Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account



Photo

USB Access Problem

- - - - -

  • Please log in to reply
81 replies to this topic

#51
wfc569

wfc569

    Newbie

  • Member
  • 19 posts
  • Joined 12-October 12
  • OS:XP Home
  • Country: Country Flag
Hi Jaclaz,
I just experienced similar problem with my USB stick - not recognized by Window XP. I was wondering if you can shade of light to the issue of my case? I took the 1st step to download the TestDisk and ran some analysis, but my Tech knowledge is not good enough to carry me through by reading you previous postings with other members here. Attached is some screen shot including TestDisk's "Analyse" result.

Many thanks in advance....Attached File  Kingston reseult.doc   82KB   3 downloads


How to remove advertisement from MSFN

#52
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,562 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

Hi Jaclaz,
I just experienced similar problem with my USB stick - not recognized by Window XP. I was wondering if you can shade of light to the issue of my case? I took the 1st step to download the TestDisk and ran some analysis, but my Tech knowledge is not good enough to carry me through by reading you previous postings with other members here. Attached is some screen shot including TestDisk's "Analyse" result.

Many thanks in advance....Attached File  Kingston reseult.doc   82KB   3 downloads

Well, first thing you should make a copy of the stick.
I.e. do what was already suggested in post #11:
http://www.msfn.org/...285#entry858285
(this thread is quite oldish and some tools have changed but that post is still valid)
To identify the \\physicaldrive number open Disk management, the boot disk (the one on which you C:\ normally is) will be disk 0, if you only have the USB stick (besides the bootdisk) it will be disk 1. (if you are in this "standard situation", i.e. without other disks and without one of those multi-card reader, the stick wiil be disk 1)
Disk manager may (please read as will) ask you to "initialize the disk" (because of the missing 0x55AA), DO NOT let it do this.
http://reboot.pro/12253/#entry106759

Or you could use datarescuedd, which is GUI and easier to use:
http://www.datarescu...cue/v3/drdd.htm
then use the dsfo to extract first 100 sectors (supposing the "full" stick image is C:\mystick.img
dsfo C:\mystick.img 0 51200 C:\USB_100.img
compress C:\USB_100.img in a .zip file and attach it to your next post.

Once you have the image and posted the initial snippet, will see what we can do.

jaclaz

Edited by jaclaz, 12 October 2012 - 12:02 PM.


#53
wfc569

wfc569

    Newbie

  • Member
  • 19 posts
  • Joined 12-October 12
  • OS:XP Home
  • Country: Country Flag
Hi Jaclaz ,

Many thx for such a quick response. It took me a while to read through thread #11 carefully and thought I have done the necessary steps to get the information you were asking for..... Here is info:

USB_full.img => OK, 1817706496 bytes, 713453s, MD5 = b7897877209b4aab1cb4b93d1e13695b
USB_100.img => OK, 51200 bytes, 0.016s, MD5 = b1a956465d6ff0119d74710c550f8789

I also attached 2 files here.

Many thx for taking time walk me through this process!!

Attached Files



#54
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,562 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

Many thx for taking time walk me through this process!!

You are welcome.
The issue here is that the file you posted is NOTHING like it should be. :(

I will (exceptionally for you) take my crystal ball out of it's (dark red) velvet wrapping and tell you what I can see in it ::w00t:
  • you bought a largish (let's say 16 or 32 Gb) stick on e-bay or however on the Internet and not in a shop :unsure:
  • you payed for it a very convenient price :thumbup
  • you used the stick for some time without any issue, until one day (possibly today) you copied to it a few files - likely some .pdf's and .xls's and filled it up above around 2Gb :yes:
  • suddenlly you cannot access it anymore :ph34r:

Let me know how much of the above is correct and (this is the MAIN thing) approximately how big (roughly) were in total the set of files that you copied to it just before it wasn't anymore accessible.

jaclaz

#55
wfc569

wfc569

    Newbie

  • Member
  • 19 posts
  • Joined 12-October 12
  • OS:XP Home
  • Country: Country Flag
HaaaHaaa... You are right on most counts.... I bought this stick a long long while back and have been using it to back up my files. recently, I just re-did my PC at home so I backed up some more files but didn't paying attention to the space left. i guess i over stuffed my stick this time so it decided to strike on me...

