Recovering Data From Transcend 8GB SDHC

[Kelpie]

I have a client of my boyfriend's business who was an idiot and pulled out his SDHC while it's writing. Now it's completely trashed.

I've tried foremost, magicrescue, and PhotoRec to no avail. All them do not output any of the files.

I have an EeePC 4G Surf (The reason I'm stuck with this job, because I have the SDHC reader, boyfriend's burnt out. Plus he likes his uptime.). It is capable of quite a lot more than people think it is. But that's my speciality - Finding the capabilities of hardware. I have an nLited copy of XP as my main system, Backtrack 3 Live on my 4GB USB drive.

I was told to use Backtrack 3, and it really was in my mind before anyone told me, but I was pretty much done with all the distros I've tried before this one. It's frustrating because the support is crappy for my EeePC. Before this I was using Cruncheee which worked okay, but not so well. Still ran across issues. Now Backtrack 3 has been wonderful to me!

The problem I have here is that the whole SDHC is trashed. To the point that the filesystem can not be detected by either programs I've tried above. And these files on here are very important.

However, I know that there is an absolute possibility of recovering this data, because of how it's acting. I had an A-data 4GB SDHC of my own, and I put swap on it to allow for more space to be left on my SSD for things that need the latency-free speed of it... And needless to say, it smelt like burnt brownies and dmesg said it thinks it's an 8GB SDHC. However, dmesg shows that this SDHC is detected fine. Just can't mount it.

I have tried dd_rescue, but it seems like it doesn't really work or A.K.A. I'm more of a Linux newb than it appears, even if I almost got Arch Linux to work.

Now I'm using dd conv=noerror,sync /dev/sda1 /dev/sdb1
I have copied a total of 2.2GB in almost 11 hours. REALLY slow, but I understand why now.

However, I was told by this really nutzo, tape loving, linux nerd who likes to take all the fans out of his computer like an idiot to let his components die (he's actually lost a few harddrives). No offense meant from this, but that's who I go to for most of my linux questions (Rizon IRC, linux channel) But that's the kind of person he is. :P I'm the nerd who likes to push SSDs onto everyone. God can I shut up about that too!? Anyways, I was told by him that it's probably just writing a bunch of 0's because dd is used for CDs. Yes, I know, his advice is usually 80% good, and so I usually go to someone else to make sure it's good advice.

I want to recover this data off of this SDHC. All I get is bad block *. This information is important, so I want to do it as gentle as possible, and I was told to make a copy of the data to work on on hardware I know I can trust. This seems logical. So that's my first goal for today.

Sorry for the unorganized crap of this thread, I haven't been feeling well lately. But I guess my conclusion of a question would be: Could someone point me in the right direction so I can get this done today?

[lupin]

Well first off, if the data really is important you might want to take it to a data recovery company and have them get the data back. Its not a good idea to learn data recovery on the job, there's not a whole lot of room for mistakes.

If the data is important, but not important enough to warrant paying for its recovery, then you may want to try some of these tools which can be used in recovering data from damaged hard drives:

safecopy | freshmeat.net
recoverdm | freshmeat.net
myrescue | freshmeat.net

These are all included on the FCCU forensic boot CD, which can be modified to boot from a USB stick. Or you can customise your own BackTrack 4 PreFinal USB pretty easily (check the Offensive Security blog) and add these tools to that.

Now apologies here if in the following paragraphs Im just telling you something obvious you already know, but I'm unsure of what you're doing with that dd command since the "if=" and "of=" switches are missing from what you have put in your post, and you've also specified partitions instead of disk devices for the inputs and outputs.

Normally a command like this (and Ive edited it a bit to show source and destination) would be trying to copy the disk partition on /dev/sda1 to /dev/sdb1:

dd conv=noerror,sync if=/dev/sda1 of=/dev/sdb1

If the partition on the SDHC device is unrecognisable, and assuming that the SDHC is /dev/sda this command may give you problems.

This command would copy the entire contents of the /dev/sda storage device (including all partitions, damaged or not) to a file on disk. Once its there you can use various file carving techniques on the file to get data back

dd conv=noerror,sync if=/dev/sda of=/path/filename

If you haven't already, you might also want to post your question at a forum dedicated to computer forensics or data recovery - this forum is more concerned with penetration testing.

[Kelpie]

Yeah, I kind of figured that.

Yeah, I always either forget the of,if parts and then get an "invalid command" or I remember it and then forget to mention the use of them. Quite terrible about that.

It's a bunch of picture files I must recover. Used for a camera. So you can imagine how important it is.

The guy agreed I would make an image of the data before we sent it off to Trascend to get the data recovered. I have personal trust issues with sending it off to a company like that. Mainly because I've worked at as an RMA Tech for a company before, and saw some really... low quality doings.

I just want to know if I use this command it will copy the data and then I can use something to fix the file allocation part.

I guess the reason I posted on here, is because this distro is probably the most stable, most supportive, and... I love the complexity despite it being mostly above my head. And figured y'all would know about it, since it's a tool in the OS.

[lupin]

OK then.

My suggested approach for taking an image of the device would be to use one of the tools I mentioned to create the image file - after all these tools are designed for use in situations where the data on the drive may not be easily accessible.

You could maybe even take multiple images of the drive, each using a different tool, as some tools may provide better results. Just be aware that accessing the drive further may reduce chances of data recovery if the hardware is damaged, and you also have to take the time required to take each image into account if the files are required quickly.

Id also suggest reading the README for each tool you use and ideally you would also want to test the tools on some other device first....

[Zaafiriel]

If this can help, PhotoRec is another a tool to recover lost data and specifically lost pictures and videos.