[jaclaz]

doniel, on Jun 25 2009, 09:30 PM, said:

Attached - but note:

1) The attachment system didn't like .bin any more than it liked .log, so added .txt to both files.

Really?
Could this connected to this part of the referenced post?:

jaclaz, on May 20 2009, 09:25 PM, said:

Compress the two files in a .zip archive and post it as an attachment, I'll have a look at them.

doniel, on Jun 25 2009, 09:30 PM, said:

2) My system contains 2 physical hard drives, a floppy, and a DVD, and, at the moment, a USB drive is attached. I assumed that the floppy and DVD drives are not included in the chain of physical drives, and that the USB drive is physical drive 2.

It may have been the right choice, but unfortunately, BOTH the files you posted are just a (nice, rounded ) collection of digital 00's.
This could mean EITHER:

• that something went wrong while extracting/copying the sectors/files
  
• that you got the right \\.\Physicaldrive AND the extracting/copying went allright BUT the sectors on the stick are actually all 00's

My guess is that unfortunately it is #2 above, which can be caused by three things:

• partial accidental wiping (of some initial sectors) of the device (not good, but leaving some hopes)
  
• total accidental wiping of the device (bad)
  
• device controller or flash memory malfunctioning (bad)

Can you describe with as much detail as you can remember how this thing happened, if there were previous symptoms of failure, if any particular program was run against the stick, if the stick was EVER attached to an unprotected by antivirus PC, etc.?

Let's try again with a slightly different approach.
Get dsfo (within the DSFOK toolkit):
http://members.ozemail.com.au/~nulifetv/fr...ware/index.html

Open a command prompt and run from the directory where you unzipped dsfo.exe:

dsfo \\.\Physicaldrive2 0 102400 C:\first200.dat

Compress C:\first200.dat to a .zip and attach to your next post the resulting archive.

If you have access to a hosting site of some kind (even a free one like megaupload or rapidshare would do) AND the stick did not contain privete/personal data that I shouldn't see, create a "full" image of the stick (you will need as much available space on your hard disk as the size of the stick + say another half size for the compressed file) by running:

dsfo \\.\Physicaldrive2 0 0 C:\fullima.dat

Compress C:\fullima.dat to a .zip, upload the resulting archive to the filehosting site and send me via PM the download link...

If it's not all 00's some partial recovery may be still possible.

doniel, on Jun 25 2009, 09:30 PM, said:

By the way, you didn't need to provide a link - all you had to do was tell me to scroll to the top of this page!

A link is a link, and generally stays linked
"Relative" addresses, such as "look at top of the page" may change depending on which particular view you are seeing this thread with, and from a number of other reasons.

jaclaz

[doniel]

Sorry. I've been checking several times a day for your reply, but never realized that we'd gone to a page 3. I'll post a proper reply as soon as I can.

Thank you!

[doniel]

Really? Could this connected to this part of the referenced post
Compress the two files in a .zip archive and post it as an attachment

Didn't realize that your request for a zip file was to get around attachment system restrictions.


"Relative" addresses, such as "look at top of the page" may change depending on which particular view you are seeing this thread with, and from a number of other reasons.

Point taken.

first200.zip attached.

Hope to be able to u/l full image. Will let you know. But first, I need an answer from you. Winrar won't let me break up the full image into smaller files in zip format. Do you have a problem with rar format?

Thanks again, jaclaz!

doniel

Attached File(s)

•  FIRST200.zip (237bytes)
  Number of downloads: 2

[jaclaz]

Unfortunately the whole file you sent is made of 00's.

No problem with .rar, the good (or bad) thing is that if the whole image is made of 00's the compressed file will be very, very small.

So, try compressing the image in a "monolithic" .zip or .rar, if the result is very small, it means that it contains mostly 00's, on the other hand, if the resulting archive is "biggish" it means that some data is still there, and then you can re-create it in splitted .rar files.

Is there any chance that the \\.\PhysicalDrive2 may be "wrong"?
I don't think so as if the device does not exist dsfo should throw an error.
Which size is the "full" image (without compression)?
Is it compatible with the "label" size of the stick?
It could be that simply something in the controller or in the flash memory has gone "beserk".

jaclaz

This post has been edited by jaclaz: 30 June 2009 - 03:00 AM

[doniel]

Full image uncompressed is about 7.5 GB. Rar is 4.7 GB. It's going to take me quite some time to u/l. Will let you know as it gets done so that you can d/l it as they get posted.

[jaclaz]

doniel, on Jun 30 2009, 03:09 PM, said:

Full image uncompressed is about 7.5 GB. Rar is 4.7 GB. It's going to take me quite some time to u/l. Will let you know as it gets done so that you can d/l it as they get posted.

the 4.7 GB size of the compressed image is (besides being "huge" ) a good sign that at least some data is still on the stick.

jaclaz

[jaclaz]

Unfortunately it seems like the WHOLE image is made of 00's.

I am scanning it right now, but in about first 2/3 of it I couldn't find but zeroes.

This is NOT "normal".

