Pages

Tuesday, September 23, 2008

Formating a undetectable flash drive

Here some more recent RnD done on one of flash drive of friend - Rishit. He was about to dump harddisk data to professional data recoverer.. Eventually settled down on party ;-)

A Transiant flash drive of 120GB space, which was undetectable on WindowsXp.
Condition :
  • Drive undetected on Windows
  • Mounted on Linux-FC6, but could not delete dirty partition sectors
  • Nor move corrupted data to other location.
  • Drive was almost in condition to dump


===========================================
[root@localhost ~]# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
23520588 20259704 2046832 91% /
/dev/sda3 101105 16544 79340 18% /boot
tmpfs 512748 0 512748 0% /dev/shm
/dev/sda2 30701264 25927728 4773536 85% /home/mahendra/D_drive
/dev/sda1 20972824 15270744 5702080 73% /mnt/c
/dev/sdb1 117218240 3006620 114211620 3% /media/Rishit Shah
[root@localhost ~]# mkfs /dev/sdb1
mke2fs 1.39 (29-May-2006)
/dev/sdb1 is mounted; will not make a filesystem here!
[root@localhost ~]# mkfs -t vfat /dev/sdb1
mkfs.vfat 2.11 (12 Mar 2005)
mkfs.vfat: /dev/sdb1 contains a mounted file system.
[root@localhost ~]# mkfs -t vfat /dev/sdb1
mkfs.vfat 2.11 (12 Mar 2005)
mkfs.vfat: /dev/sdb1 contains a mounted file system.
[root@localhost ~]# mkfs /dev/sdb1
mke2fs 1.39 (29-May-2006)
/dev/sdb1 is mounted; will not make a filesystem here!
===========================================

[root@localhost ~]# fdisk -l

Disk /dev/sda: 80.0 GB, 80026361856 bytes
255 heads, 63 sectors/track, 9729 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sda1 * 1 2611 20972826 7 HPFS/NTFS
/dev/sda2 2612 6435 30716280 c W95 FAT32 (LBA)
/dev/sda3 6436 6448 104422+ 83 Linux
/dev/sda4 6449 9729 26354632+ 5 Extended
/dev/sda5 6449 9729 26354601 8e Linux LVM

Disk /dev/sdb: 120.0 GB, 120034123776 bytes
255 heads, 63 sectors/track, 14593 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sdb1 1 14593 117218241 7 HPFS/NTFS
[root@localhost ~]# fdisk /dev/sd
sda sda1 sda2 sda3 sda4 sda5 sdb sdb1
[root@localhost ~]# fdisk /dev/sdb1

The number of cylinders for this disk is set to 14592.
There is nothing wrong with that, but this is larger than 1024,
and could in certain setups cause problems with:
1) software that runs at boot time (e.g., old versions of LILO)
2) booting and partitioning software from other OSs
(e.g., DOS FDISK, OS/2 FDISK)

Command (m for help): p

Disk /dev/sdb1: 120.0 GB, 120031478784 bytes
255 heads, 63 sectors/track, 14592 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

This doesn't look like a partition table
Probably you selected the wrong device.

Device Boot Start End Blocks Id System
/dev/sdb1p1 ? 13578 119522 850995205 72 Unknown
Partition 1 does not end on cylinder boundary.
/dev/sdb1p2 ? 45382 79243 271987362 74 Unknown
Partition 2 does not end on cylinder boundary.
/dev/sdb1p3 ? 10499 10499 0 65 Novell Netware 386
Partition 3 does not end on cylinder boundary.
/dev/sdb1p4 167628 167631 25817+ 0 Empty
Partition 4 does not end on cylinder boundary.

Partition table entries are not in disk order

Command (m for help): d
Partition number (1-4): 1

Command (m for help): d
Partition number (1-4): 2

Command (m for help): d
Partition number (1-4): 3

Command (m for help): d
Selected partition 4
Command (m for help): w
The partition table has been altered!

Calling ioctl() to re-read partition table.

WARNING: Re-reading the partition table failed with error 22: Invalid argument.
The kernel still uses the old table.
The new table will be used at the next reboot.
Syncing disks.

===========================================
Tried deleting all partitions but w command in fdisk dosnt work. Its bad man.

[root@localhost ~]# mkfs.vfat -F 16 /dev/sdb1
mkfs.vfat 2.11 (12 Mar 2005)
mkfs.vfat: /dev/sdb1 contains a mounted file system.

Final try for umounting & then formating the drive

umount -f /dev/sdc1
[root@localhost ~]# mkdosfs -F32 -I /dev/sdc1
mkdosfs 2.11 (12 Mar 2005)
[root@localhost ~]#



Wow !!! I removed the drive & reconnected

[root@localhost ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/VolGroup00-LogVol00
23G 20G 2.0G 91% /
/dev/sda2 30G 25G 4.6G 85% /home/mahendra/D_drive
/dev/sda3 99M 17M 78M 18% /boot
tmpfs 501M 0 501M 0% /dev/shm
/dev/sda1 21G 15G 5.5G 73% /mnt/c
/dev/sdc1 112G 16K 112G 1% /media/disk-1

It works !


No comments:

Post a Comment

Comments welcome :