Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account


Photo

8GB Flash drive corruption due to unsafe removal - recovery?

- - - - -

  • Please log in to reply
6 replies to this topic

#1
lastwraith

lastwraith
  • Member
  • 3 posts
  • OS:none specified
  • Country: Country Flag
Hi all,

I was hoping to get some help attempting to recover a flash drive.

PROBLEM: According to the owner, the flash drive was inserted in a Mac and was having data written to it when it was removed without properly being prepared for removal. Now every time it is inserted into a computer, Windows asks to please insert a disk into drive (drive letter). In Windows disk management, it shows up as a drive letter but the drive has 0 bytes and no partitions on it.

ACTIONS TAKEN: I have read through some of the threads here where JACLAZ was helping others, but I am unable to get DSFO to generate a proper image of the drive. When I attempted to get it to generate an image with the command "dsfo \\.\PHYSICALDRIVE1 0 0 C:\dsfok\hddfull.img", I can see the activity light on the flash drive blinking constantly. However, after leaving this operation overnight......the image file had grown to 84GB and did not seem like it was going to stop anytime soon (on an 8GB flash drive!).
In addition, I had previously run Testdisc and Photorec but even with deep scans there is no partition information available to these programs so I cannot continue further.

Unfortunately, data recovery is not my forte. Any help would be appreciated.
There are videos on the drive that the person would like recovered if possible. I don't believe it's life and death material, but I don't like returning something to a person I know without having accomplished something.
Thanks again.

attached is a sample image from DSFO (result of issued command = "dsfo \\.\PHYSICALDRIVEn 0 51200 C:\dsfok\USB_100.img")
edit: added screenshot from DMDE on 8GB flash drive

Attached Files


Edited by lastwraith, 01 December 2012 - 04:57 PM.



How to remove advertisement from MSFN

#2
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,042 posts
  • OS:none specified
  • Country: Country Flag
Unfortunately I have NO good news. :(

That stick has seemingly and *somehow* got into what we highly specialized technicians ;) call "bricked" status.
The terms has been initially adopted for the Seagate 7200.11:
Posted Image
but it applies to other devices as well.

The issue is that is seen as 0 bytes.
There is not any *known* method to exit this state without losing the data (and not necessarily it is possible to exit this state).

It is *likely* (but not guaranteed) that data can still be recovered by doing either a "chip-off" reading or a transplant on another controller, but these procedures need tools and knowledge well outside the DIY field.

If the scope is to recover the flash stick, you can try - if you are able to find the appropriate "Manufacturer Tool" to "reset" or "zap" (other highly specialized term) the stick, but in the procedure data will be lost in 99% of cases.

Additionally something "very wrong" must have happened during previous attempts, as I can see in the sector (it seems like the .img is 100 times the same sector) the string "TestDisk" which I don't think it is a concidence (and I have never seen TESTDISK write that without user intervention).
It looks like it was attempted to write TESTDISK bootsector but *somehow* the location was shifted 384 bytes :w00t:

In any case, and this is "aligned" with the "never ending" dsfo result, it seems like the reading goes in "loops" and the first sector only is read over and over.

It is possible (but improbable) that using another tool you can actually get a proper image (or however not an endless repetition of first sector), but since PHOTOREC wasn't able to find anything, I really doubt it.
Since it costs nothing, you can try datarescuedd.
http://www.datarescu...cue/v3/drdd.htm

jaclaz

#3
dencorso

dencorso

    Adiuvat plus qui nihil obstat

  • Super Moderator
  • 5,782 posts
  • OS:98SE
  • Country: Country Flag

Donator

And while you're at it, which pendrive are you trying to recover? Does it have a known manufacturer and model, or is it a genereic (= brandless) one? What are it's VID and PID (even brandless pendrives usually have VIDs and PIDs)?

#4
lastwraith

lastwraith
  • Member
  • 3 posts
  • OS:none specified
  • Country: Country Flag
Hi jaclaz,

I appreciate you taking a look at the information for me. The owner had tried a few things before handing it over.
I ran testdisk myself just to see if it would turn up anything, as I have had good luck with it in the past. My next step (as per one of your helpful posts) was to run dsfo to get a drive image but obviously that did not go well for me.

When that failed, I tried datarescuedd and a few other programs just to see if they could even make sense of the drive....with no good results and I took no write actions in any of those programs.

Again, I appreciate the time and will have to decline further action. I don't think it's that vital for the owner.

@dencorso - The drive in question is a DANE-ELEC 8GB (like the attached pic) - for your curiosity. Thanks for taking a look at my post. This forum is an excellent resource if just for good software links. Found a whole bunch of highly useful utilities by reading through some back and forths jaclaz had with other posters.

Thanks again.

Attached Files


Edited by lastwraith, 02 December 2012 - 07:19 AM.


#5
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,042 posts
  • OS:none specified
  • Country: Country Flag

The drive in question is a DANE-ELEC 8GB (like the attached pic) - for your curiosity.

This doesn't actually answer dencorso's question, I will try to translate it ;):
Please get ChipGenius here:
http://reboot.pro/to...661-chipgenius/
http://www.mydigit.cn/chipgenius.htm
run it and post either a screenshot or copy and paste it's textual output.

jaclaz

#6
lastwraith

lastwraith
  • Member
  • 3 posts
  • OS:none specified
  • Country: Country Flag
I understood the request, it's just that since I am no longer pursuing recovery (as per the declining further assistance comment) I didn't want to bother wasting much effort on the drive. Unfortunately (or perhaps fortunately), time is a precious commodity.

(And for the record, I DID answer one of his questions.....I just chose the really easy one ;) )

However, if you are really interested in the gritty details....I don't mind making some further efforts to satisfy your curiosity (because that's something I understand fully).

Your call.

As for me, I'm ok with your "beyond reasonable recovery methods" judgment and in my opinion, our collective time is better spent elsewhere.

I do appreciate your help and don't wish to take away from you helping others with more likely chances at success.

Thanks!

Edited by lastwraith, 02 December 2012 - 09:57 PM.


#7
dencorso

dencorso

    Adiuvat plus qui nihil obstat

  • Super Moderator
  • 5,782 posts
  • OS:98SE
  • Country: Country Flag

Donator

As for me, I'm ok with your "beyond reasonable recovery methods" judgment and in my opinion, our collective time is better spent elsewhere.

I agree. Never mind.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users



How to remove advertisement from MSFN