Tool to determine filesystem on removable media

Since you dont know the filesystem that the device is using, and you want to access the files... you should take the "forensic" path. Some random thoughts in NO order:

(The following progs don't need/have installation, except no.4. All progs are free to use.)

1)Go to cgsecurity.org and download the latest version. It can recognize MANY types of partitions. Its a command-line prog. Extract the zip and either run "testdisk_win.exe /list" to see if it recognize your device or just ""testdisk_win.exe" and follow the command-line menus with the cursors. Read the manual from the site before you use it. At any time you think did a bad choice, CTRL-C and rerun it , or close the CMD window. All this will help you recognize the partition (if that is what u r after)

2)From the same zip (see above) there is another prog called "Photorec" (also command line). It uses file-carving techniques. That means that it can find deleted (or not deleted) files based on their file-structure. It might see your device as a "raw" device, and "carve" it to extract all possible files , based on their file-structure

3)Go to accessdata.com and download FTK Imager Lite version 2.9.0 Open FTK Imager -> File -> Add evidence Item -> choose "Physical Drive" -> it should list your device something like "\device_blah". Make sure you don't have other devices connected or if you have, make sure you will recognize them and know which is which. If you see your device there click "Finish" and it will mount your device. From the left part of the screen you can see specs of the device and see and export the files.

4)Go to findandmount.com. The program is called "Partition Find and Mount". Some random lines from the site:

• ...locates and mounts lost partitions in read-only mode, thus allowing you to safely access them with any file manager
• ...finds lost or deleted partitions by scanning the storage device and looking for specific signatures that represent the beginning of a partition
• ...Partition Find and Mount does not rely on the information stored in the Master Boot Record (MBR)
• ...All partitions are mounted in the read-only mode. You won't be able to alter files on such partitions, but only to copy files off that partition. This guarantees that the data cannot be altered by the operating system or any software (including malware).

It might find your partition and mount it as read only. From there you will see your files and extract them.

If you don't find what the partition is or your files... you might want to ask a question at the Forensic Focus Forum. Don't forget to tell us if you had any success and how.

Sorry for the long post :P