2

user decided to reboot his pc during copy from usb stick and it corrupted his precious data. I'm trying to diagnose what's wrong but unfortunately i hit a wall and can't understand the issue with the stick.

I can see this disk in Disk Utility, but seems like all it has is unallocated space.

sudo fsck /dev/sdc
fsck from util-linux 2.27.1
e2fsck 1.42.13 (17-May-2015)
fsck.ext2: Attempt to read block from filesystem resulted in short read while trying to open /dev/sdc
Could this be a zero-length partition?

fdisk -l /dev/sdc
fdisk: cannot open /dev/sdc: Input/output error

Any help would be greatly appreciated.

dmesg /syslog:

[ 6073.351716] sd 6:0:0:0: [sdc] tag#0 Sense Key : Not Ready [current]
[ 6073.351719] sd 6:0:0:0: [sdc] tag#0 Add. Sense: Medium not present
[ 6073.351722] sd 6:0:0:0: [sdc] tag#0 CDB: Read(10) 28 00 00 76 c6 80 00 00 08 00
[ 6073.351724] blk_update_request: I/O error, dev sdc, sector 7784064
[ 6073.351726] Buffer I/O error on dev sdc, logical block 973008, async page read

He tried to copy around 500mb of work files from that stick, it froze and he rebooted "Just in case". As far I know that was the only copy of those files. Is there any way to try to restore data?

It's getting weirder and weirder. I gave up with restoring data and tried to wipe this stick with shred or dd. Outputs:

shred: /dev/sdd: error writing at offset 19218807296: Input/output error
shred: /dev/sdd: error writing at offset 19218807808: Input/output error

dd: error writing '/dev/sdc': Input/output error
1+0 records in
0+0 records out
0 bytes copied, 0,00123257 s, 0,0 kB/s

Tried to format on Win workstation, cant even plug it in or access through cli, got over hundred "Wrong folder name errors" in a few seconds.

Qqqq
  • 31
  • cannot open /dev/sdc: Input/output error - it's broken. Try a different USB controller/port/hub/cable/computer. If still nothing, it's garbage. Unless it's a hard drive in a USB enclosure, in that case take it out & try it directly. – Xen2050 Nov 21 '17 at 09:36
  • Why do you have a file system on a plain device without partitions? Why are you still using ext2 for anything of worth in 2017? – David Foerster Nov 21 '17 at 09:50
  • Thanks for answers. This stick belongs to someone else and used as a work device only because we have moved to the new office and currently i have nor hardware nor soft to distribute between users. But work need to be done! :) – Qqqq Nov 21 '17 at 10:16
  • @Xen2050 It is generic Transcend Jetflash 64 stick. Tried Ubuntu, MacOS and Win workstations, still nothing. – Qqqq Nov 21 '17 at 10:22
  • Sounds like a lot more than just filesystem corruption, even a borked ext2 will still let you read all the sectors (and try picking up the pieces with testdisk/photorec). Check dmesg/syslog to confirm more error messages, but if nothing reads then it really sounds broken. Maybe the user rebooted because the copying was already frozen, and it was already broken... at least the original data's still on the main hard drive – Xen2050 Nov 21 '17 at 10:45
  • @Qqqq Welcome to Ask Ubuntu! Please use the [edit] function to include information into your answer, not use comments for that. I've included your information into your question for now and you can remove your comment. Thank you. – Videonauth Nov 22 '17 at 04:46
  • 1
    You can try to recover data with PhotoRec, http://www.cgsecurity.org ; See the following link for more details -- for example, it is a good idea to clone the pendrive and do the repair work on a cloned copy, http://ubuntuforums.org/showthread.php?t=2196858&p=13409986#post13409986 – sudodus Nov 22 '17 at 06:50
  • 1
    If the data is critical, here's an answer to a similar problem which you may find useful. @sudodus is correct you should be working on a copy rather than the original media in order to minimize the loss of data. – Elder Geek Nov 22 '17 at 14:56
  • Thank for suggestions, guys, i really appreciate your help. I'm aware of backups but in this situation i couldn't do a thing because users have their own laptops as a workstations and i don't have HW to install any backup service on it.

    How can i close this question?

     – Qqqq Nov 23 '17 at 07:56

1 Answers1

0

Sounds like the drive's file structure was damaged. This can happen when the buffers are not completely written out to the drive before it gets unplugged.

In the future it helps to have pmount installed so the buffers are flushed properly during system idle time. It allows hot-plug-and-unplug gracefully.

To get it, 

sudo apt-get update
sudo apt-get install pmount

Another great feature of pmount is that the drive will retain its mount point. For instance, if it mounts as /media/me/USB32 but then is unplugged and replugged it will remount at that same location.

Without pmount the system will often not notice the dismount, or (as it sounds like in this case) will not have all the buffers written out to the drive (which can include directories).

If it does not notice the dismount then it is likely to append a digit to the remounted USB stick, resulting in `/media/me/USB321' - which means that if you write to the original address the system will treat it as a directory on the root partition. The contents will never reach the USB stick in that scenario.

I consider pmount to be a MUST-HAVE. Then gone are the days of needing to type sync;sync;sync when using these drives.

SDsolar
  • 3,169
  • So as far as i understand there is no way to recover any data which might be stored? I tried to use testdisk and output was like:

    search_part() Disk /dev/sdc - 63 GB / 58 GiB - CHS 60256 64 32 file_pread(6,5,buffer,19(0/0/20)) read err: Input/output error file_pread(6,3,buffer,24(0/0/25)) read err: Input/output error file_pread(6,3,buffer,71(0/2/8)) read err: Input/output error

     – Qqqq Nov 21 '17 at 10:18
  • 1
    Doesn't seem very likely. One thing you might try is put it into a Windows machine and try chkdsk /f on it. I think you either have corruption in a directory causing it to try to read an address that doesn't even exist on the drive, or it may be a true hardware failure. One good rule of thumb is to always make sure to have two copies of important information in case one ends up unreadable. Backups. Good luck with this one. – SDsolar Nov 21 '17 at 16:17