HDD GURU FORUMS
http://forum.hddguru.com/

USB Flash - overwritten first 512 bytes with dd
http://forum.hddguru.com/viewtopic.php?f=10&t=8400		 Page 1 of 1
Author:  jeanel [ January 19th, 2008, 17:31 ]
Post subject:  USB Flash - overwritten first 512 bytes with dd
Hello,

I have done what we always fear. In haste I typed the wrong letter in the command line of dd

dd if=/dev/zero of=/dev/sdb1 bs=512 count=1

Unfortunatelly sdb was my flash disk and not the sda1 I wanted to.

So to describe the problem: now I have a KingMax 1GB usb flash which is recognized both in linux and windows as USBest USB2FlashStorage

MHDD finds it as USBest USB2FlashStorage 0.00Utff0163A1BAG
LBA: 0 Unit size: 0 bytes

I have tried:

MHDD>ID
Direct access device
USBest USB2FlashStorage 0.00Utff0163A1BAG
LBA: 0 Unit size: 0 bytes
Warning: Incorrect ID or drive is not ready

The same output I get when I use TOF. Plus I get:
In order to use this function, your drive must be initialized. This drive is not connected or not functioning properly.

Please help. Do I have any chance of recovery? Can I still access the sectors at a lower level? I am pretty sure that if I could just get a dump of the stick I could recover my files.

By the way linux see it but when I try to mount it I get /dev/sdb: no media mounted

Thank you very much.

Desperately yours :(

Cristian Vidu
Author:  pepe [ February 1st, 2008, 10:16 ]
Post subject:  Re: USB Flash - overwritten first 512 bytes with dd
Hi,

I suppose any FS recovery software will be able to help U like getdataback, easyrecovery or whatever, I am not familiar with currently sold ones...
or if U are a bit bit-minded, U can rebuild the partition table manually with a disk editor.

regards,
pepe
Author:  jeanel [ February 3rd, 2008, 17:12 ]
Post subject:  Re: USB Flash - overwritten first 512 bytes with dd
Thanks for the reply.

I have tried a few recovery software but to no avail. The usb flash is seen as a cd-drive both in windows and linux.

When any soft is trying to access the USB Flash it is saying that no media is mounted (or no cd in drive).

I have managed to convert a USB flash into a USB CD-ROM :)

Does anyone have an idea about what information is contained in those 512 bytes?
Author:  dick [ February 3rd, 2008, 17:45 ]
Post subject:  Re: USB Flash - overwritten first 512 bytes with dd
Hi,

Maybe if you find a solution to your problem it might help me find a solution to my own....see here....http://forum.hddguru.com/flash- ... t8395.html

In my case the usb pen type flash drives asks for me to insert removable media.

Pepe replied saying he did not think the problem is due to the controller chip. He suggests the problem might be in the system area.

Well reading your post makes me think we have similar problems.

How would we read out the system areas on these drives?

Can we reprogram the system area directly or do we have to remove the chips and do this in a programmer?
Author:  jeanel [ February 3rd, 2008, 18:22 ]
Post subject:  Re: USB Flash - overwritten first 512 bytes with dd
The problem is definitely in the system area. More to the point the first 512 bytes. As you can see my flash is certainly not affected in other areas and was working before I erased those bytes.

Now to be honest I was stupid enough not to see that I corrupted the disk. After I did "dd if=/dev/zero of=/dev/sdb1 bs=512 count=1" I did an "fdisk -l" and I saw some corruption (fdisk complained about erroneous partition table) but I did not realize what I did. I worked a bit more on that flash (copying some files to another location) and rebooted. After the reboot I became aware of what happened.

I have access to another identical USB Flash but I did not try to move the chip. Here is why:
Image

The height is about 1 mm.

I still hope there is a software way. I don't have the time right now but I am thinking I may modify the kernel sources and even if it is seen as a CD have it ignore that and just keep on reading.

Unfortunately I am not a programmer so this is not an easy task for me.

If you do find a soft way around this please tell me. I'll keep you posted with what I find.

Cristian Vidu
Author:  pcotter [ February 4th, 2008, 3:45 ]
Post subject:  Re: USB Flash - overwritten first 512 bytes with dd
Hi,
Not sure if this will help...
http://www.cgsecurity.org/wiki/PhotoRec
Author:  CL4uD1u [ November 20th, 2008, 4:42 ]
Post subject:  Re: USB Flash - overwritten first 512 bytes with dd
I have the same problem with my 8gb kingmax usb stick. It is recognized in windows xp like USBest USB2FlashStorage . Is there something i can do or should i just go with it to warranty.
Author:  popinsky [ February 2nd, 2009, 10:20 ]
Post subject:  Re: USB Flash - overwritten first 512 bytes with dd
You have erased your boot sector.

There are several ways to fix this, and seeing there are other posts with similar problems, I'll provide a solution even though the topic is pretty old.