Is there a way to get my data back?

#56
wfc569

wfc569

    Newbie

  • Member
  • 19 posts
  • Joined 12-October 12
  • OS:XP Home
  • Country: Country Flag
The last time I was able to save down the file to this USB stick was last Friday for my work file. Its about 19 MB. Then, I was not able to see the data after I tried to use it again this Tuesday...

#57
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,562 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

Is there a way to get my data back?

Yes and no.
What happens, if it is one of the "fake" sticks I was referring to, is that data copied to it (once the "real" capacity of the stick is reached) "wraps around", overwriting the initial part of the stick.
Since this area (initial part of a - I presume - FAT32 formatted) stick holds the FAT tables, it greatly depends on two factors:
  • how big were the original FAT tables
  • how many data has been copied to the stick "beyond" it's real size
which sums up on "how many of the FAT tables is still there".

There is still anyway the possibility to recover some data as "files" (i.e. recover not the filesystem but only it's contents), you will get most of the data (losing the filenames) unless there is "heavy" defragmentation.

Without further data (what were the contents, wif you have only a few files that you are interested in, how big was the last copy operation on the stick) cannot say more about the suggested way to proceed.

jaclaz

#58
wfc569

wfc569

    Newbie

  • Member
  • 19 posts
  • Joined 12-October 12
  • OS:XP Home
  • Country: Country Flag
I used online free software to recover most of my JPEG and MP3 or M4 music files so that portion of the file is not a big deal. Yeah i lost the file names, and dates but still better than not able to recover them at all. Now, my urgent goal is to find a way to recover my non JPEG and non music files. If you know a way to recover them, would really appreciate your thought on this...

#59
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,562 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

I used online free software to recover most of my JPEG and MP3 or M4 music files so that portion of the file is not a big deal. Yeah i lost the file names, and dates but still better than not able to recover them at all. Now, my urgent goal is to find a way to recover my non JPEG and non music files. If you know a way to recover them, would really appreciate your thought on this...

Well, try using PHOTOREC ("companion" of TESTDISK):
http://www.cgsecurit...g/wiki/PhotoRec
apart the name, it will attempt to recover *any* file.
Photorec attempts to determine the file type, in some cases it may get the "wrong type" (and consequently the file may not open properly or be not recognized by the "appropriate" software.

A good idea would be to re-scan the recovered files with TRiD:
http://mark0.net/soft-trid-e.html
which has a more accurate "detection" engine.

About filenames, consider that most "office" files do have some "metadata" that normally include the filename with which they were saved.
If the filenames are important, you can scan them with a suitable program and recover this "metadata" (how exactly depends on the exact file types)

Roughly, and on "Gb size" of the filesystem (FAT32), there are 2 sectors of FAT per MB.
So, if the stick was "labeled" as 8 Gb, the beginning of 2nd copy of the FAT tables was likely around sector 16000, if it was 16 Gb, around sector 32000 and if 32 GB around sector 64000, which means that (in the hypothesis that you were actually very near the real physical size of the stick and what happened was a "wrap-around" of the 19 Mb), if the stick was 32 Gb, the second copy should be "intact", if 16 Gb it is "likely", if it was 8Gb there are very little or no chances.

Having a look at the the image with Dmde:
http://softdm.com/
won't do anyway any harm.

jaclaz

#60
wfc569

wfc569

    Newbie

  • Member
  • 19 posts
  • Joined 12-October 12
  • OS:XP Home
  • Country: Country Flag
Many thanks. I will take some time to look into what you suggested and keep you post on the progress.

