Trying to retrieve data from a broken USB pen drive

the_syco

Hello all.

I'm trying to get data from a USB pen drive. The aunt who I got it off doesn't know jack about computers, so they sent it 280km up country to me. It is unknown what happened to it.

Have tried:

Active@ Undelete
Active@ File Recovery
LeKuSoft Data Recovery
ICare Data Recovery
Easeus Data Recovery Wizard
Ontrack EasyRecovery

All the above either doesn't see it, or gives some error when trying to read it.

Windows picks it up, and sees the drive (as "Removable N: No Media" in Computer Management), but I'm unable to access it. Clicking "format" does nothing.

Knoppix 6.2.1 doesn't read it, but it seems to get "stuck" when it's trying to load hardware. I think one of the above programs also had the same problem. It's almost like there's a physical or software fault blocking the drive been accessed? No idea.

Will try any logical ideas that anyone here has on getting data from it.

If it makes any difference, it is this model

Overheal

ask here:

http://twitter.com/chloe_obrian

the_syco

Overheal wrote: »

ask here:

http://twitter.com/chloe_obrian

CT Unit? Um, hrm...

Overheal

If Chloe can't do this, nobody can.

Well, PNY wight be able to. Have you contacted them?

ricman

try a unix livecd eg mint ,2008 version fits on 1 cdr.

the_syco

ricman wrote: »

try a unix livecd eg mint ,2008 version fits on 1 cdr.

Would it be much different than Knoppixs boot CD which I used?

Gonna contact PNY when I find out from the relative when they bought the drive.

/edit
The Knoppix I think was a 2010 version.

ricman

see here
http://www.download3k.com/System-Utilities/Backup-Restore/Download-Memory-Stick-Data-Recovery.html
or here http://www.download3k.com/System-Utilities/Backup-Restore/Download-Memory-Stick-Data-Recovery.html
no 9 If a USB item is not being recognised, try using “USBDeview” (freeware

i havent used this software ,so its up to you to try it or not.
You tried knoppix, so mint probably wont recognise it,if knoppix does not see the drive.
or try control panel,administrative tools, computer management, storage, see does the drive show up there.
IF you have to format it, use quick format mode.

ricman

i meant to post this link,http://www.nirsoft.net/utils/usb_devices_view.html

Capt'n Midnight

ask on the unix forum too

in linux disk what do lsusb or dmesg say about the disk ?

if it lists [sdb] then use ddrescue to grab the raw data ( if [sdc] then /dev/sdc etc. )


sudo ddrescue /dev/sdb usb.raw logfile
if not there use sudo apt-get install gddrescue

ddrescue is like dd but it will continue on errors, and retry those areas later on

if it copies data over then use photorec to recover images from the usb.raw file

if not then it may be a hardware error
if the plug is loose try holding it in place with something , plan b is re-soldering the connections if you/someone you know reckons they could do it

Don't forget to rant on about unplugging the disk before "it's safe to remove"

dmesg

usb 1-5: new high speed USB device using ehci_hcd and address 13
[1664899.099883] usb 1-5: configuration #1 chosen from 1 choice
[1664899.103293] scsi6 : SCSI emulation for USB Mass Storage devices
[1664899.125352] usb-storage: device found at 13
[1664899.125355] usb-storage: waiting for device to settle before scanning
[1664904.124544] usb-storage: device scan complete
[1664904.155793] scsi 6:0:0:0: Direct-Access USB Flash Memory 5.00 PQ: 0 ANSI: 0 CCS
[1664904.162288] sd 6:0:0:0: Attached scsi generic sg1 type 0
[1664904.396857] sd 6:0:0:0: [sdb] 7830528 512-byte logical blocks: (4.00 GB/3.73 GiB)
[1664904.397349] sd 6:0:0:0: [sdb] Write Protect is off
[1664904.397357] sd 6:0:0:0: [sdb] Mode Sense: 23 00 00 00
[1664904.397364] sd 6:0:0:0: [sdb] Assuming drive cache: write through
[1664904.402977] sd 6:0:0:0: [sdb] Assuming drive cache: write through
[1664904.402989] sdb: sdb1
[1664904.451074] sd 6:0:0:0: [sdb] Assuming drive cache: write through
[1664904.451086] sd 6:0:0:0: [sdb] Attached SCSI removable disk

lsusb
Bus 001 Device 013: ID 0930:6545 Toshiba Corp. Kingston DataTraveler 2.0 Stick (4GB) / PNY Attache 4GB Stick

Capt'n Midnight

ricman wrote: »

IF you have to format it, use quick format mode.

Don't format it.

the data is worth more than the drive

the_syco

ricman wrote: »

see here
http://www.download3k.com/System-Utilities/Backup-Restore/Download-Memory-Stick-Data-Recovery.html

Doesn't see the drive.

bedlam wrote: »

As Windows appears to be able to see the key, you could try dding it (first and last examples on page). If successful you can then run photorec against the resultant image to carve out files.

According to Disk Management, the USB stick is "Disk 5: Removable N No media", so I selected HDD5...

c:\dd-0.6beta3>dd if=\\?\Device\Harddisk5\Partition0 of=c:\temp\usb2.i
mg bs=1M --size --progress
rawwrite dd for windows version 0.6beta3.
Written by John Newbigin <jn@it.swin.edu.au>
This program is covered by terms of the GPL Version 2.

