. The original partition must have been either NTFS or FAT32, and I'd bank on ntfs.

What do you recommend I should do to retrieve that data ?

Do I just apply a single FAT32 or NTFS partition on the whole volume ?

Or is there a smarter way to go about it ? Like a tool I don't know about ?

jwav
  • 141
  • 4
  • It's corrupt. The reason is likely impossible to determine now. You may want to use recovery tools like Testdisk/Photorec. There are commercial alternatives for Windows that tend to work much better in Windows file systems and are a lot more user friendly. If the data you or your friend think it's important then paying for the recovery software or service is something to consider. – ChanganAuto Oct 21 '22 at 17:09
  • 1
    If you need to recover data you should NOT format, partition or whatever else that writes to it. IMO SuperUser is a super bad place to ask about data recovery seen all nonsense that is accepted as answer. – Joep van Steen Oct 22 '22 at 11:30
  • Yep, I'm currently reviewing recovery tools and don't plan on even touching the actual USB key unless I absolutely need to. And in case I mess something up, there's always the `dd` backup. Do you have a recommendation for another place to ask for advice ? IMO the closing of this question was clearly unjustified, but I'm keeping it alive in case I figure it out so I can post the solution here. – jwav Oct 23 '22 at 12:35
  • 1
    Yes, backup with dd, ddrescue even better or whatever makes sector-by-sector backup. I like reddit's r/datarecovery sub best for data recovery related questions. – Joep van Steen Oct 23 '22 at 13:49
  • 1
    Then use file recovery tool to scan the 'disk' image. DMDE for example, it's good and it is affordable. Even free demo is quite generous, recovers 4000 files per run/folder. – Joep van Steen Oct 23 '22 at 13:50
  • 1
    @JoepvanSteen : Just to let you know : PROBLEM SOLVED. I downloaded DMDE (free version) and managed to see the "lost" folders and files right away. As I suspected, it was the partition table that was wiped, not the data. Being impatient, I paid for the full version (16€ for a 1 year license, no biggie) and recovered all the data. Thanks a lot for the pointer, you saved me a bunch of time. I'll try to find the time to re-post the question and answer it Q&A style later on with a link and credits to your answer. Hopefully it won't get shut down then. – jwav Oct 26 '22 at 12:46
  • @jwav, good to hear you got your stuff back! – Joep van Steen Oct 27 '22 at 12:00

0 Answers0