Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Here is what happened:

I used the Laptop and accessed some data on my usb stick. Then I closed the Laptop putting the system into sleep mode. The USB-Stick was still plugged in. After the laptop was completely in sleep I removed the Stick (the light was off, so it must have been without power). I woke up the laptop today without the USB-Stick. Now when I re-plug it, the filesystem will not be mounted automatically.

I tried to manually mount it:

chi mnt # mount -t vfat /dev/disk/by-id/usb-JetFlash_Transcend_4GB_QTMFKJQQ-0\:0-part1 usb/
mount: wrong fs type, bad option, bad superblock on /dev/sdb1,
       missing codepage or helper program, or other error
       Manchmal liefert das Syslog wertvolle Informationen – versuchen
       Sie  dmesg | tail  oder so

Doing a dmesg | tail I found the following:

FAT-fs (sdb1): bogus number of FAT structure
FAT-fs (sdb1): Can't find a valid FAT filesystem

So I tried to do fsck.vfat on the partition of the stick, to see if it can somehow fix it:

chi mnt # fsck.vfat /dev/disk/by-id/usb-JetFlash_Transcend_4GB_QTMFKJQQ-0\:0-part1 
dosfsck 3.0.9, 31 Jan 2010, FAT32, LFN
Cluster size is zero.

Is there some way to repair the filesystem on the stick using linux tools? I am using gentoo.

Also shouldn't this behavior be considered a bug or at least dangerous? Removing the stick while the system is in sleep mode sounds like a common use-case to me. Also if you remove it, it is very easy to forget to put it back in before you turn the system back on, and I don't think this should kill your file-system like this. I am willing to report this bug, but I don't know which mailing list/bugtracker would be the correct one.

EDIT:

I found some suggestions online. However if I try this using:

dd if=/dev/disk/by-id/usb-JetFlash_Transcend_4GB_QTMFKJQQ-0\:0-part1 of=sector6.bin bs=512 count=1 skip=6 conv=noerror,sync
dd if=sector6.bin of=/dev/disk/by-id/usb-JetFlash_Transcend_4GB_QTMFKJQQ-0\:0-part1 bs=512 count=1 conv=noerror,sync,notrunc

I still get the same error afterwards. I also tried using CHKDSK F: \R \T under windows as suggested by some posts, but this tool only reports the drive as RAW and thus unsuported.

share|improve this question
    
Most systems are set up to unmount external filesystems before going to sleep, but that's only possible if there are no open files. –  Gilles Mar 24 '12 at 23:46
    
@Gilles: I thought so too. I opened a bug report for Gentoo and it is currently being investigated. The files seem gone though, even with TestDisk and PhotoRec (but I could repair some of them). –  LiKao Mar 25 '12 at 0:06

1 Answer 1

up vote 3 down vote accepted

Before you do anything to the USB-stick, you should make an image of it:

dd bs=4k of=stick.img if=/dev/disk/by-id/usb-JetFlash_Transcend_4GB_QTMFKJQQ-0\:0

Then you put your stick safely away and use the stick.img file to do your fiddling, instead of destroying more data.

Are there important files on it? Check http://www.cgsecurity.org/wiki/PhotoRec for recovery tools. It recovers more than just photo's unlike the name suggests.

Once you have recovered you data, create a new filesystem on the USB-stick as the old can no longer be trusted with your data. (mkfs.vfat)

share|improve this answer
    
Notice that '-part1' indicates you're doing your fiddling on the first partions, not on the whole USB-stick. –  jippie Mar 24 '12 at 14:49
    
Yes, I have made a backup with the command above. PhotoRec also seems very usable. I just found TestDisk and PhotoRec on some other posting online and will try around now, to see how useable they are for this. –  LiKao Mar 24 '12 at 14:50
    
Or you can use cat /dev/disk/by-id/usb-JetFlash_Transcend_4GB_QTMFKJQQ-0\:0 >stick.img, with less risk of a typo, and it's likely to be faster. –  Gilles Mar 24 '12 at 23:47
    
If cat is faster than dd, you probably forgot to specify the blocksize: 'bs=1M' Blocksize is 512B by default, whereas most block devices for disks are 4kB based. Not sure why we teach people to use 'dd', I believe 'cat' is not transparent for binary files on all Unices. I know for a fact that 'dd' is the only accepted way in forensics. –  jippie Mar 25 '12 at 8:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.