Jump to content
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble

MSFN is made available via donations, subscriptions and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. Alternatively, register and become a site sponsor/subscriber and ads will be disabled automatically. 



Sign in to follow this  
red fox

USB Flash Drive gone rogue!

Recommended Posts

red fox    0

Hello to all, my first posting....

I've seen a few discussion on the forums regarding USB flash drive access problems and I have tried to follow various suggestion in them, but unfortunately have failed to reach a successful result at the moment.

Just over a week ago I was working on my computer and managed to successfully save information to my Intergral Neon 32GB USB 3.0 Flash Drive which I have been using successfully up to this point

I didn't use the computer/Flash drive the following day but when I powered up the computer and inserted the Flash drive I got the "You need to format the disk in drive H: before you can use it." " Do you wish to format?"

Obviously I declined and found that my flash drive was now reporting that it was 28.88GB RAW Healthy (Primary Partition).

I have tried several 'recovery' tools but none seem to help me get to the root of my problems.

I have getting on for 3yrs of data on this drive and unfortunately the last backup I have is well over a year out-of-date. That will teach me to back up more often!!

If someone could advise me on the best method to follow which may allow me to recover my flash drive I would be extremely grateful.

Many Thanks

32GB USB Problem.jpg

Share this post


Link to post
Share on other sites

jaclaz    943

Have a quick look at it in DMDE:
http://dmde.com/

And report what you see when you open the device as "PhysicalDrive".

Please note how DMDE unlike most "recovery tools" is a professional tool,, so it misses the "I know what is best for you, just click this button" approach of many "automated" recovery tools, you will need to take some time reading its help/documentation in order to begin using it.

IF the disk is accessible, next step would be to make an image of it (dd-like, or "forensic sound"), and if such image is created successfully then following attempts to repair/recover should be taken from this image (actually, if possible form a second copy of this image).

jaclaz
 

Share this post


Link to post
Share on other sites
red fox    0

jaclaz,

I've run the above program and select Physical Devices and it shows me the various drives I have in my system.

I select Physical Drive 2 - USB DISK 3.0: 0.0 I get the following result (see Attached)

What do I need to do?  If possible....

RF

DMDE Select Device 1.jpg

Share this post


Link to post
Share on other sites
jaclaz    943

It doesn't look good :( (though it is not yet the case to despair).

What you see in the background is the first absolute sector of the device (LBA 0), as you can see it is all 00's, while it should have normally some MBR code, at the very least it should have had a disk signature at offset 440, an entry in the partition table and magic bytes 55 AA at offset 510 if it was a partitioned device or - if it was a "superfloppy" - some bootsector code (and anyway the 55 AA at offset 510 ).

The message  disk needs to be formatted comes from those 2 bytes missing, but that is not the problem.

The device is seen as 60566016 sectors (0 60566015, see top left of your screenshot) which sounds "just right" as 60566016*512=31009800192 i.e. roughly 31 Gb in disk manufacturer terms and 28.8 in OS ones, whilst DMDE is seemingly not capable of accessing sector 6056015 (last sector) this is not in itself a problem, it can happen and you can click on ignore or ignore all.

Let's see if it makes progresses...

IF nothing is found, try checking sectors LBA 2, 63, 128 and 2048, if also all of them are all 00's the issue may be something in the controller (i.e. it is possible that data is still in the solid state memory chip(s) but for *whatever* reasons the controller inside the USB stick cannot find the data and "simulates" an empty stick).

You could make an image of the stick anyway (DMDE has a provision for this but it has to be seen whether it works in this case since last sector has troubles), make a checksum of the image and verify with the zero hash calculator:
http://www.edenprime.com/tools/epAllZeroHashCalculator.htm

Can you post a link to the exact model of the USB thingy?

The controller is seemingly a Phison one (rather common) but if we get to know the exact model there may be other tools (from the controller manufacturer) to try on that stick.

Go to this page (Russian, use google translate):

http://www.usbdev.ru/

you want to get Chipgenius, ChipEasy AND Usbflashinfo, and provide results of all of them (each tool may be "better" than the other to gather appropriate information").

 

jaclaz 

 

Edited by jaclaz

Share this post


Link to post
Share on other sites
red fox    0

jaclaz,

The USB Flash drive is a Intergral Neon 32GB USB 3.0 - not sure if that helps identify any manufacturer tools.

