How can I get hidden files from an external device with terminal?

Question

Level 1

0 points

How can I get hidden files from an external device with terminal?

Here is my situation. I have an mp3 player that is a Sansa Clipp. This version has third party firmware installed that not only hides the music files but will not let me copy them at all when I do a straight copy. All I get are empty folders. I want to install the actual firmware but first I need to back up the entire contents of the device because essentially I need to wipe the malicious firmware and everything else off the disc in order to to this. This device came from the Bureau of Prisons and is sold to prisoners. It is basically locked to the hilt and the only way to unlock it officially is to send it to the third party that installed the firmware and pay them $25. I know that I should be able to use terminal to get the files off of this but so far a "cp" command has only given me the files that I get when I drag and drop. The music files seem to be hidden in a partition that I can't access. Let me know if anyone has any help they can give. I just need to back up the full contents of the device. I have instructions on how to wipe it and reinstall but backing up is crucial to this. Thanks for any help and please ask questions if I haven't made my problem clear enough.

iMac, OS X Mavericks (10.9.5)

Posted on Mar 24, 2015 5:33 PM

Reply

Answer 1

rccharles

Level 6

12,957 points

Mar 25, 2015 1:59 PM in response to mbk23

The dd command will back up at the block level. backup at the device level not the partition level.

dd if=/dev/disk0s10 bs=4096 | gzip | dd of=~/disk0-s10 bs=4096

dd if=~/disk0-s10 bs=4096 | gunzip | dd of=/dev/disk0s10 bs=4096

Reply

Answer 2

mbk23 Author

Level 1

0 points

Mar 25, 2015 4:53 PM in response to rccharles

Thank you for the advice. I am trying the dd command but I am not all to experienced with the terminal so I really would appreciate it if you explained it to me like I am five. Thanks if you can.

Reply

Answer 3

rccharles

Level 6

12,957 points

Mar 26, 2015 3:00 PM in response to mbk23

I have know way of knowing whether or not this will copy the data. The device could have some hidden hand-shack.

I assume the Sansa Clipp is a usb connected device. The method works for a flash drive. There is a different method for a harddrive..

First, you need to find the name of the device. Mount the device.

/Applications/Utilities/Terminal.

# run the df command. type command then press return.

mac $ df -h
Filesystem                Size   Used  Avail Capacity  Mounted on
/dev/disk1s16             272G   259G    12G    95%    /
devfs                     113K   113K     0B   100%    /dev
fdesc                     1.0K   1.0K     0B   100%    /dev
<volfs>                   512K   512K     0B   100%    /.vol
automount -nsl [217]        0B     0B     0B   100%    /Network
automount -fstab [222]      0B     0B     0B   100%    /automount/Servers
automount -static [222]     0B     0B     0B   100%    /automount/static
/dev/disk1s10             500G   302G   197G    60%    /Volumes/ServiceRepairManuals
/dev/disk1s14              80G    50G    30G    62%    /Volumes/Second-80
/dev/disk2s1              446M    15M   431M     3%    /Volumes/2partitions
/dev/disk2s2               46M   9.0M    37M    20%    /Volumes/second-disk
mac $ # unmount disk by dragging to trash can.
mac $ df -h
Filesystem                Size   Used  Avail Capacity  Mounted on
/dev/disk1s16             272G   259G    12G    95%    /
devfs                     112K   112K     0B   100%    /dev
fdesc                     1.0K   1.0K     0B   100%    /dev
<volfs>                   512K   512K     0B   100%    /.vol
automount -nsl [217]        0B     0B     0B   100%    /Network
automount -fstab [222]      0B     0B     0B   100%    /automount/Servers
automount -static [222]     0B     0B     0B   100%    /automount/static
/dev/disk1s10             500G   302G   197G    60%    /Volumes/ServiceRepairManuals
/dev/disk1s14              80G    50G    30G    62%    /Volumes/Second-80
mac $ # figure out the name of the device.
mac $ # see what dev disappeared.
mac $ # in this case the unix names of the partitions are: /dev/disk2s1 & dev/disk2s2
mac $ # the device, flash name, is /dev/disk2
mac $ # pull out the device from it's usb port.  Plug it back in.
mac $ df -h
Filesystem                Size   Used  Avail Capacity  Mounted on
/dev/disk1s16             272G   259G    12G    95%    /
devfs                     113K   113K     0B   100%    /dev
fdesc                     1.0K   1.0K     0B   100%    /dev
<volfs>                   512K   512K     0B   100%    /.vol
automount -nsl [217]        0B     0B     0B   100%    /Network
automount -fstab [222]      0B     0B     0B   100%    /automount/Servers
automount -static [222]     0B     0B     0B   100%    /automount/static
/dev/disk1s10             500G   302G   197G    60%    /Volumes/ServiceRepairManuals
/dev/disk1s14              80G    50G    30G    62%    /Volumes/Second-80
/dev/disk2s1              446M    15M   431M     3%    /Volumes/2partitions
/dev/disk2s2               46M   9.0M    37M    20%    /Volumes/second-disk

