Flash Drive problem [Solved - report]

[Patton Echols]

On 01/05/2011 05:02 AM, Boggess Rod wrote:
>> ------------------------------
>>
>> On 01/04/2011 12:27 PM, Johnny Rosenberg wrote:
>>> Den 2011-01-04 21:10:41 skrev Patton Echols<p.echols at comcast.net>:
>>>
>>>> I have been given a compact flash card with the request that I
>>>> recover files from the card.  When a usb card reader is plugged, no
>>>> reaction.  I've looked at the log viewer and there are no messages
> in
>>>> any log when the card reader is plugged in w/o card (I think that is
>>>> normal) and no messages in any log when the card is plugged in -
>>>> pretty abnormal I think.
>>>>
>>>> I have tested the reader with another card.
>>>>
>>>> Any thoughts on getting a reaction from this card?
>>>>
> <Remainder elided.>
>
> I've done this several times. I'd be very curious to see what you
> ultimately find,

Thanks for the thoughts Rod.  To let everyone know how it came out:

The card would not be read by a USB card reader, but when plugged into a 
builtin multicard reader, it was recognized as a device.  I don't really 
know why.  My hypothesis is that the builtin reader is attached via the 
PCI bus and does not require a completely functioning card to show up.  
The "why" is not important, the lesson is that if you are dealing with a 
broken flash device, try a hardwired card reader.

I imaged the drive using " dd if=/dev/USBDrive 
of=/media/USB2/flashdrive"  Where /media/USB2/ was the mountpoint of a 
usb pendrive and flashdrive was a file.  I made a mistake here, because 
the pendrive is FAT formatted and could only handle a 4gb file.  The 
better alternative would have been to image to a file on the harddrive 
and go from there.

Once I had the image file, I used a file carver "foremost" with all the 
defaults to recover 259 jpeg images.  Of those, about a half dozen were 
broken, with missing blocks of pixels or chunks rearranged.   It is 
possible that other tools would have done a better job.  More can be 
found out about the process here:
https://help.ubuntu.com/community/DataRecovery

As for the mistake, I told the card owner as soon as I figured it out 
and offered to reimage the card and try again.  He said he had something 
less than 300 pictures on the card, he thought I had all of them, and 
even if not, the ones that I recovered were all he was interested in.  
So end of project.