#61
wfc569

wfc569

    Newbie

  • Member
  • 19 posts
  • Joined 12-October 12
  • OS:XP Home
  • Country: Country Flag
hi jaclaz,

I used DMDE to seach the USB_Full. img from DSFO running result and was able to see the directory tree of my USB stick. I try to recover one file as example but ran into some situation here. I have attached the screen shot for your review. The Excel file was recovered but didn't seem to be able to open normally. My initial guess is that this file is damaged and can not be recovered. However, I still have some tiny hope deep down to seek expert opinion and hope there is a way to get the file back in tack. Really appreciate your input on this issue....

Attached Files



#62
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,562 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

hi jaclaz,

I used DMDE to seach the USB_Full. img from DSFO running result and was able to see the directory tree of my USB stick. I try to recover one file as example but ran into some situation here. I have attached the screen shot for your review. The Excel file was recovered but didn't seem to be able to open normally. My initial guess is that this file is damaged and can not be recovered. However, I still have some tiny hope deep down to seek expert opinion and hope there is a way to get the file back in tack. Really appreciate your input on this issue....


Well, the good news are that seemingly DMDE managed to either find a "sound" or "almost sound" second copy of the FAT :unsure: or more likely some "good" directory entries.
Of course this does not means that *all* files will be recoverable (or that they will be recovered without further processing.

Trying one file is not a "senceful" way to proceed, in the sense that you cannot get any conclusion from a single specimen, for all we know you might have been "unlucky" (please read as "very lucky" :w00t: ) and that particular file may be the ONLY one damaged....

As a matter of fact, due to the hypothized "wrap around issue", the most "recent" files are those that are mre likely to be damaged.

In this cases - besides the fact that some knowledge of the way filesystems (and "recovery tools") work - the approach is usually a "negative" one, once you have recovered all possible files, you do a map of the actual clusters used by them, then see if "the rest" do contain bits and pieces of the "still missing" ones and see if you can "re-assemble them" or at least get the data from them.

That particular Excel file is particularly big, depending on the way it has been originally copied/saved to the stick, it is likely to be fragmented.
It seemingly starts on a "early" cluster, that could mean that it have been saved there when it was smaller and later updated (growing in size and possibly "wrapping around").

There are tools (I don't think that Freeware ones exist, though) capable of (sometimes) recovering the contents from a damaged Excel (.xls format) files, they actually get the values (and not the formulas) and need anyway some manual work to "fill the gaps".

However I see that the DMDE is on sector 16 which cannot possibly be an actual root directory, since it is identical to sector 0, these are evidently "parts" of the root written "in the wrong place" due to the issue.

Let's do another thing (I still miss the info about the original capacity of the stick).

Roughly, and on "Gb size" of the filesystem (FAT32), there are 2 sectors of FAT per MB.
So, if the stick was "labeled" as 8 Gb, the beginning of 2nd copy of the FAT tables was likely around sector 16000, if it was 16 Gb, around sector 32000 and if 32 GB around sector 64000, which means that (in the hypothesis that you were actually very near the real physical size of the stick and what happened was a "wrap-around" of the 19 Mb), if the stick was 32 Gb, the second copy should be "intact", if 16 Gb it is "likely", if it was 8Gb there are very little or no chances.

If it was 8 Gb, extract from the image first 2*16000+2000=34000*512=17408000 bytes from the "whole" image, zip the result, upload to a free hosting site and PM me the link.
You can do the math allright in case of other sizes.

jaclaz

#63
wfc569

wfc569

    Newbie

  • Member
  • 19 posts
  • Joined 12-October 12
  • OS:XP Home
  • Country: Country Flag
Hi Jaclaz,

I also included the DMDE run stats here. Secondly, I have to apologize not getting you the information you have been asking.... because I was not sure I understood what you meant in the first first place. Now, I gotta ask this silly question on how to extract part of the file from while image file result in "USB_full.img". My USB stick is 2 GB so I figure i need to get 2 x 4,000 + 2,000 = 10,000 x 512 = 5,120,000 bytes from the "USB_full.img" file. thanks

