Loading...

testdisk saved my data from a sd-card

:heavy_exclamation_mark: This post is older than a year. Consider some information might not be accurate anymore. :heavy_exclamation_mark:

TestDisk is free data recovery software. I got serious problems with my 16 GB SDXC card. It was formatted with ext3 and the superblock was corrupt.

dmesg output

[ 151.452247] mmc0: tried to reset card
[ 151.455632] mmcblk0: error -84 transferring data, sector 31268863, nr 1, cmd response 0x900, card status 0x0
[ 151.455636] blk_update_request: I/O error, dev mmcblk0, sector 31268863
[ 151.455638] Buffer I/O error on dev mmcblk0, logical block 3908607, async page read

Check devices with filesystems

tan@omega:/mnt$ lsblk --fs
NAME FSTYPE LABEL UUID MOUNTPOINT
sda
├─sda1 swap c5d4d58b-27ad-49dd-8255-01fb69795614 [SWAP]
├─sda2 ext4 bd9de86c-faa1-4968-ad14-71b12ca252c8 /tmp
└─sda3 ext4 8e37730a-c66f-4c89-a472-1aa5429cd7a2 /home
sdb
├─sdb1 vfat E3A3-A07D /boot/efi
├─sdb2 ext4 4f29469e-ada9-43ae-b9c4-1aa4cf7bce57 /
└─sdb3 swap b0b73417-8369-41cc-9850-15a03904155e [SWAP]
mmcblk0
└─mmcblk0p1

The SD card has no filesystem assigned. A case for testdisk. If you haven’t installed testdisk yet, you can install it with

sudo apt-get install testdisk

To prevent harming other devices or drives state explicitly the device

sudo testdisk /debug /dev/mmcblk0

It opens the console menu

TestDisk 7.0, Data Recovery Utility, April 2015
  TestDisk is free software, and
comes with ABSOLUTELY NO WARRANTY.
Select a media (use Arrow keys, then press Enter):
>Disk /dev/mmcblk0 - 16 GB / 14 GiB

Select Intel/PC partition, since my card was formatted on Linux.

TestDisk 7.0, Data Recovery Utility, April 2015
Disk /dev/mmcblk0 - 16 GB / 14 GiB
Please select the partition table type, press Enter when done.
>[Intel  ] Intel/PC partition
 [EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
 [Humax  ] Humax partition table
 [Mac    ] Apple partition map
 [None   ] Non partitioned media
 [Sun    ] Sun Solaris partition
 [XBox   ] XBox partition
 [Return ] Return to disk selection

The following menu is showed:

TestDisk 7.0, Data Recovery Utility, April 2015
Disk /dev/mmcblk0 - 16 GB / 14 GiB
     CHS 488576 4 16 - sector size=512
>[ Analyse  ] Analyse current partition structure and search for lost partitions
 [ Advanced ] Filesystem Utils
 [ Geometry ] Change disk geometry
 [ Options  ] Modify options
 [ MBR Code ] Write TestDisk MBR code to first sector
 [ Delete   ] Delete all data in the partition table
 [ Quit     ] Return to disk selection

Run the analysis, it shows me I could still access my data, except for the corrupted data.

TestDisk 7.0, Data Recovery Utility, April 2015
Disk /dev/mmcblk0 - 16 GB / 14 GiB - CHS 488576 4 16
Partition Start End Size in sectors
Linux 32 0 1 488543 3 16 31264768
superblock 0, blocksize=4096 []
superblock 32768, blocksize=4096 []
superblock 98304, blocksize=4096 []
superblock 163840, blocksize=4096 []
superblock 229376, blocksize=4096 []
superblock 294912, blocksize=4096 []
superblock 819200, blocksize=4096 []
superblock 1605632, blocksize=4096 []
superblock 2654208, blocksize=4096 []
To repair the filesystem using alternate superblock, run
fsck.ext4 -p -b superblock -B blocksize device

The filesystem check didn’t work nor could I repair the damage to the superblock. Start the image backup with dd

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/mmcblk0 - 16 GB / 14 GiB
1 P Linux 32 0 1 488543 3 16 31264768
3.31 % ==>
Disk images are mainly used
- for forensics purpose
- or to deal with media with bad sectors
To use TestDisk or PhotoRec with this disk image, start a Terminal and run
testdisk image.dd
or photorec image.dd

Now mount the image.dd as loopback device and copy the recovered data that can be rescued :smile:

tan@omega:~/tmp$ mkdir backup
tan@omega:~/tmp$ sudo mount -ro loop -t ext3 image.dd backup/

Saves my day. It wasn’t that important, since I used Apple everything is perfectly covered with time machine, but good to know you can mostly rely on testdisk as last resort.

Please remember the terms for blog comments.