All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 13 posts ] 
Author Message
 Post subject: USB Flash - overwritten first 512 bytes with dd
PostPosted: January 19th, 2008, 17:31 
Offline

Joined: January 19th, 2008, 17:15
Posts: 4
Hello,

I have done what we always fear. In haste I typed the wrong letter in the command line of dd

dd if=/dev/zero of=/dev/sdb1 bs=512 count=1

Unfortunatelly sdb was my flash disk and not the sda1 I wanted to.

So to describe the problem: now I have a KingMax 1GB usb flash which is recognized both in linux and windows as USBest USB2FlashStorage

MHDD finds it as USBest USB2FlashStorage 0.00Utff0163A1BAG
LBA: 0 Unit size: 0 bytes

I have tried:

MHDD>ID
Direct access device
USBest USB2FlashStorage 0.00Utff0163A1BAG
LBA: 0 Unit size: 0 bytes
Warning: Incorrect ID or drive is not ready

The same output I get when I use TOF. Plus I get:
In order to use this function, your drive must be initialized. This drive is not connected or not functioning properly.

Please help. Do I have any chance of recovery? Can I still access the sectors at a lower level? I am pretty sure that if I could just get a dump of the stick I could recover my files.

By the way linux see it but when I try to mount it I get /dev/sdb: no media mounted

Thank you very much.

Desperately yours :(

Cristian Vidu


Top
 Profile  
 
 Post subject: Re: USB Flash - overwritten first 512 bytes with dd
PostPosted: February 1st, 2008, 10:16 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 4334
Location: Hungary
Hi,

I suppose any FS recovery software will be able to help U like getdataback, easyrecovery or whatever, I am not familiar with currently sold ones...
or if U are a bit bit-minded, U can rebuild the partition table manually with a disk editor.

regards,
pepe

_________________
Adatmentés - Data recovery


Top
 Profile  
 
 Post subject: Re: USB Flash - overwritten first 512 bytes with dd
PostPosted: February 3rd, 2008, 17:12 
Offline

Joined: January 19th, 2008, 17:15
Posts: 4
Thanks for the reply.

I have tried a few recovery software but to no avail. The usb flash is seen as a cd-drive both in windows and linux.

When any soft is trying to access the USB Flash it is saying that no media is mounted (or no cd in drive).

I have managed to convert a USB flash into a USB CD-ROM :)

Does anyone have an idea about what information is contained in those 512 bytes?


Top
 Profile  
 
 Post subject: Re: USB Flash - overwritten first 512 bytes with dd
PostPosted: February 3rd, 2008, 17:45 
Offline

Joined: January 8th, 2008, 5:21
Posts: 925
Location: uk
Hi,

Maybe if you find a solution to your problem it might help me find a solution to my own....see here....http://forum.hddguru.com/flash- ... t8395.html

In my case the usb pen type flash drives asks for me to insert removable media.

Pepe replied saying he did not think the problem is due to the controller chip. He suggests the problem might be in the system area.

Well reading your post makes me think we have similar problems.

How would we read out the system areas on these drives?

Can we reprogram the system area directly or do we have to remove the chips and do this in a programmer?


Top
 Profile  
 
 Post subject: Re: USB Flash - overwritten first 512 bytes with dd
PostPosted: February 3rd, 2008, 18:22 
Offline

Joined: January 19th, 2008, 17:15
Posts: 4
The problem is definitely in the system area. More to the point the first 512 bytes. As you can see my flash is certainly not affected in other areas and was working before I erased those bytes.

Now to be honest I was stupid enough not to see that I corrupted the disk. After I did "dd if=/dev/zero of=/dev/sdb1 bs=512 count=1" I did an "fdisk -l" and I saw some corruption (fdisk complained about erroneous partition table) but I did not realize what I did. I worked a bit more on that flash (copying some files to another location) and rebooted. After the reboot I became aware of what happened.

I have access to another identical USB Flash but I did not try to move the chip. Here is why:
Image

The height is about 1 mm.

I still hope there is a software way. I don't have the time right now but I am thinking I may modify the kernel sources and even if it is seen as a CD have it ignore that and just keep on reading.

Unfortunately I am not a programmer so this is not an easy task for me.

If you do find a soft way around this please tell me. I'll keep you posted with what I find.

Cristian Vidu


Top
 Profile  
 
 Post subject: Re: USB Flash - overwritten first 512 bytes with dd
PostPosted: February 4th, 2008, 3:45 
Offline

Joined: August 28th, 2007, 11:11
Posts: 26
Location: Germany
Hi,
Not sure if this will help...
http://www.cgsecurity.org/wiki/PhotoRec

_________________
"Dum Spiro, Spero"


Top
 Profile  
 
 Post subject: Re: USB Flash - overwritten first 512 bytes with dd
PostPosted: November 20th, 2008, 4:42 
Offline

Joined: November 20th, 2008, 4:37
Posts: 1
I have the same problem with my 8gb kingmax usb stick. It is recognized in windows xp like USBest USB2FlashStorage . Is there something i can do or should i just go with it to warranty.


Top
 Profile  
 
 Post subject: Re: USB Flash - overwritten first 512 bytes with dd
PostPosted: February 2nd, 2009, 10:20 
Offline

Joined: February 2nd, 2009, 10:03
Posts: 1
Location: sweden
You have erased your boot sector.

There are several ways to fix this, and seeing there are other posts with similar problems, I'll provide a solution even though the topic is pretty old.