To backup your USB drive do this:

dd if=/dev/sdb of=./flashdisk.dd bs=1024

This will put all contents of your flashdrive (/dev/sdb) in the file flashdisk.dd

Using a common linux tool called 'foremost' you can probably recover some or all files from the flashdisk using the newly created file, flashdisk.dd, as input to foremost. It carves out a number of filetypes automagically.

Another, more involved method, goes like this:
Backup your flash drive as above, creating a flashdisk.dd file, just to be sure.

Now, take another flashdisk (I'm assuming you've got access to one more) and extract the boot sector from it using:

dd if=/dev/your_other_flashdisk of=./bootsector.dd bs=512 count=1

Now, put that bootsector onto your old flashdisk using:

dd if=./bootsector.dd of=/dev/your_thrashed_flashdisk bs=512 count=1

If all is well, you should now be able to access your old flashdrive just like before.

I'm making a few assumptions here, but if you haven't meddled too much with the flashdisk your file system should be good to go.

Hope this helps.

jeanel wrote:
Hello,

I have done what we always fear. In haste I typed the wrong letter in the command line of dd

dd if=/dev/zero of=/dev/sdb1 bs=512 count=1

Unfortunatelly sdb was my flash disk and not the sda1 I wanted to.

So to describe the problem: now I have a KingMax 1GB usb flash which is recognized both in linux and windows as USBest USB2FlashStorage

MHDD finds it as USBest USB2FlashStorage 0.00Utff0163A1BAG
LBA: 0 Unit size: 0 bytes

I have tried:

MHDD>ID
Direct access device
USBest USB2FlashStorage 0.00Utff0163A1BAG
LBA: 0 Unit size: 0 bytes
Warning: Incorrect ID or drive is not ready

The same output I get when I use TOF. Plus I get:
In order to use this function, your drive must be initialized. This drive is not connected or not functioning properly.

Please help. Do I have any chance of recovery? Can I still access the sectors at a lower level? I am pretty sure that if I could just get a dump of the stick I could recover my files.

By the way linux see it but when I try to mount it I get /dev/sdb: no media mounted

Thank you very much.

Desperately yours :(

Cristian Vidu
Author:  enderst [ February 2nd, 2009, 21:23 ]
Post subject:  Re: USB Flash - overwritten first 512 bytes with dd
will wipe mbr+partition table
dd if=/dev/zero of=/dev/sdb bs=512 count=1

wipe just the mbr
dd if=/dev/zero of=/dev/sdb bs=446 count=1
Author:  user56 [ May 6th, 2009, 14:35 ]
Post subject:  Re: USB Flash - overwritten first 512 bytes with dd
Instructions:

Download http://flashboot.ru/uploads/files/publi ... 9.35.0.zip
If the link doesn't work, go to http://translate.google.com/translate?h ... %26id%3D11 and click the download link

Plug in your USB stick (I would recommend unplugging any other USB devices)
Install and run the program (it will install a driver to directly access your USB stick)
Click File - Enumerate Ports (an error message may appear about the number of ports - don't worry)
Click File - Refresh
Your device should be displayed in the list
Select the USB device you want to repair
Click File - Scan Block (this will run a quick surface scan of your disk)
Click File - Start
When it is complete (don't worry about error messages), exit the program
Click Start Menu - MDPT - Uninstall Driver
When it has uninstalled the driver, unplug your USB stick and plug it back in again. It should now be readable by windows.

You can now run standard data recovery software (I recommend R-Studio). To view the log file go to C:\Program Files\MDPT\Logs - it will let you know if there are any bad blocks/sectors on your USB Stick

The process should work on any USB stick being displayed as "USBest USB2FlashStorage"
Author:  jeanel [ May 8th, 2009, 3:11 ]
Post subject:  Re: USB Flash - overwritten first 512 bytes with dd
Thanks for the help user56.

If you are still around I still have some problems. MPDT reports error and nothing is changed. Log following:

Port 0 : Connect
status : Code:0x48 0x72
Capacity : 1016MB
VID/PID : 1307/163
Inquiry : USBest USB2FlashStorage
Serial Number :
Samsung-2311-8Gb
Operating Mode : 1.1 - Single
Total Bad Blocks : 922

0x48 Bad block count exceed tolerance
0x72 Initialize ISP Failed

At least 0x48 I understand what it means but I can't reset the table. But 0x72 I can't make heads or tails of it.

Do you know of a solution?

Thanks again for the advice so far. At least I have a starting point.
Author:  ssmg.911 [ June 22nd, 2009, 23:22 ]
Post subject:  Re: USB Flash - overwritten first 512 bytes with dd
hey guys i have been trying to mount an iso image on my flash drive for two days for now
i hav tried
dd if=my.iso of=/dev/sdb
also
dd if=my.iso of=/dev/sdb1
also
dd if=my.iso of=/dev/sdb bs=1024


but nothing worked ,do these 512 bytes has something to do with
plese help
Author:  Amarbir[CDR-Labs] [ August 2nd, 2009, 6:39 ]
Post subject:  Re: USB Flash - overwritten first 512 bytes with dd
Mates ,
Was The Issue Ever Solved Or Its Still Hanging
Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/