PDA

View Full Version : USB Problem? Help Fast!



kotak07
9th May 2007, 09:51 PM
yea so im using fedora so i thought id ask for help here. I put pictures on my USB drive from fedora and i then took them to windows but when i opened the drive up in windows the pictures were gone. Now i know they are not deleted but when i used a data recovery tool in windows on the drive it showed me the files that were deleted in windows, Now i need a tool or instructions on how to recover the files on linux/fedora. Please i rele need help, my sisters wedding pictures were on there and i need to recover them. Thanks for all your help.

kotak07
10th May 2007, 01:59 AM
anyone have any idea?

daneel971
10th May 2007, 06:54 AM
I suspect that you removed the usb-drive without unmounting it first - the data wasn't really written to the usb drive.

kotak07
10th May 2007, 11:20 AM
but i cut and pasted the photos onto it..so does that mean my photos are gone?

kotak07
10th May 2007, 11:43 AM
so then if there is a way to recover the files can someone tell me how or if there is a way to undo the cut and paste i did then please tell me..any idea that might be able to save these photos....if you want to no the files were saved to the desktop. Please help me im really desperate to get these photos back. My camera made .xml files like [picturename].jpg.xml but idk if u can recreate the photos and the photos were also deleted from my camera so someone help?

offcenter77
10th May 2007, 03:08 PM
As daneel971 said, you need to unmount the disk first before you unplug it from the computer. That will allow the OS to flush the changed segments to the disk.

Right click on the device icon and click "Safely Remove".

JN4OldSchool
10th May 2007, 03:17 PM
I too think it was that you didnt unmount the pen drive. The oics are probably gone, but if you search there is a way to recover deleted data off the camera card unless you have written over it. It is a freeware windows program and I have used it to good effect in the past. I dont know the name though. But probably the only way to get those pics back will be through the camera.

stevea
10th May 2007, 11:47 PM
I'm sorry that you experiencesd this problem. Just as background for the next Time. The Linux notion of a filesystem allows you to mount and unmount the volume. The mount and unmount commands are basically notification to the kernel that it's available/unavailable. On some media like the flash sticks, we do not want to write to the volume every time the OS receives a write request, For example if you wrte 100 files to a directory on the flash, this requires that you read/update/write the directory 100 times. Also that you read/update/write the block allocation tables perhaps thousands of times. Instead a buffer cache exists that holds these updates in RAM, and then the "unmount" command forces the buffers to be finally flushed to the Flash device and the filesystem is then maked as unavailable.

FWIW Windows also requires that you unmount USB stoage devices for the same reason.

Yeah - when you remove the flash without an UNMOUNT you have left the filesystem in a bad state. Probably the directory structure and the block allocation tables and perhaps part of the last pic were lost. You *should* be able to recover the rest, but you'll need to look into data recovery tools for the FAT32 file system (I assume that is what you have on your flash).

First - make a complete raw backup of the flash. To do this insert the flash in your Linux system. Unmount it if it automounts. Then find the correct name for the volume. This will be something like /dev/sdb and NOT /dev/sdb1. You can find this by typing "fdisk -l" as root, then look fot the right-size with the VFAT/FAT32 partition.

To save a copy of the flash use the command (as root)
dd if=/dev/sdb of=backup-flash-goldcopy.img # use the correct name at /dev/sd?b?
This copies every byte from the Flash to the "backup-flash-goldcopy.img file. Never delete of modifiy the goldcopy until you finish the recovery. Extract the flash stick.

You can mount and explore flash contents. with
# make a copy from the goldcopy
cp backup-flash-goldcopy.img test1.img
# make a mount point directory
mkdir TEST
# mount the test1 copy on the TEST directory
mount -o loop ./test1.img ./TEST
# explore the corrupted file system
ls -laR ./TEST

Ther eis probably a lot of Linux FAT recovery stuff - but you'l lhave to search for it.
I'm not familiar with FAT file recovery programs but you'll get a thousand hits from google. I suggest you try the freebies & freeware ones first. Some of the commercial products have free downloads that will show you what could be recovered.

best wishes.

leigh123linux
10th May 2007, 11:56 PM
You could try PhotoRec

http://www.cgsecurity.org/wiki/PhotoRec



PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from Hard Disks and CDRom and lost pictures (thus, its 'Photo Recovery' name) from digital camera memory. PhotoRec ignores the filesystem and goes after the underlying data, so it will still work even if your media's filesystem has been severely damaged or re-formatted.

