I'm on Linux.

[mcc@mastodon.social]

I'm on Linux. I have an SD card which has been giving me a number of strange problems for a while now. It now appears to have wiped itself completely. Looking in GNOME disks the main partition, which I expect to be exfat, is of type "unknown". If I run fsck.exfat, It claims it's not a valid exfat image.

Windows refuses to even look at it.

Before I destructively image the disk, do you think there is ANYTHING else I can/should try to see if the data is still easily recoverable?

[ellenor2000@mastodon.top]

@mcc testdisk/photorec? last i remember ubuntu had testdisk or both in its repos #lang_en

[allie@kind.social]

@mcc Is there maybe a way to write a "valid boot sector" to it. I remember there being a utility for that, but I don't remember what it's called.

Maybe dd-ing it to a file as a backup?

[hyc@mastodon.social]

@mcc dd the entire thing to a file, work with the file. There are two FATs on any fat filesystem, the 2nd one might still be intact.

[Gæst]

@mcc@mastodon.social i guess id try using photorec on it? and maybe save a full backup of the entire disk image with ddrescue if its particularly important to me (in this case id take the backup first before anything else)

[lluad@mastodon.ie]

@mcc Image the whole SD to a file, then take a copy of the file and work solely with the copy.

ddrescue may be a good way to make that image, depending on how the SD card has failed.

Then something like TestDisk might help recover files.

[fuzzix@mastodon.ie]

@mcc https://www.cgsecurity.org/wiki/TestDisk used this once to recover an ext4 partition *after* someone had reformatted it as NTFS... YMMV. Good luck!

[jonfr600@mastodon.social]

@mcc This looks like a bad block in the sector of the SD card. It seems that it can only be repaired using Windows.

https://superuser.com/questions/519513/repairing-a-corrupt-exfat-file-system

[jpaskaruk@growers.social]

@mcc I accept the occasional death of an SD card to be the price of doing pleasure.

I also have a hoard of all my broken and way-too-tiny cards because of course I do.

Might be able to fix that worthless 64MB SD someday.

[nicolai@babka.social]

@mcc testdisk and photorec. And make a copy with GNU ddrescue before

[joriki@infosec.exchange]

@mcc

maybe possibly: bootrepair

[lynndotpy@mastodon.social]

@mcc Other advice to make a copy and then use testdisk / photorec are good. But if you haven't checked with a known good card already, maybe the reader / adapter could be an issue too?

[mhoye@cosocial.ca]

@mcc I see that other people have already mentioned them, but the right answer is testdisk/photorec and I've seen them save the day more than a few times.

https://www.cgsecurity.org/wiki/PhotoRec

[realcainmosni@mastodon.me.uk]

@mcc Best you can do is image the device - if it is readable at all - and work with that. Do NOT try to work with the device directly if you can avoid it. Corruption lies in that direction. From now on treat it as read only (which also means not attempting to mount it, again).

[realcainmosni@mastodon.me.uk]

@mcc There are forensic tools which will help make sense of the image if you can get one at all. Binwalk on the image, for starters. A bit overblown for your use case, but there's also Sleuthkit and Autopsy (proper forensic tools, which are great for data recovery, if you have the time and dedication).

[simon@gotosocial.grnwds.uk]

@mcc
TestDisk might work but haven't tried it with exfat. It's very good for Linux filesystems. https://www.cgsecurity.org/wiki/TestDisk_Download

[davep@infosec.exchange]

@mcc This sort of thing but without the live Linux USB?

https://www.thelinuxvault.net/linux-backup-recovery/step-by-step-linux-data-recovery-tutorial/

[davep@infosec.exchange]

@mcc I'd go down straight to the "make an image" bit first.

[spacelifeform@infosec.exchange]

@mcc

Probably tosst. What does fdisk -l /dev/sda report?

[evan@cosocial.ca]

@mcc I've had good results with ddrescue and external drives.

https://www.gnu.org/software/ddrescue/