Any tools for MiniFS or CFS?

[BytesBack]

I have a drive that a customer recently dropped off with clicking heads. After a head swap, I was able to read all but 45 sectors successfully. Even those 45 were able to be read while ignoring ECC. So the image seems near-perfect.

I tried several different tools to locate the picture files that the customer was looking for (R-studio, Data Rescue PC, Test Disk, PhotoRec). Most found absolutely nothing while R-studio claimed that the entire drive was full of file types no one has ever heard of. Worryingly, LBA 0 and 63 contained nothing I had seen before.

I contacted Yarek (thanks!) who pointed out that the signature on LBA 0 was that of CFS or MiniFS. The customer has just left the country and will be out of touch for a while, and I was hoping to have this done for her when she gets back. Have any of you ever worked with, seen, or even heard of MiniFS or CFS? Know of any tools that should work here?

Thanks!
Steve

[drc]

What kind of drive was it? Is this out of a Creative Zen? Can you post the contents of LBA 0?

[BytesBack]

Unfortunately the customer left town and hasn't responded to my emails while she's been gone. I don't know exactly what it is from. She just said she had a bunch of pictures on it. I enclosed block 0 so that you can see the minifs, CFS for yourself. I had to do it as a text file, but all the info is there. Sorry that I don't know how to post raw data. Let me know if you want it in some other format.

FYI block 63 is all 00s

I hope someone has seen this before, because I'm at a loss.

Attachments

block 0.txt

Block 0 from Hitachi 60 GB

(513 Bytes) Downloaded 535 times

[guru]

http://leho.kraav.com/blog/2009/02/25/c ... operation/

http://gist.github.com/483969

You will have to read and I guess have a brain :O)

[BytesBack]

Holy crap! That's working! Thanks very much drc and guru!

I know how to read but I was concerned about the brain requirement

For anyone in the future that searches for this... follow the bottom of the two links and download the python script. If you don't have it already, install python on your computer.

On my Mac (10.6.4) I launched the 'update shell profile command' that came with Python 2.7. I then opened a new terminal window and typed the following, sans outer quotes: 'python <script and location> <raw disk name> songs <output dir>'

On my computer it looked like this: 'python /zenrecover.py /dev/rdisk1 songs /temp/zendata'

Check the script for things to look for other than songs and you can put that in place of the word songs in the above command lines.

Also note that the output directory is created as part of the script. It can't exist beforehand.

Thanks all for your help!!!


Steve
Bytes Back Data Recovery
http://www.bytesbackdatarecovery.com

[guru]

no problem well done with the reading and the BRAIN ;o)

[BytesBack]

I have a sneaking suspicion that the customer might have dropped off the wrong hard drive. She was describing a bunch of photos and a couple videos in a folder on her desktop that I was looking for. That sure doesn't sound like a Zen...

I was able to recover 7 GB from the 60 GB drive. All songs. I ran the python script for archives, system, playlists and recordings as well, to try to get everything off. There wasn't anything but songs. While I'm happy to have gotten the songs off, I was looking for pictures. There doesn't seem to be a modifier in that script for pictures. I've never worked with a Creative Zen drive before (obviously). Is there a way to get pictures off? Does it even have the ability to store them?

Also worth noting: According to winhex, 80% of the drive is 00 so there might not be much more to get.

Thanks again for your help.
Steve

[drc]

Well, if they are there they aren't going to be encrypted or anything. If your scanning tools didn't find any jpg headers then there aren't any jpgs...