PhotoRec is free, this open source multi-platform application is distributed under GNU Public License. PhotoRec is a companion program to TestDisk, an app for recovering lost partitions on a wide variety of filesystems and making non-bootable disks bootable again. You can download them from this link.

For more safety, PhotoRec uses read-only access to handle the drive or memory support you are about to recover lost data from. Important: As soon as a pic or file is accidentally deleted, or you discover any missing, do NOT save any more pics or files to that memory device or hard disk drive; otherwise you may overwrite your lost data. This means that even using PhotoRec, you must not choose to write the recovered files to the same partition they were stored on.
Contents
[hide]

* 1 Operating systems
* 2 Filesystems
* 3 Media
* 4 Known file format
* 5 Other topics
* 6 Problems ?

Operating systems

PhotoRec runs under

* DOS/Win9x
* Windows NT 4/2000/XP/2003
* Linux
* FreeBSD, NetBSD, OpenBSD
* Sun Solaris
* Mac OS X

and can be compiled on almost every Unix system.
Filesystems

Photorec ignores the filesystem, this way it works even if the filesystem is severely damaged.
It can recover lost files at least from

* FAT,
* NTFS,
* EXT2/EXT3 filesystem
* HFS+

ReiserFS includes some special optimizations centered around tails, a name for files and end portions of files that are smaller than a filesystem block. In order to increase performance, ReiserFS is able to store files inside the b*tree leaf nodes themselves, rather than storing the data somewhere else on the disk and pointing to it. Unfortunately, PhotoRec isn't able to deal with this, it's why it doesn't work well with ReiserFS.
Media

PhotoRec works with HardDisks, Cdrom, Compact Flash, Memory Stick, SecureDigital, SmartMedia, Microdrive, MMC, USB Memory Drives...
PhotoRec has been successfully tested with the following Digital Camera

* Canon EOS300D, 10D
* HP PhotoSmart 620, 850, 935
* Nikon CoolPix 775, 950, 5700
* Olympus C350N, C860L, Mju 400 Digital, Stylus 300
* Sony DSC-P9
* Praktica DCZ-3.4
* Casio Exilim EX-Z 750

Known file format

PhotoRec searches known file header and because there is no data fragmentation (usually), it can recover the whole file. Photorec recognises numerous file format including ZIP, Office, PDF, HTML, JPEG and various graphics file formats. The whole list of file formats recovered by PhotoRec contains more than 80 file extensions.

A.Serbinski
11th May 2007, 01:33 AM
It the disk was not unmounted, then they were never written in the first place, which means that it is IMPOSSIBLE to recover them.

Note that BOTH windoze and Linux require you to unmount disks before detaching them. With CD's, both will generally do this automatically - the drive button triggers an unmount and eject event. With floppies in Linux, you have to manually unmount, in windoze, it automatically unmounts the instant that a read or a write is finished. With USB memory, you have to press the green button in your taskbar and hit "safely remove". In Linux, you right-click on the icon on the desktop and press "unmount".

Note this though; when you press "unmount", it is NOT instantly ready to be unplugged. You need to WAIT for the disk to be synchronized. If you are lucky and have a USB memory with an LED, you wait for it to stop blinking. Otherwise, use your judgment and wait until you think it should be done.

Wayne
11th May 2007, 01:39 AM
Usually, in Gnome a message pops up telling you the unit is safe to be removed. Strange though, it doesn't every time!

Wayne

leigh123linux
11th May 2007, 01:45 AM
It the disk was not unmounted, then they were never written in the first place, which means that it is IMPOSSIBLE to recover them.

Note that BOTH windoze and Linux require you to unmount disks before detaching them. With CD's, both will generally do this automatically - the drive button triggers an unmount and eject event. With floppies in Linux, you have to manually unmount, in windoze, it automatically unmounts the instant that a read or a write is finished. With USB memory, you have to press the green button in your taskbar and hit "safely remove". In Linux, you right-click on the icon on the desktop and press "unmount".

Note this though; when you press "unmount", it is NOT instantly ready to be unplugged. You need to WAIT for the disk to be synchronized. If you are lucky and have a USB memory with an LED, you wait for it to stop blinking. Otherwise, use your judgment and wait until you think it should be done.

I wasn't thinking about the usb drive ( In the first post he says he copy & pasted them so the original location might be recoverable !

A.Serbinski
11th May 2007, 02:26 AM
Yes, thats true.