mac $ dd if=/dev/disk2 bs=4096 | gzip | dd of=~/disk2-s1-2 bs=4096
dd: /dev/disk2: No such file or directory
0+1 records in
0+1 records out
20 bytes transferred in 0.014734 secs (1357 bytes/sec)
mac $

Reply

Answer 4

mbk23 Author

Level 1

0 points

Mar 26, 2015 3:17 PM in response to rccharles

I know the name of it. It is USB. It comes up as:

/dev/disk2

15432224 1411632 14020592

10%

0

0 100% /Volumes/SANSA CLIPP

Reply

Answer 5

rccharles

Level 6

12,957 points

Mar 26, 2015 3:48 PM in response to mbk23

Well then, it would be best if you were not using the device when making a copy.

dd if=/dev/disk2 bs=4096 | gzip | dd of=~/disk2-s1-2 bs=4096

if=/dev/disk2 is the input name

bs=4096 is block size to speed up the process.

| pipe output to next command.

gzip to compress the data

of=~/disk2-s1-2 output file name. ~ place data in your home folder with name disk2-s1-2

Reply

Answer 6

mbk23 Author

Level 1

0 points

Mar 26, 2015 4:01 PM in response to rccharles

dd: /dev/disk2: Permission denied

0+2 records in

0+2 records out

20 bytes transferred in 0.015354 secs (1303 bytes/sec)

looks like this firmware is a beast

btw, I can't use the device. I am locked out of it because it was a requirement to revalidate it using an internal network at the B.O.P. every 14 days. That ran out months ago. I know I could use a third party application to back it up but the problem there is I am at a university and do not have administrative access to install such an application. That is why I was hoping I could somehow back up the hidden partition using the terminal. Thank you for your help.

Reply

Answer 7

rccharles

Level 6

12,957 points

Mar 26, 2015 4:15 PM in response to mbk23

Well, that means the dd command could not access the device. Typically, that means someone is using the device. Try unmounting the device. Drag the device to the trash can or umount /dev/disks2 notice the missing letter n.

or

sudo dd if=/dev/disk2 bs=4096 | gzip | dd of=~/disk2-s1-2 bs=4096

enter your admin password. no letters will display. press return when done.

Reply

Answer 8

mbk23 Author

Level 1

0 points

Mar 26, 2015 4:36 PM in response to rccharles

I tried to unmount by dragging to trash. then I get

dd: /dev/disk2: No such file or directory

0+2 records in

0+2 records out

20 bytes transferred in 0.000243 secs (82322 bytes/sec)

when I do the umount /dev/disks2

I get

umount: /dev/disks2: not currently mounted

I do not have administrative access. I am at a university computer lab.

Reply

Answer 9

rccharles

Level 6

12,957 points

Mar 26, 2015 8:07 PM in response to mbk23

You should be able to install apps on your own flash drive. Like carbon copy cloner. Mac OS x allows most apps to be anywhere.

I tried to unmount by dragging to trash. then I get

dd: /dev/disk2: No such file or directory

0+2 records in

0+2 records out

20 bytes transferred in 0.000243 secs (82322 bytes/sec)

You need to use the hardware port address. I do not know how to find. Your in an area where using sudo comes in handy. Have you tried booting Linux off of a usb stick?

hear is an article on the problem.

http://stackoverflow.com/questions/11784248/mac-os-analog-to-dev-ttyusbxx

Reply