Attached Files



#64
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,562 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

Hi Jaclaz,

I also included the DMDE run stats here. Secondly, I have to apologize not getting you the information you have been asking.... because I was not sure I understood what you meant in the first first place. Now, I gotta ask this silly question on how to extract part of the file from while image file result in "USB_full.img". My USB stick is 2 GB so I figure i need to get 2 x 4,000 + 2,000 = 10,000 x 512 = 5,120,000 bytes from the "USB_full.img" file. thanks

Well, then most of what I have seen in my crystal ball was wroong after all. :ph34r:

Seriously, I was making the hypothesis that you had a "fake" USB stick, i.e. one bought as being (you choose) either 4, 8, 16, 32 or 64 Gb BUT being actually a 2 Gb stick "tricked" into showing as a bigger capacity device.
If you bought that stick as being a 2 Gb one and it is actually a 2 Gb one (dsfo produced a 1817706496 bytes file, which could be more or less "right") the reason of the filesystem corruption may lie "somewhere else".

Yes, once I get the "larger" snippet, the "DMDE stat" data you posted might be useful. :)

Do you remember if you used that stick "as is" (or re-formatted it with the standard XP/whatever "standard" format command) or if you ever ran on it such tools as "HP USB disk utility" or any similar software that creates a MBR and partition table on it?

Now, how you could have gotten the 51200 bytes?
http://www.msfn.org/...ost__p__1014548

then use the dsfo to extract first 100 sectors (supposing the "full" stick image is C:\mystick.img

dsfo C:\mystick.img 0 51200 C:\USB_100.img
compress C:\USB_100.img in a .zip file and attach it to your next post.


if you use the same approach writing 5120000 instead of 51200 (and calling the resulting file C:\USB_10000.img) what would be the result? ;)

Besides posting the above file (if I will need a bigger one I will tell you), can you try running ChipGenius on the stick and post results:
http://reboot.pro/4661/
(just to understand what is "inside" the stick)


jaclaz

#65
wfc569

wfc569

    Newbie

  • Member
  • 19 posts
  • Joined 12-October 12
  • OS:XP Home
  • Country: Country Flag
pls bear with me.... I think i got it by doing the following

dsfo \\.\physicaldrive 0 5120000 c:\dsfok\usb_10000.img

I never had a file uploaded to a free host site so i need to create one. will post the link here once i have that set up

thanks

#66
wfc569

wfc569

    Newbie

  • Member
  • 19 posts
  • Joined 12-October 12
  • OS:XP Home
  • Country: Country Flag
Here is the info from ChipGenius:

Description: [F:]USB Mass Storage Device(Kingston DataTraveler II+)
Device Type: Mass Storage Device

Protocal Version: USB 2.00
Current Speed: High Speed
Max Current: 200mA

USB Device ID: VID = 0951 PID = 1601
Serial Number: 5B6B1A291319

Device Vendor: Kingston
Device Name: DataTraveler II+
Device Revision: 0100

Manufacturer: Kingston
Product Model: DataTraveler II+
Product Revision: PMAP

Chip Vendor: Phison
Chip Part-Number: PS2251-54(PS2154) - F/W 03.00.10 [2005-09-06]
Flash ID Code: ECD35195 - Samsung [SLC-2K]

#67
wfc569

wfc569

    Newbie

  • Member
  • 19 posts
  • Joined 12-October 12
  • OS:XP Home
  • Country: Country Flag
I bought this 2 GB Kingston USB stick many many years ago, maybe 2001 or so. I am not a serious data end user so I thought its enough for me to back up some data. I don't remember how I format the USB stick to be honest. I got it working when I purchased it from Amazon. My home PC has been running NTFS format all these yrs until recently I had to re-build my PC. I vaguely remember that the Window XP ask my if I want to use NTFS or NTFS (express or something like that). After I got my PC rebuilt, I didn't use my USB stick right away until last week when I needed to do some work related from home. When I put my stick into the USB drive, that's when i notice I can not access the data inside the USB stick.

