Thread: read data off USB stick directly somehow

  1. #1
    Registered User
    Join Date
    Apr 2017
    Posts
    80

    read data off USB stick directly somehow

    I recorded a long audio file on a USB stick, it's a voice recorder one too. I didn't turn it off before putting it in the computer. Now the file is 0k in size.

    I really, really, really, really need to get at this file/data somehow. Desperate. I'm on a Mac. Any suggestions? The data must be on there, it would have been saving it on there as it went, but it's ended up 0k.

    Please help.

  2. #2
    and the hat of int overfl Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    38,064
    What kind of audio file?
    Find out the magic numbers for your file format which identify the file (in the same way that say GIF files always have "GIF" as the first 3 characters).

    Is your Mac running OS X ?

    Do you have command line tools like 'dd' and 'hd'?

    1. Plug the thumb drive in and find out what device it becomes.
    Code:
    $ dmesg | tail
    [  793.755691] usbcore: registered new interface driver uas
    [  794.787229] scsi 6:0:0:0: Direct-Access              USB DISK 2.0     PMAP PQ: 0 ANSI: 0 CCS
    [  794.787847] sd 6:0:0:0: Attached scsi generic sg2 type 0
    [  795.835943] sd 6:0:0:0: [sdb] 4055040 512-byte logical blocks: (2.08 GB/1.93 GiB)
    [  795.836560] sd 6:0:0:0: [sdb] Write Protect is off
    [  795.836563] sd 6:0:0:0: [sdb] Mode Sense: 23 00 00 00
    [  795.837182] sd 6:0:0:0: [sdb] No Caching mode page found
    [  795.837185] sd 6:0:0:0: [sdb] Assuming drive cache: write through
    [  795.864366]  sdb:
    [  795.867318] sd 6:0:0:0: [sdb] Attached SCSI removable disk
    2. As 'su', start dumping from the start of the media
    Code:
    $ sudo dd if=/dev/sdb | hd | less
    00000000  eb 3e 90 2a 35 3e 2b 6b  49 48 43 00 02 40 20 00  |.>.*5>+kIHC..@ .|
    00000010  02 00 02 00 00 f8 00 01  20 00 10 00 00 00 00 00  |........ .......|
    00000020  00 e0 3d 00 00 01 29 29  33 08 ae 20 20 20 20 20  |..=...))3..     |
    00000030  20 20 20 20 20 20 46 41  54 31 36 20 20 20 f1 7d  |      FAT16   .}|
    >> more and more and more
    If your paging tool (less) has search features, then search for the magic numbers of the file format.

    Once located, make a note of the hex address at the start of the line. Make sure it is sector aligned (xxxxx[02468ace]00) because it should be at the beginning of a file. You have to convert to decimal and divide by 512 (to arrive at a value of nnnn) for the next dd step.

    3. Copy the raw sectors
    Code:
    $ sudo dd if=/dev/sdb of=recovery.bin skip=nnnn count=xyz
    If you have a rough idea how large the file might be, then xyz is how many sectors. Or you can omit count and it will copy the remainder of the thumb drive to the recovery file.

    I would suggest you get a second thumb drive and record a single short recording to it, then practice with the above steps so you're sure of what you're looking for.

    WARNING:
    Make absolutely sure your if and of parameters are what you want.
    It is so very easy to trash your OS if you get it wrong - check and check again before pressing enter!



    You might be able to use this instead.
    PhotoRec - Wikipedia
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.

  3. #3
    Registered User
    Join Date
    Apr 2017
    Posts
    80
    Oh wow, haven't gone through that in detail but it looks like an excellent answer, many thanks. One bit which stuck out was "Copy the raw sectors" which is great.

    Yup, Mac OS X 10.7.6

    It's a WAV audio file. Mono, 32 bit float, 48000Hz

    No I haven't tried those command line tools (dd and hd).

    I have tried DiskUtility, verify and repair:

    Verifying volume “USBSTICK”
    Checking file system** /dev/disk1s1
    ** Phase 1 - Preparing FAT
    ** Phase 2 - Checking Directories
    `..' entry in /PRINT has non-zero start cluster
    Correct? no
    `..' entry in /READ has non-zero start cluster
    Correct? no
    ** Phase 3 - Checking for Orphan Clusters
    87 files, 8226088 KiB free (1028261 clusters)
    Error: This disk needs to be repaired. Click Repair Disk.
    Verify and Repair volume “USBSTICK”
    Checking file system** /dev/disk1s1
    ** Phase 1 - Preparing FAT
    ** Phase 2 - Checking Directories
    `..' entry in /PRINT has non-zero start cluster
    Correct? yes
    `..' entry in /READ has non-zero start cluster
    Correct? yes
    ** Phase 3 - Checking for Orphan Clusters
    84 files, 8226120 KiB free (1028265 clusters)

    ***** FILE SYSTEM WAS MODIFIED *****
    Volume repair complete.Updating boot support partitions for the volume as required.


    Doing that didn't make any difference, file still 0k, empty.

    Will go through your answer properly.

    Many thanks.

  4. #4
    Registered User
    Join Date
    Apr 2017
    Posts
    80
    Another file's, which was made by the same device, first few bytes:

    00000000 52 49 46 46 f8 0d 03 00 57 41 56 45 66 6d 74 20 |RIFF....WAVEfmt |
    00000010 e4 01 00 00 11 00 01 00 80 bb 00 00 c0 5d 00 00 |.............]..|

  5. #5
    Registered User
    Join Date
    Apr 2017
    Posts
    80
    hd: command not found

  6. #6
    Registered User
    Join Date
    Apr 2017
    Posts
    80
    It doesn't matter how large a number I put in for count, the file is 8k every time:

    sudo dd if=/Volumes/USBSTICK/ of=recovery.bin skip=0 count=10000000
    16+0 records in
    16+0 records out
    8192 bytes transferred in 0.000122 secs (67240193 bytes/sec)

    Does that only do one sector at a time?