I've managed to get slightly further forward by clicking on Ignore All, this has now brought up the following page. As I have never used these tools before what is my next step?

I appreciate all the help you have given me....

RF

DMDE Partitions.jpg

Share this post


Link to post
Share on other sites
jaclaz    943

You need some background.

Names like "integral" or "integral Neon" usually mean "nothing", they are just "brands".
Inside the small (plastic) case of a USB stick there is a device that - usually - is produced in quantities and what the "brand" does is just creating the design of the case.
The device consists (basically) of four parts, a USB connector, a quartz or however "timing" device, one or more Flash (memory) chips and a controller.
The controllers are made by a handful of producers, in your case it is Phison.
Of course there are several models of these controllers by the same manufacturer, the programs mentioned will help to find which specific model it is.
These controllers are (usually) programmed through the USB but use a "special" protocol and set of commands, typically the device is produced "blank" and then it is programmed to be compatible with the Flash chips coupled to it, set removable or fixed, a certain part of the available memory may be reserved for "over provisioning", given a VID and PID, etc., etc.

Seemingly your device now is all 00's, in order to confirm this, try making an image of it "as is" (you will need of course around 31 Gb free on your hard disk to store this image), in DMDE you go:
Tools->Copy Sectors

In the popup as source you click on "Device" and select the USB stick, fields should autocomplete to 0/60566015/60566016, as destination you click on "File" and point it to a folder on your hard disk capable of holding the 31 Gb file.

It will take some time to create the image, but the output, is successful, will be a perfect 1:1 copy of what the OS can actually see.
Once you have the image, you calculate the MD5 hash of the file (using *any* MD5 hashing tool you may have) as an example: http://www.winmd5.com/
Then you get the given AllZeroHashCalculator and calculate the "virtual" hash of a file filled with 00's the exact same size of the image.

If the two hashes are the same it means (as I suspect) that the whole device is seen as filled by 00's.

When a stick is defective, usually one of four things happen:

1) *something* in the electronics goes bad and the device is not recognized by the OS or is 0 byte/inaccessible
2) *something* goes wrong (in the software) and the device becomes read only
3) *something goes wrong (in the software) and the device becomes 0 byte in size
4) *something* goes wrong (in the software) and the device becomes all 00's <- this is what I suspect happened on your device

In some cases of #2, #3 and #4 a tool by the manufacturer of the controller may exist and (if it exists/is available AND some understandable documentation - most are Chinese - is available) it may be able to correct the error.

As you may well understand, it is a looong shot, but it is not like there that many alternatives.

Identifying the controller chip and checking if such an utility is available would be the next step.

A selected number of professional may be able to do a "chip-off" or a "transplant" of the memory chips and recover data (if still there) but it wont' be easy to find them and it will anyway cost in the order of a few hundreds dollars.

jaclaz




 

Share this post


Link to post
Share on other sites
red fox    0

jaclaz,

Many, many thanks for the information you have provided - I very appreciate your assistance. My gut feeling is the flash drive is 'fried bread' (DEAD) but I will continue with your suggestions to see if there is anything retrievable.

I guess I've learnt a very hard lesson - Backup, backup backup!!!

If I do have any success I will report back - Thanks again

RF

Share this post


Link to post
Share on other sites
jaclaz    943
3 minutes ago, red fox said:

jaclaz,

Many, many thanks for the information you have provided - I very appreciate your assistance. My gut feeling is the flash drive is 'fried bread' (DEAD) but I will continue with your suggestions to see if there is anything retrievable.

I guess I've learnt a very hard lesson - Backup, backup backup!!!

If I do have any success I will report back - Thanks again

RF

I don' t know, the four "common" cases were given - more or less - in order of probabilities they happen, i.e. #1 is the most common and #4 is the least common, of course there is the chance that the device is perfectly functional but that *something* (malware or - no offence intended :) - a mistake by the user) actually wiped it :ph34r: or filled it with 00's or partially overwrote its contents.

Before giving up it is anyway worth to try imaging it and analyze the image, it could also be a combination of two issues, some malfunctioning of the device (hence the access error in DMDE) that caused only a partial wipe, if this is the case anyway the image will be much faster to deal with.

The three golden rules (which you learned the hard way):
 

and, to hopefully cheer you up a little bit:
http://www.brainyquote.com/quotes/quotes/c/cslewis103466.html

http://www.quotationspage.com/quote/26155.html

jaclaz


 


 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.

×