To backup your USB drive do this:

dd if=/dev/sdb of=./flashdisk.dd bs=1024

This will put all contents of your flashdrive (/dev/sdb) in the file flashdisk.dd

Using a common linux tool called 'foremost' you can probably recover some or all files from the flashdisk using the newly created file, flashdisk.dd, as input to foremost. It carves out a number of filetypes automagically.

Another, more involved method, goes like this:
Backup your flash drive as above, creating a flashdisk.dd file, just to be sure.

Now, take another flashdisk (I'm assuming you've got access to one more) and extract the boot sector from it using:

dd if=/dev/your_other_flashdisk of=./bootsector.dd bs=512 count=1

Now, put that bootsector onto your old flashdisk using:

dd if=./bootsector.dd of=/dev/your_thrashed_flashdisk bs=512 count=1

If all is well, you should now be able to access your old flashdrive just like before.

I'm making a few assumptions here, but if you haven't meddled too much with the flashdisk your file system should be good to go.

Hope this helps.

jeanel wrote:
Hello,

I have done what we always fear. In haste I typed the wrong letter in the command line of dd

dd if=/dev/zero of=/dev/sdb1 bs=512 count=1

Unfortunatelly sdb was my flash disk and not the sda1 I wanted to.

So to describe the problem: now I have a KingMax 1GB usb flash which is recognized both in linux and windows as USBest USB2FlashStorage

MHDD finds it as USBest USB2FlashStorage 0.00Utff0163A1BAG
LBA: 0 Unit size: 0 bytes

I have tried:

MHDD>ID
Direct access device
USBest USB2FlashStorage 0.00Utff0163A1BAG
LBA: 0 Unit size: 0 bytes
Warning: Incorrect ID or drive is not ready

The same output I get when I use TOF. Plus I get:
In order to use this function, your drive must be initialized. This drive is not connected or not functioning properly.

Please help. Do I have any chance of recovery? Can I still access the sectors at a lower level? I am pretty sure that if I could just get a dump of the stick I could recover my files.

By the way linux see it but when I try to mount it I get /dev/sdb: no media mounted

Thank you very much.

Desperately yours :(

Cristian Vidu


Top
 Profile  
 
 Post subject: Re: USB Flash - overwritten first 512 bytes with dd
PostPosted: February 2nd, 2009, 21:23 
Offline
User avatar

Joined: September 28th, 2008, 0:30
Posts: 34
will wipe mbr+partition table
dd if=/dev/zero of=/dev/sdb bs=512 count=1

wipe just the mbr
dd if=/dev/zero of=/dev/sdb bs=446 count=1


Top
 Profile  
 
 Post subject: Re: USB Flash - overwritten first 512 bytes with dd
PostPosted: May 6th, 2009, 14:35 
Offline

Joined: May 1st, 2009, 18:52
Posts: 1
Location: Europe
Instructions:

Download http://flashboot.ru/uploads/files/publi ... 9.35.0.zip
If the link doesn't work, go to http://translate.google.com/translate?h ... %26id%3D11 and click the download link

Plug in your USB stick (I would recommend unplugging any other USB devices)
Install and run the program (it will install a driver to directly access your USB stick)
Click File - Enumerate Ports (an error message may appear about the number of ports - don't worry)
Click File - Refresh
Your device should be displayed in the list
Select the USB device you want to repair
Click File - Scan Block (this will run a quick surface scan of your disk)
Click File - Start
When it is complete (don't worry about error messages), exit the program
Click Start Menu - MDPT - Uninstall Driver
When it has uninstalled the driver, unplug your USB stick and plug it back in again. It should now be readable by windows.

You can now run standard data recovery software (I recommend R-Studio). To view the log file go to C:\Program Files\MDPT\Logs - it will let you know if there are any bad blocks/sectors on your USB Stick

The process should work on any USB stick being displayed as "USBest USB2FlashStorage"


Top
 Profile  
 
 Post subject: Re: USB Flash - overwritten first 512 bytes with dd
PostPosted: May 8th, 2009, 3:11 
Offline

Joined: January 19th, 2008, 17:15
Posts: 4
Thanks for the help user56.

If you are still around I still have some problems. MPDT reports error and nothing is changed. Log following:

Port 0 : Connect
status : Code:0x48 0x72
Capacity : 1016MB
VID/PID : 1307/163
Inquiry : USBest USB2FlashStorage
Serial Number :
Samsung-2311-8Gb
Operating Mode : 1.1 - Single
Total Bad Blocks : 922

0x48 Bad block count exceed tolerance
0x72 Initialize ISP Failed

At least 0x48 I understand what it means but I can't reset the table. But 0x72 I can't make heads or tails of it.

Do you know of a solution?

Thanks again for the advice so far. At least I have a starting point.


Top
 Profile  
 
 Post subject: Re: USB Flash - overwritten first 512 bytes with dd
PostPosted: June 22nd, 2009, 23:22 
Offline

Joined: June 22nd, 2009, 23:16
Posts: 1
Location: INDIA
hey guys i have been trying to mount an iso image on my flash drive for two days for now
i hav tried
dd if=my.iso of=/dev/sdb
also
dd if=my.iso of=/dev/sdb1
also
dd if=my.iso of=/dev/sdb bs=1024


but nothing worked ,do these 512 bytes has something to do with
plese help


Top
 Profile  
 
 Post subject: Re: USB Flash - overwritten first 512 bytes with dd
PostPosted: August 2nd, 2009, 6:39 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3471
Location: CDRLabs @ Chandigarh [ India ]
Mates ,
Was The Issue Ever Solved Or Its Still Hanging

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 13 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 51 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group