0M Error reading file: 2 The system cannot find the file specified

0+0 records in
0+0 records out

ricman wrote: »

i meant to post this link,http://www.nirsoft.net/utils/usb_devices_view.html

This sees the info about the USB drive:

==================================================
Device Name : Port_#0002.Hub_#0008
Description : PNY USB 2.0 FD USB Device
Device Type : Mass Storage
Connected : No
Safe To Unplug : No
Disabled : No
USB Hub : No
Drive Letter : N:
Serial Number : 0164420EB95012F2
Created Date : 14/03/2011 13:10:22
Last Plug/Unplug Date: 14/03/2011 21:33:21
VendorID : 154b
ProductID : 6545
Firmware Revision : 2.00
USB Class : 08
USB SubClass : 06
USB Protocol : 50
Hub / Port :
Computer Name :
Vendor Name :
Product Name :
ParentId Prefix :
Service Name : USBSTOR
Service Description: USB Mass Storage Driver
Driver Filename : USBSTOR.SYS
Device Class : USB
Device Mfg : @usbstor.inf,%generic.mfg%;Compatible USB storage device
Power :
Driver Description: USB Mass Storage Device
Driver Version : 6.1.7600.16385
Instance ID : USB\VID_154B&PID_6545\0164420EB95012F2
==================================================

Knoppix sees it... but when trying to, erm, I dunno; "view" it(?), it stops, and has to skip the process.

If anyone knew of where the boot log is kept, I could copy it onto a working USB key, and put it up here.

tmcw

I've had success with FileScavenger when nothing else worked. If Windows can see it, there's a good chance FileScavenger will be able to see it too.

the_syco

tmcw wrote: »

I've had success with FileScavenger when nothing else worked. If Windows can see it, there's a good chance FileScavenger will be able to see it too.

Nope Got the error: "Error 2 accessing \\.\PhysicalDrive5: The system cannot find the file specified."

/edit
The demo of "Recover My Files v4" by "GetData" sees the drive, but also can't read the files.

=-=

It seems the common denominator is that some of the programs can see that the drive is plugged in, but cannot access the files on it. Which is really confusing and odd

Capt'n Midnight

forget about partitions and formatting , they get mushed up easily if a drive is removed before it's safe to eject , and compared to the built in tools in unix/linux, windows is about as useful as a chocolate teapot when it comes to trying to recover files with it's built in tools,

the first pass should always be with non destructive apps - that verify / show what would be recovered without writing to the disk

have you tried photorec ?

had you tried ddrescue - in case you only get one chance of reading the drive ?
(linux live cd - http://www.forensicswiki.org/wiki/Ddrescue - yes you can run it in cygwin in windows, but for a one off ubuntu live cd is probably easier )
it won't recover the files, but will try to scrape the 1's and 0's off a drive while it is still readable. Later on you can do data recovery on the drive image ,

the_syco

Capt'n Midnight wrote: »

have you tried photorec ?

photorec_win.exe doesn't see the USB stick.

Capt'n Midnight wrote: »

had you tried ddrescue - in case you only get one chance of reading the drive ?

Getting systemrescuecd-x86-2.0.1.iso from http://www.sysresccd.org/Main_Page Will see how that goes.

the_syco

the_syco wrote: »

Getting systemrescuecd-x86-2.0.1.iso from http://www.sysresccd.org/Main_Page Will see how that goes.

Photorec doesn't see the USB stick whilst running this nix live CD.

TestDisk also fails to see it.

/edit

Um, I'm guessing that they can see HDD's, but maybe not USB sticks? Maybe I'm looking at the wrong place in Linux, or with the wrong tools?

/edit2
Um. This is weird. To ensure that "fdisk -l" can see the usb stick, I stuck another one in. It can now see both sticks. I think.

Here's a picture:
https://us.v-cdn.net/6034073/uploads/attachments/3532/151985.jpg

It seems to see both drives. I'm guessing /DEV/SDC is the working one, and /DEV/SDC1 is the one which I'm trying to recover, as it has a few "unknown" partitions in it.

/edit3
Okay, confirmed, /DEV/SDC1 above is the working usb stick. If it's in by itself, it can be read, if the other one is in by itself, nothing is seen. It seems it needs another USB stick to be in, to be seen.

/edit4
Ran testdisk /dev/sdc and although no partition as such came up, it said "Structure: ok". no idea what this means. Ran a "deeper search". Gets nothing. If I run a scan with "none" (no partition), it comes up as a FAT32 disk. Will look into this further over the weekend.

Capt'n Midnight

yeah that partition table looks fairly scrambeled

try photorec from the linux cd as it may have access to /dev/sdc1

if all else fails and you are ready to give up on the drive try copying the partition table from the other drive to this one (they aren't exactly the same though)

the_syco

After lots of Linux fun, it seems /dev/sdc and /dev/sdc1 is the same usb stick.
/dev/sdc - the disk
/dev/sdc1 - the partition

The light on the broken one flashes when inserted into the PC, but dunno what it comes up as in Linux just yet.

Capt'n Midnight

the_syco wrote: »

After lots of Linux fun, it seems /dev/sdc and /dev/sdc1 is the same usb stick.

The light on the broken one flashes when inserted into the PC, but dunno what it comes up as in Linux just yet.

/dev/sdc is the drive
/dev/sdc1 is the first partition on the drive

the_syco

It seems in Windows, it can see the USB stick, but no data recovery program that I've tried can see it.

In systemrescuecd (seems it is based on Gentoo), it cannot see the USB stick, or is hidden from me somewhere :S

/edit
Seems populating /dev/ when booting times out when the USB stick is plugged in on boot. Suppose it skips it. Can't see it if I leave it out, and plug it in later, either.