I use my FAT32 thumbdrive to acquire Ubuntu linux memory, I already have 200 microsoft word files in my thumbdrive
In linux i use command dd if=/dev/mem of=/dev/sdc1, sdc1 is my thumbdrive, after acquirng memory, i insert my thumbdrive into my win7 machine, it said disk can't be recognized, what should be the correct command to acquire memory? thanks
sdc1 is the first partition of the raw block device that is your usb stick. By using that command you have overwritten the FAT32 file-system so that is why your computer no longer recognises it. You'll need to reformat it.
You need to mount the file-system first before trying to write files to it.
'mount /dev/sdc1 /mnt' should work
then command
'dd if=/dev/mem of=/mnt/mem.dd'
You are probably better off using
example LiME command
insmod /mnt/lime.ko "path=/mnt/memory format=lime"
thanks, so any way to recover my 200 word documents? now my thumdriver is in EXt4 formate or other format? windows 7 can't recognize, and linux also can't recognize.
How have you concluded that it is formatted Ext4? If you wrote over the FAT32 partition with a RAM dump then there is no usable file-system… You will only be able to recover some of the 200 word documents if you haven't overwritten them with you RAM dump. Use a file carver.
Use a file carver.
Translated to practice, you may want to try PHOTOREC or DMDE (examples of free tools) on the USB stick.
If you are lucky, you may recover a part of those 200 files, losing the filesystem metadata and their original filename, as long as the files were not originally fragmented.
There are more sophisticated carver tools and approaches, but as a first attempt I would try the above.
Please also consider how it depends on the EXACT format of the word files you are looking for, the .doc format is very different from the .docx format of newer versions of word (which is actually a .zip format) and results/probability of success may vary, particularly in some cases corrupted or incomplete .zip files may be (partially) recovered and in the case of .docx is not uncommon to be able to retrieve the contents (loosing formatting) out of a corrupted file.
jaclaz
thanks, if my original thumbdrive G driver partion is FAT32, and I wrongly dd, it is ext4 (detected by photorec), when i recover,
(1) can i select folder instead of partion G in photorec step1
(2) when it asks me for partion type during recover, should i use fat32 or ext4? i choose ext4, but it recover those linux file into *.txt, file name are lost and also there is no file type *.doc in the last step of recovery.
thus i 'm quite disappointed
1 No.
2 FAT32 (i.e. what the filesystem was before having been - hopefully partially - overwritten)
You have to understand the basics.
BEFORE there was a FAT32 file system.
NOW there is NOT an ext4 file system BUT RATHER a RAW memory dump (i.e. NO filesystem at all)
In any case SURELY the most relevant part of the FAT32 file system (the actual FAT tables) have been overwritten, as they are originally saved at the very beginning of the device.
So the carver PHOTOREC or DMDE or any other won't be able to find
1) allocation of files
2) most probably filenames and metadata (actually they may find some filenames BUT will have no way to "couple" them with the files)
3) ONLY those files that fulfill these two conditions
3.1 were each saved to a contiguous extent
3.2 were not overwritten by the memory dump
Particularly the 3.1 gives "random" probabilities of success depending on the previous use of the stick, how exactly the files were saved to it, etc., etc., and 3.2 might as well mean both all 200 of them or none (0) depending on the size of the memory dump, the size of the word files and the actual location they were originally resident.
As suggested to you on the other thread, READ the
https://
You want to modify File Opt for .doc (or .docx and .zip) files only.
jaclaz