To get to this condition one of the following cases applies:

• stick has been (accidentally or intentionally) wiped (to wipe a flash memory means writing 00's to it, which for an 8 Gb stick should take several minutes, so you should have noticed it)
  
• stick has been "zapped" or "fried" by some overcurrent or overvoltage (but usually when this happens it is the controller that gets fried, see below)
  
• something is wrong in the hardware (the controller seems OK, as the stick is recognized by Windows, so it should be the actual flash, but if you are lucky it could also be a "real hardware" failure, such as a cold or broken soldering)

I guess that your only remaining thing to try is to "crack" open the stick enclosure and inspect both visually and with a ohmmeter the continuity of tracks and chips's pins.

If this check reveals no problems, depending on the value you attribute to the data on the stick, it may be the case to ask a professional to try and take off the stick the flash and mount it on another (identical) stick/controller.

Of course you can do this attempt by yourself, but managing surface mounted components (as stick chips usually are) is not that easy for a non-expert and with "rudimental" tools, I guess it depends on your manual skills and experience.


jaclaz

P.S.: For the record and for other users, the image once compressed, resulted in a 4.7 Mb file, not as initially posted 4.7 Gb.

This post has been edited by jaclaz: 30 June 2009 - 06:31 PM

[doniel]

I guess that your only remaining thing to try is to "crack" open the stick enclosure and inspect both visually and with a ohmmeter the continuity of tracks and chips's pins.


I tried to pry the cover off using a small flathead screwdriver, with no success. Is it possible to get the cover off without ruining it, or do I need to break it off?

[jaclaz]

doniel, on Jul 1 2009, 11:05 PM, said:

I tried to pry the cover off using a small flathead screwdriver, with no success. Is it possible to get the cover off without ruining it, or do I need to break it off?

It greatly depends on the actual model of the stick, a few are simply two plastic shells that you can separate by using a knife (you will probably break anyway the case, but if you are careful with these it can be re-glued together) some are more "tough" and need to be cut/broken.

jaclaz

[Ludwig Von Cookie Koopa]

I don't know if this is sloved but I am inputting my input.

My USB-pen/stick/flash would do the exact same thing. It would not read on Windows XP, but instead give me a document folder instead. A folder that proclaimed "THE DRIVE IS UNREADABLE". However on my Win98 machine, it would read the drive. When I used it on a Imac machine (white) I was able to read the drive with no problems.

Back on my 98 machine after running Scandisk ( when the drive appeared to have nothing ) it was able to recover disk data. I forget if I did or did not format the disk.

Sometimes when I hook a hardrive to my PC. Especially one that I have not used for ages. It reports a misfire ( whatever) of space. I ran scandisk, and it recovered all my files but left the names with there shorten DOS counterparts.

I could only assume it has something to do with the last computer you used the machine on.

The end result is me getting/finding another USB drive lying around in the street. Since this would occur over and over again when I had to use the USB drive multiuple times, moving from machine to machine.

[wfc569]

Hi Jaclaz,
I just experienced similar problem with my USB stick - not recognized by Window XP. I was wondering if you can shade of light to the issue of my case? I took the 1st step to download the TestDisk and ran some analysis, but my Tech knowledge is not good enough to carry me through by reading you previous postings with other members here. Attached is some screen shot including TestDisk's "Analyse" result.

Many thanks in advance....  Kingston reseult.doc (82K)
Number of downloads: 2

[jaclaz]

wfc569, on 12 October 2012 - 11:22 AM, said:

Hi Jaclaz,
I just experienced similar problem with my USB stick - not recognized by Window XP. I was wondering if you can shade of light to the issue of my case? I took the 1st step to download the TestDisk and ran some analysis, but my Tech knowledge is not good enough to carry me through by reading you previous postings with other members here. Attached is some screen shot including TestDisk's "Analyse" result.

Many thanks in advance.... Kingston reseult.doc

Well, first thing you should make a copy of the stick.
I.e. do what was already suggested in post #11:
http://www.msfn.org/...285#entry858285
(this thread is quite oldish and some tools have changed but that post is still valid)
To identify the \\physicaldrive number open Disk management, the boot disk (the one on which you C:\ normally is) will be disk 0, if you only have the USB stick (besides the bootdisk) it will be disk 1. (if you are in this "standard situation", i.e. without other disks and without one of those multi-card reader, the stick wiil be disk 1)
Disk manager may (please read as will) ask you to "initialize the disk" (because of the missing 0x55AA), DO NOT let it do this.
http://reboot.pro/12253/#entry106759

Or you could use datarescuedd, which is GUI and easier to use:
http://www.datarescu...cue/v3/drdd.htm
then use the dsfo to extract first 100 sectors (supposing the "full" stick image is C:\mystick.img

dsfo C:\mystick.img 0 51200 C:\USB_100.img

compress C:\USB_100.img in a .zip file and attach it to your next post.