I hope this brief operational history may shade some light what I did wrong.....

#68
wfc569

wfc569

    Newbie

  • Member
  • 19 posts
  • Joined 12-October 12
  • OS:XP Home
  • Country: Country Flag
do you have a free hosting web site to suggest? I tried Mozy, but it is taking forever to do the 1st back up....

#69
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,562 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

pls bear with me.... I think i got it by doing the following

dsfo \\.\physicaldrive 0 5120000 c:\dsfok\usb_10000.img


NO. (meaning that if you used \\.\physicaldrive1 then you got it (maybe).
I mean if the stick is still functional, the idea of making an image is that you use the image (of copies of it) and leave the stick alone.
But i'ts Ok as well in this case, since you don't have issues mounting/accessing the device.
Since you do have an image (the C:\dsfok\USB_full.img), you could have used it as source for dsfo instead of the actual stick/physicaldrive.

The stick sounds a lot like being bought in 2005 or 2006:

F/W 03.00.10 [2005-09-06]

in 2001 a 2 Gb stick probably didn't actually exist (or it was at a "crazy price" :ph34r: ), a common sizes in 2003 were 128/256/512 Mb, a 1 Gb sick was "huge", see history of Netac for year 2001:
http://www.netac.com...ac-Histroy.aspx
or date first available here:
http://www.amazon.co...B/dp/B000AV14M2

You did nothing "wrong" :), the stupid stick *somehow* had an issue, you are perfectly innocent, sometime it is just the actual stick "inside" /controller or flash memory), sometimes a "quirk" in the mounting/unmounting/writing to it of the OS, sometime is not using the "Safely remove" tray icon or however not properly flushing the write cache....

jaclaz

P.S.: Try Zshare:
http://www2.zshare.ma/

Edited by jaclaz, 15 October 2012 - 12:21 PM.


#70
wfc569

wfc569

    Newbie

  • Member
  • 19 posts
  • Joined 12-October 12
  • OS:XP Home
  • Country: Country Flag
hi Jaclaz,

I have posted the file via the link below for that 2 GB

http://www.filefacto...p/5nwpeox3z7az/

May I trouble you be a bit more specific what larger DMDE stat data you are looking? I will try to get that information over for your diagnostics.


Yes, once I get the "larger" snippet, the "DMDE stat" data you posted might be useful. :)


thanks

#71
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,562 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

hi Jaclaz,

I have posted the file via the link below for that 2 GB

http://www.filefacto...p/5nwpeox3z7az/

May I trouble you be a bit more specific what larger DMDE stat data you are looking? I will try to get that information over for your diagnostics.


Yes, once I get the "larger" snippet, the "DMDE stat" data you posted might be useful. :)


thanks

Got it. :thumbup
I'll have a look.

Sorry, misunderstanding, the "stats" you already posted are useful to examine the usb_10000.img (larger snippet) they were/are unuseful with just the usb_100.img (smaller snippet).

jaclaz

#72
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,562 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag
I have some good news :).

The thingy was originally formatted as FAT16 (not as FAT32) with a cluster size of 64 sectors/32 Kb.
What actually happened remains a mistery, both copies of the FAT tables are lost forever, but I managed to re-build a bootsector (with *valid* data) and two empty FATs that are enough to let DMDE (or TESTDISK) see the WHOLE root directory (and hopefully link to the contents of the subdirectory).
Still you won't be able to recover undamaged any file that was fragmented, and further recovery (in any case a partial one) can be possible only operating manually (a longish and "dirty" - in the sense of frustrating - job).

