Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Well!

I made a ISO file from a USB with dd command, like this way!

sudo dd if=/dev/sdc1 of=/var/isos/hbcd.iso conv=noerror

My USB had a fat32 file system

I tried recover with next commands

sudo dd if=/var/isos/hbcd.iso of=/dev/sdc1  conv=noerror 

But just show small files in root, then trailed next:

sudo ddrecover if=/var/isos/hbcd.iso of=/dev/sdc1  /var/isos/hbcd.log

But doesn't work either

I installed sleuthkit autopsy and say me that my restored partition have a RAW fs it should be FAT32.

how can I recover this data again?

share|improve this question

2 Answers 2

Maybe there's a problem with the MBR on your device (sdc), try testdisk and maybe it will be able to fix it on sdc? Or, sdc itself might have some physical errors, personally I've had some problems with usb flash memory (sd cards, thumbdrives) and multiple partitions.

Or maybe there's a problem with the partition backup (hbcd.iso), try

fsck.msdos -n /var/isos/hbcd.iso

and see if it likes the fat32 partition or not. (-n makes no changes, just to check)

Or First, to just get the data, directly mounting the hbcd.iso file should work if it's a good fat32 filesystem, then you could copy everything out of it without playing with sdc at all. Testdisk can copy the files out of it directly too and may work better if there's some problems with it (run testdisk hbcd.iso). Something like this should work:

mount -o loop,ro hbcd.iso [somedir]

And if mounting & testdisk can't read the filesystem then photorec (part of the testdisk package) can carve the data out of hbcd.iso, but it probably won't keep any original filenames. I think sleuthkit should have some good data carving tools, maybe even testdisk/photorec.

Don't forget the data recovery rule: MAKE A BACKUP COPY AND PLAY WITH IT FIRST! Otherwise some small typo or a naughty program could erase everything, so backup that hbcd.iso.

share|improve this answer

From how I understand dd, it reads what it can and copies the data it gets.

But if there is an error, there is no data so nothing to copy and nothing gets written into the output
- so with conv=noerror you get a mismatch/offset between actual data and sector/block numbering.

You need conv=sync,noerror to neutralize that effect. sync adds 'NUL' data (zero bytes here) to fill the gaps and keep the following blocks where they should be in the output (image file).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.