• Announcements

    • xper

      MSFN Sponsorship and AdBlockers!   07/10/2016

      Dear members, MSFN is made available via subscriptions, donations and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. Alternatively, become a site sponsor and ads will be disabled automatically and by subscribing you get other sponsor benefits.
Sign in to follow this  
Followers 0
lastwraith

8GB Flash drive corruption due to unsafe removal - recovery?

7 posts in this topic

Hi all,

I was hoping to get some help attempting to recover a flash drive.

PROBLEM: According to the owner, the flash drive was inserted in a Mac and was having data written to it when it was removed without properly being prepared for removal. Now every time it is inserted into a computer, Windows asks to please insert a disk into drive (drive letter). In Windows disk management, it shows up as a drive letter but the drive has 0 bytes and no partitions on it.

ACTIONS TAKEN: I have read through some of the threads here where JACLAZ was helping others, but I am unable to get DSFO to generate a proper image of the drive. When I attempted to get it to generate an image with the command "dsfo \\.\PHYSICALDRIVE1 0 0 C:\dsfok\hddfull.img", I can see the activity light on the flash drive blinking constantly. However, after leaving this operation overnight......the image file had grown to 84GB and did not seem like it was going to stop anytime soon (on an 8GB flash drive!).

In addition, I had previously run Testdisc and Photorec but even with deep scans there is no partition information available to these programs so I cannot continue further.

Unfortunately, data recovery is not my forte. Any help would be appreciated.

There are videos on the drive that the person would like recovered if possible. I don't believe it's life and death material, but I don't like returning something to a person I know without having accomplished something.

Thanks again.

attached is a sample image from DSFO (result of issued command = "dsfo \\.\PHYSICALDRIVEn 0 51200 C:\dsfok\USB_100.img")

edit: added screenshot from DMDE on 8GB flash drive

USB_100.zip

post-367299-0-78506500-1354402598_thumb.

Edited by lastwraith
0

Share this post


Link to post
Share on other sites

Unfortunately I have NO good news. :(

That stick has seemingly and *somehow* got into what we highly specialized technicians ;) call "bricked" status.

The terms has been initially adopted for the Seagate 7200.11:

discbrick.jpg

but it applies to other devices as well.

The issue is that is seen as 0 bytes.

There is not any *known* method to exit this state without losing the data (and not necessarily it is possible to exit this state).

It is *likely* (but not guaranteed) that data can still be recovered by doing either a "chip-off" reading or a transplant on another controller, but these procedures need tools and knowledge well outside the DIY field.

If the scope is to recover the flash stick, you can try - if you are able to find the appropriate "Manufacturer Tool" to "reset" or "zap" (other highly specialized term) the stick, but in the procedure data will be lost in 99% of cases.

Additionally something "very wrong" must have happened during previous attempts, as I can see in the sector (it seems like the .img is 100 times the same sector) the string "TestDisk" which I don't think it is a concidence (and I have never seen TESTDISK write that without user intervention).

It looks like it was attempted to write TESTDISK bootsector but *somehow* the location was shifted 384 bytes :w00t:

In any case, and this is "aligned" with the "never ending" dsfo result, it seems like the reading goes in "loops" and the first sector only is read over and over.

It is possible (but improbable) that using another tool you can actually get a proper image (or however not an endless repetition of first sector), but since PHOTOREC wasn't able to find anything, I really doubt it.

Since it costs nothing, you can try datarescuedd.

http://www.datarescue.com/photorescue/v3/drdd.htm

jaclaz

0

Share this post


Link to post
Share on other sites

And while you're at it, which pendrive are you trying to recover? Does it have a known manufacturer and model, or is it a genereic (= brandless) one? What are it's VID and PID (even brandless pendrives usually have VIDs and PIDs)?

0

Share this post


Link to post
Share on other sites

Hi jaclaz,

I appreciate you taking a look at the information for me. The owner had tried a few things before handing it over.

I ran testdisk myself just to see if it would turn up anything, as I have had good luck with it in the past. My next step (as per one of your helpful posts) was to run dsfo to get a drive image but obviously that did not go well for me.

When that failed, I tried datarescuedd and a few other programs just to see if they could even make sense of the drive....with no good results and I took no write actions in any of those programs.

Again, I appreciate the time and will have to decline further action. I don't think it's that vital for the owner.

@dencorso - The drive in question is a DANE-ELEC 8GB (like the attached pic) - for your curiosity. Thanks for taking a look at my post. This forum is an excellent resource if just for good software links. Found a whole bunch of highly useful utilities by reading through some back and forths jaclaz had with other posters.

Thanks again.

post-367299-0-13629100-1354454336_thumb.

Edited by lastwraith
0

Share this post


Link to post
Share on other sites

The drive in question is a DANE-ELEC 8GB (like the attached pic) - for your curiosity.

This doesn't actually answer dencorso's question, I will try to translate it ;):

Please get ChipGenius here:

http://reboot.pro/topic/4661-chipgenius/

http://www.mydigit.cn/chipgenius.htm

run it and post either a screenshot or copy and paste it's textual output.

jaclaz

0

Share this post


Link to post
Share on other sites

I understood the request, it's just that since I am no longer pursuing recovery (as per the declining further assistance comment) I didn't want to bother wasting much effort on the drive. Unfortunately (or perhaps fortunately), time is a precious commodity.

(And for the record, I DID answer one of his questions.....I just chose the really easy one ;) )

However, if you are really interested in the gritty details....I don't mind making some further efforts to satisfy your curiosity (because that's something I understand fully).

Your call.

As for me, I'm ok with your "beyond reasonable recovery methods" judgment and in my opinion, our collective time is better spent elsewhere.

I do appreciate your help and don't wish to take away from you helping others with more likely chances at success.

Thanks!

Edited by lastwraith
0

Share this post


Link to post
Share on other sites
As for me, I'm ok with your "beyond reasonable recovery methods" judgment and in my opinion, our collective time is better spent elsewhere.

I agree. Never mind.

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.