A Colleague asked me if I could restore a corrupted USB Key. The corruption was possibly caused by a daughter using a music downloader which had embedded viruses and a resulting BSOD.

When I plugged it into a XUbuntu 7.04 Dell Inspiron Laptop at work the filesystem looked like this from Thunar. Note the completely garbled filenames and non-sensical file sizes.

Thunar View of Corrupt USB Key.

I googled and found something close to what I was looking for but the restore I had to do ended up being a lot easier.

Under Ubuntu I plugged the USB Key in.

It auto mounted to /media/disk so I ran mount to find which device it was and then un mounted it

umount /dev/sdb

To give yourself room for trial and error it's best to copy the entire USB Key to a disk image file. Use dd to perform the copy.

root@dellbox:/media# dd if=/dev/sdb of=/home/jamesm/rick_usbkey.img
16711680+0 records in
16711680+0 records out
8556380160 bytes (8.6 GB) copied, 8763.47 seconds, 976 kB/s
root@dellbox:/media#

This took a long time...

I then made a compressed copy of the resulting file with bzip so I had a untouched before image.
cat rick_usbkey.img | bzip2 -c > rick_usbkey_archive.img.bz2

I found I had to mount the disk image but not using normal mount because it autodetects with too many strange options. So I used losetup. The -f option basically says find me the next available free loop device.

losetup -f rick_usbkey.img

Then use fsck.vfat with the -r option for interactive repair and -l option so you can see filenames and paths that are being recovered

fsck.vfat -r -l /dev/loop0

What follows is the screen output of the choices I made to repair the USB File Image. The input to fsck.vfat are in bold italics

dosfsck 2.11, 12 Mar 2005, FAT32, LFN
There are differences between boot sector and its backup.
Don't worry about the boot sector we aren't worried about it. It's the File Allocation Table (FAT) that is corrupt
Differences: (offset:original/backup)
1) Copy original to backup
2) Copy backup to original
3) No action
? 3
FATs differ but appear to be intact. Use which FAT ?
Obviously the FAT is telling complete lies about what is on the disk so the only option is to use the hopefully OK 2nd FAT (i.e. the Backup)
1) Use first FAT
2) Use second FAT
? 2

Free cluster summary wrong (1957454 vs. really 1958541)
I simply trusted fsck.vfat that this needed fixing and said to correct it
1) Correct
2) Don't correct
? 1
You need to say yes to perform the changes or nothing will happen. If you perform the changes and it doesn't work you will need to use the backup copy of the disk image you created and rerun the whole process with different options
Perform changes ? (y/n) y

Once the disk repair is complete unmount the USB key disk image file off the loopback device and remount it to a directory to have a look at the recovered contents:

root@dellbox:~# losetup -d /dev/loop0
root@dellbox:~# mount -o loop rick_usbkey.img usbkey/

Check the contents of the disk image to see if you have uncorrupt file and directory entries

root@dellbox:~# cd usbkey/
root@dellbox:~/usbkey# ls
Correspondence Match Meetings Program 0708 ~wrl2513.tmp
Golf Files News Letters Ricks Music

From this point you can then FDISK the corrupt USB key and create a new partition of type WIN95 VFAT (it's code is b in FDISK), use mkfs.vfat to create a new file system and then copy the files from the disk image back onto the USB key