Instructions:
  • you have an image of the stick "as is" in C:\dsfok\usb_full.img
  • make a COPY of it as c:\dsfok\usb_full_fixed.img
  • unzip the attached to c:\dsfok\ (C:\dsfok\usb_500_patch.img)
  • open a command prompt and in it do:
    dsfi c:\dsfok\usb_full_fixed.img 0 0 C:\dsfok\usb_500_patch.img
  • use DMDE to access the image c:\dsfok\usb_full_fixed.img
  • alternatively you can use TESTDISK

When using testdisk:
Open a command prompt and navigate to the directory where you have testdisk, actual executable should be testdisk_win.exe, issue:
testdisk_win.exe /log c:\dsfok\usb_full_fixed.img
then (in the testdisk UI):
  • Proceed
  • None
  • Advanced
  • Boot
  • List
(then use "c" to attempt copying files)
OR:
  • Proceed
  • None
  • Analyse
  • Quick Search
  • P
(then use "c" to attempt copying files)

jaclaz

Attached Files



#73
wfc569

wfc569

    Newbie

  • Member
  • 19 posts
  • Joined 12-October 12
  • OS:XP Home
  • Country: Country Flag
Many thx, Jaclaz.... I will spend some good amount of time going through the instruction carefully and see if I get get to the final step. I'll let you know the process from my end. Again, many thanks for all the suggestions...

#74
wfc569

wfc569

    Newbie

  • Member
  • 19 posts
  • Joined 12-October 12
  • OS:XP Home
  • Country: Country Flag
Hi Jaclaz,

I have attached some screen shots with some comments and questions for you on the instruction you posted earlier. Hope these screen shots will yield some suggestions how to proceed for the next step.

thanks

Attached Files



#75
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,562 posts
  • Joined 23-July 04
  • OS:none specified
  • Country: Country Flag

*** For those marked with “X”, does that mean those files are corrupted and can not be retrieved?

Yes, and No, those are deleted files, these cannot normally be recovered or - as a matter of fact - only the "last written of them" may.

if you watch accurately on the right, you will see how most of them "share" the same cluster beginning address.



When I tried to recover “Yahoo v Impulse System.xls” file from DMDE, I got the following message when trying to open it in Excel.

Yes, I understand this, the file is (was) evidently fragmented.

Is there a way to fix “selected” file(s)?

There is rarely a definite answer when we are talking of data recovery, maybe yes/maybe no.

Maybe it will require very tedious manual operation here…..

Yes and no, it depends by such a big number of factors that it is really difficult whether one of the (Commercial) specialised tools might be able to do some magic.
In DMDE, if you check the entry for “Yahoo v Impulse System.xls” you will see how it begins (maybe) on cluster 371 (filesize 8909312 243.09.2012 16:36), BUT if you scroll down a bit, you will see that you have an entry for a (deleted) “Yahoo v Impulse System.xls~RF1c4f8a1.TMP” that begins on cluster 331 (filesize 8909312 243.09.2012 16:36).
Since we have clusters sized 32,768 bytes, a file 8909312/32768=271,89.. will occupy 272 clusters and thus it is evident a "superimposing".
If you go:
Tools->Update Custer maps
Tools->Cluster Map
then you start "navigating" the "bottom window", (with cursor keys) you will see how clusters from 331 to 370 are not allocated, (and thus may contain the "beginning" of the excel file), if you continue (right cursor arrow) up to vcn 271 and go beyond it over vcn 272, you see that the filename changes, BUT if you go "backwards" (left cursor arrow) you will notice how the "same" area is now linked to "other files".

If there is a way of doing that, do you recommend I should seek a professional assistance in the US?

It depends on how much you value those data.
Without any actual guarantee of recovering the whole file (or even anything more than "bits and pieces") we are talking of hundreds of US$, since there are some (I presume) earlier versions of that file - and depending on the actual contents of the file - in some case is possible to "combine" data or as said earlier extract values and re-use formulas from an older copy.


jaclaz




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users