Once you have the image and posted the initial snippet, will see what we can do.

jaclaz

This post has been edited by jaclaz: 12 October 2012 - 12:02 PM

[wfc569]

Hi Jaclaz ,

Many thx for such a quick response. It took me a while to read through thread #11 carefully and thought I have done the necessary steps to get the information you were asking for..... Here is info:

USB_full.img => OK, 1817706496 bytes, 713453s, MD5 = b7897877209b4aab1cb4b93d1e13695b
USB_100.img => OK, 51200 bytes, 0.016s, MD5 = b1a956465d6ff0119d74710c550f8789

I also attached 2 files here.

Many thx for taking time walk me through this process!!

Attached File(s)

•  DSFO running result.doc (47K)
  Number of downloads: 4
•  DSFO result.zip (952bytes)
  Number of downloads: 2

[jaclaz]

wfc569, on 12 October 2012 - 12:59 PM, said:

Many thx for taking time walk me through this process!!

You are welcome.
The issue here is that the file you posted is NOTHING like it should be.

I will (exceptionally for you) take my crystal ball out of it's (dark red) velvet wrapping and tell you what I can see in it :

• you bought a largish (let's say 16 or 32 Gb) stick on e-bay or however on the Internet and not in a shop
  
• you payed for it a very convenient price
  
• you used the stick for some time without any issue, until one day (possibly today) you copied to it a few files - likely some .pdf's and .xls's and filled it up above around 2Gb
  
• suddenlly you cannot access it anymore

Let me know how much of the above is correct and (this is the MAIN thing) approximately how big (roughly) were in total the set of files that you copied to it just before it wasn't anymore accessible.

jaclaz

[wfc569]

HaaaHaaa... You are right on most counts.... I bought this stick a long long while back and have been using it to back up my files. recently, I just re-did my PC at home so I backed up some more files but didn't paying attention to the space left. i guess i over stuffed my stick this time so it decided to strike on me...

Is there a way to get my data back?

[wfc569]

The last time I was able to save down the file to this USB stick was last Friday for my work file. Its about 19 MB. Then, I was not able to see the data after I tried to use it again this Tuesday...

[jaclaz]

wfc569, on 12 October 2012 - 01:22 PM, said:

Is there a way to get my data back?

Yes and no.
What happens, if it is one of the "fake" sticks I was referring to, is that data copied to it (once the "real" capacity of the stick is reached) "wraps around", overwriting the initial part of the stick.
Since this area (initial part of a - I presume - FAT32 formatted) stick holds the FAT tables, it greatly depends on two factors:

• how big were the original FAT tables
  
• how many data has been copied to the stick "beyond" it's real size

which sums up on "how many of the FAT tables is still there".

There is still anyway the possibility to recover some data as "files" (i.e. recover not the filesystem but only it's contents), you will get most of the data (losing the filenames) unless there is "heavy" defragmentation.

Without further data (what were the contents, wif you have only a few files that you are interested in, how big was the last copy operation on the stick) cannot say more about the suggested way to proceed.

jaclaz

[wfc569]

I used online free software to recover most of my JPEG and MP3 or M4 music files so that portion of the file is not a big deal. Yeah i lost the file names, and dates but still better than not able to recover them at all. Now, my urgent goal is to find a way to recover my non JPEG and non music files. If you know a way to recover them, would really appreciate your thought on this...

[jaclaz]

wfc569, on 12 October 2012 - 01:52 PM, said:

I used online free software to recover most of my JPEG and MP3 or M4 music files so that portion of the file is not a big deal. Yeah i lost the file names, and dates but still better than not able to recover them at all. Now, my urgent goal is to find a way to recover my non JPEG and non music files. If you know a way to recover them, would really appreciate your thought on this...

Well, try using PHOTOREC ("companion" of TESTDISK):
http://www.cgsecurit...g/wiki/PhotoRec
apart the name, it will attempt to recover *any* file.
Photorec attempts to determine the file type, in some cases it may get the "wrong type" (and consequently the file may not open properly or be not recognized by the "appropriate" software.

A good idea would be to re-scan the recovered files with TRiD:
http://mark0.net/soft-trid-e.html
which has a more accurate "detection" engine.

About filenames, consider that most "office" files do have some "metadata" that normally include the filename with which they were saved.
If the filenames are important, you can scan them with a suitable program and recover this "metadata" (how exactly depends on the exact file types)

Roughly, and on "Gb size" of the filesystem (FAT32), there are 2 sectors of FAT per MB.
So, if the stick was "labeled" as 8 Gb, the beginning of 2nd copy of the FAT tables was likely around sector 16000, if it was 16 Gb, around sector 32000 and if 32 GB around sector 64000, which means that (in the hypothesis that you were actually very near the real physical size of the stick and what happened was a "wrap-around" of the 19 Mb), if the stick was 32 Gb, the second copy should be "intact", if 16 Gb it is "likely", if it was 8Gb there are very little or no chances.

Having a look at the the image with Dmde:
http://softdm.com/
won't do anyway any harm.

jaclaz

[wfc569]

Many thanks. I will take some time to look into what you suggested and keep you post on the progress.