A Colleague asked me if I could restore a corrupted USB Key. The corruption was possibly caused by a daughter using a music downloader which had embedded viruses and a resulting BSOD.
When I plugged it into a XUbuntu 7.04 Dell Inspiron Laptop at work the filesystem looked like this from Thunar. Note the completely garbled filenames and non-sensical file sizes.
Thunar View of Corrupt USB Key.
I googled and found something close to what I was looking for but the restore I had to do ended up being a lot easier.
Under Ubuntu I plugged the USB Key in.
It auto mounted to /media/disk so I ran mount to find which device it was and then un mounted it
To give yourself room for trial and error it’s best to copy the entire USB Key to a disk image file. Use dd to perform the copy.
[email protected]:/media# dd if=/dev/sdb of=/home/jamesm/rick_usbkey.img
16711680+0 records in
16711680+0 records out
8556380160 bytes (8.6 GB) copied, 8763.47 seconds, 976 kB/s
This took a long time…
I then made a compressed copy of the resulting file with bzip so I had a untouched before image.
cat rick_usbkey.img | bzip2 -c > rick_usbkey_archive.img.bz2
I found I had to mount the disk image but not using normal mount because it autodetects with too many strange options. So I used losetup. The -f option basically says find me the next available free loop device.
losetup -f rick_usbkey.img
Then use fsck.vfat with the -r option for interactive repair and -l option so you can see filenames and paths that are being recovered
fsck.vfat -r -l /dev/loop0
What follows is the screen output of the choices I made to repair the USB File Image. The input to fsck.vfat are in bold italics
dosfsck 2.11, 12 Mar 2005, FAT32, LFN
There are differences between boot sector and its backup.
Don’t worry about the boot sector we aren’t worried about it. It’s the File Allocation Table (FAT) that is corrupt
1) Copy original to backup
2) Copy backup to original
3) No action
FATs differ but appear to be intact. Use which FAT ?
Obviously the FAT is telling complete lies about what is on the disk so the only option is to use the hopefully OK 2nd FAT (i.e. the Backup)
1) Use first FAT
2) Use second FAT
Free cluster summary wrong (1957454 vs. really 1958541)
I simply trusted fsck.vfat that this needed fixing and said to correct it
2) Don't correct
You need to say yes to perform the changes or nothing will happen. If you perform the changes and it doesn’t work you will need to use the backup copy of the disk image you created and rerun the whole process with different options
Perform changes ? (y/n) y
Once the disk repair is complete unmount the USB key disk image file off the loopback device and remount it to a directory to have a look at the recovered contents:
Check the contents of the disk image to see if you have uncorrupt file and directory entries
From this point you can then FDISK the corrupt USB key and create a new partition of type WIN95 VFAT (it’s code is b in FDISK), use mkfs.vfat to create a new file system and then copy the files from the disk image back onto the USB key