  7. #7
    Registered User
    Join Date
    Apr 2017
    Posts
    80
    For this,
    sudo dd if=/dev/sdb | hd | less
    is there an alternative to hd? As I mentioned, hd isn't found.

  8. #8
    Make Fortran great again
    Join Date
    Sep 2009
    Posts
    1,413
    Find a Windows PC and try Recuva, I've used it in the past to recover lost file fragments

  9. #9
    and the hat of int overfl Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    38,064
    Sorry, I alias hd as follows.

    alias hd='od -Ax -t x1z'

    > Does that only do one sector at a time?
    You need to find the /dev entries, not the mounted volumes (which may be damaged).

    But yes, 8192 bytes copied = 512 * 16 records.
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.

  10. #10
    Registered User
    Join Date
    Apr 2017
    Posts
    80
    Quote Originally Posted by Salem View Post
    Sorry, I alias hd as follows.

    alias hd='od -Ax -t x1z'

    > Does that only do one sector at a time?
    You need to find the /dev entries, not the mounted volumes (which may be damaged).

    But yes, 8192 bytes copied = 512 * 16 records.

    Putting alias hd='od -Ax -t x1z' then sudo dd if=/dev/sdb | hd | less asks for my password but in an odd way, and typing in my password doesn't work.

    ~
    ~
    ~
    (END)
    Sorry, try again.
    (END)
    Sorry, try again.
    (END)
    Sorry, try again.
    sudo: 3 incorrect password attempts


    So I'm not able to copy the whole drive at the moment. Being able to do that would be tremendously helpful. Any ideas how to? Thanks.

  11. #11
    and the hat of int overfl Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    38,064
    Well sudo has a short-term memory so once you've entered your password successfully, you have like 5 to 10 mins of grace.

    So perhaps some simple command to get the prompt over and done with, then what you really want to do
    sudo ls
    # now this should work without a prompt
    sudo dd if=/dev/sdb | hd | less

    Or if the alias is messing it up, try hiding it in a sub-shell
    sudo dd if=/dev/sdb | ( hd ) | less

    Or just spell it out fully
    sudo dd if=/dev/sdb | od -Ax -t x1z | less
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.

  12. #12
    Registered User
    Join Date
    Apr 2017
    Posts
    80
    Quote Originally Posted by Salem View Post
    Well sudo has a short-term memory so once you've entered your password successfully, you have like 5 to 10 mins of grace.

    So perhaps some simple command to get the prompt over and done with, then what you really want to do
    sudo ls
    # now this should work without a prompt
    sudo dd if=/dev/sdb | hd | less

    Or if the alias is messing it up, try hiding it in a sub-shell
    sudo dd if=/dev/sdb | ( hd ) | less

    Or just spell it out fully
    sudo dd if=/dev/sdb | od -Ax -t x1z | less

    Did
    dd if=/Volumes/USBSTICK | hd | less
    after doing sudo ls
    That got round the sudo problem. But now
    od: z: unrecognised format character
    (END)

    Thanks.

  13. #13
    and the hat of int overfl Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    38,064
    Read the manual page for your 'od' command to find out what option(s) give you the most useful output.

    Maybe the 'z' option is a Linux enhancement.

    'hexdump' is another common name for a very similar program - do you have that instead?
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.

  14. #14
    Registered User
    Join Date
    Apr 2017
    Posts
    80
    Quote Originally Posted by Salem View Post
    Read the manual page for your 'od' command to find out what option(s) give you the most useful output.

    Maybe the 'z' option is a Linux enhancement.

    'hexdump' is another common name for a very similar program - do you have that instead?
    Yes I have hexdump. So use that instead of od? OK I'll try that. Is it going to output to a file or the screen? Looks like it's going to be the screen, but maybe I'm wrong?

  15. #15
    Registered User
    Join Date
    Apr 2017
    Posts
    80
    I did
    dd if=/Volumes/USBSTICK | hexdump | less

    and got:
    16+0 records in
    16+0 records out
    8192 bytes transferred in 0.007094 secs (1154755 bytes/sec)
    0000000 52 45 43 4f 52 44 20 20 20 20 20 10 00 00 00 00
    0000010 00 00 00 00 00 00 00 00 00 00 07 00 00 00 00 00
    0000020 57 41 54 43 48 20 20 20 20 20 20 10 00 c3 ef 4c
    ...

    But only about 30 lines or so. Is there a way to get the whole drive's content? And into a file?

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. C++ - Eject USB stick
    By mad-hatter in forum C++ Programming
    Replies: 0
    Last Post: 03-17-2017, 01:09 PM
  2. Replies: 21
    Last Post: 11-03-2007, 02:56 PM
  3. Read size of data array when reading .txt data
    By Taquito in forum C Programming
    Replies: 13
    Last Post: 04-29-2007, 01:52 AM
  4. drawing a stick man
    By bigjoke in forum C Programming
    Replies: 3
    Last Post: 12-27-2005, 01:53 PM
  5. read/write directly from VideoRam?
    By Magica in forum C Programming
    Replies: 5
    Last Post: 03-31-2003, 04:23 PM

Tags for this Thread