Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Flash Drive Data Lost Forever?


  • Please log in to reply
12 replies to this topic

#1 joenorwood77

joenorwood77

  • Members
  • 60 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:22 AM

Posted 31 March 2012 - 03:24 PM

In the Fall of 2011, I was using my flash drive at work and abruptly all of my files were gone. Work uses Macs and at home I use a Lenovo laptop. I had all of my important files for work on the flash drive and I am a teacher. That day one time when I connected my flash drive, some files and folders were gone and the second time all were gone and I was prompted to format my flash drive. I attempted recovering my files many times over via recovery programs, and I also sent the flash drive in to two different companies. Nothing worked. One time I was desperate and after trying many programs and one of those companies I sent the flash drive to, I took someones advice and formatted the drive. After that, I still received prompts that the flash drive needs to be formatted. I ended up formatting twice total (one quick and one normal). The second company feels that my formatting should not be a big deal for recovery, but there is something more major that they are unable to fix. That company was the one that Sandisk suggested to recover files specifically for their company. lc-tech was that companys name and they say the disk reads as all zeros so nothing they can do. Flashdrivepros was the first place. Of course I understand to ALWAYS back up important info but did not take my own advice. Feel free to add an questions or comments regarding this 32 gb sandisk cruzer. I heard some people think that perhaps going between PC and Macs might cause issues. Also, I never properly ejected the flash drive before disconnecting it from my computers. Because of flash drive not working, some wonder if the formats even erased anything. I have almost given up on this, but due to the importance of these files, I want to give this one last shot.

BC AdBot (Login to Remove)

 


#2 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:01:22 PM

Posted 31 March 2012 - 04:33 PM

Did you do the 'full format' while it was plugged into a Windows 7 or Windows Vista machine? I ask because Microsoft changed the format command for those operating systems to write all 0's to the partition being formatted.

Here is a way for you to see if it is indeed all 0's.

Download Disk Investigator (it's free)
http://www.diskcleaners.com/#dskinv

under View select DISK and then select your flash drive and you will be able to see the raw data on it. You can drag the scroll bar at the bottom of the screen to quickly view all across the drive and see if anything is there or if it is all 0's.

If you try this, let us know if you see any data or just 0's. If you have any problems or questions doing this, let us know.

James

#3 joenorwood77

joenorwood77
  • Topic Starter

  • Members
  • 60 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:22 AM

Posted 31 March 2012 - 04:43 PM

I am on vacation in Chicago but once I return to Minnesota, I will test out the flash drive with the disk Investigator. I did use Windows 7 to format. It was still so strange that even after formatting that it prompted me immediately to format it again. Is it possible though, like the one recovery company stated, that if there was an issue with the flash drive, the format might not have really done anything to the flash drive anyway? I guess we will have to wait to see what I find out from DI sometime later next week...

#4 joenorwood77

joenorwood77
  • Topic Starter

  • Members
  • 60 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:22 AM

Posted 03 April 2012 - 09:46 PM

I see data and it is not just all zeros.

#5 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:01:22 PM

Posted 04 April 2012 - 08:54 AM

Hi

Can you copy and paste in your reply the text in the box under DISK INFORMATION (it's right under where you select the disk)?

James

#6 joenorwood77

joenorwood77
  • Topic Starter

  • Members
  • 60 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:22 AM

Posted 04 April 2012 - 08:49 PM

Logical drive: F
Size: 29 Gb (popularly 32 Gb)
Logical sectors: 62531648
Bytes per sector: 512
Sectors per Cluster: 32
Cluster size: 16384
File system: FAT32
Number of copies of FAT: 2
Sectors per FAT: 15267
Start sector for FAT1: 34
Start sector for FAT2: 15301
Root DIR Sector: 30568
Root DIR Cluster: 2
2-nd Cluster Start Sector: 30568
Ending Cluster: 1953159
Media Descriptor: 248
Root Entries: 0
Heads: 255
Hidden sectors: 0
Backup boot sector: 6
Reserved sectors: 34
FS Info sector: 1
Sectors per track: 63
File system version: 0
SerialVolumeID: 80B60D5C
Volume Label: NO NAME

#7 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:01:22 PM

Posted 04 April 2012 - 09:22 PM

Hi

That information helps us figure out if the data you are seeing that is not 0's is part of the new formatted file system or if it is the old data that you want to recover.

We don't want to beat on this too much in case it is fragile so I recommend this series of attempts. You may have tried some of these already. If you did and it did not work skip it this time.

First try PhotoRec like you did for the flipcam.

Then TestDisk using the Undelete feature.

Then Recuva.

If none of those work, use Disk Investigator and use the slider at the bottom and let me know if you see anything besides 0's between sector 1,600,000 and 48,000,000 (you don't have to look at them all just scan over them to see if there is anything besides 0's there)

James

#8 joenorwood77

joenorwood77
  • Topic Starter

  • Members
  • 60 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:22 AM

Posted 04 April 2012 - 11:23 PM

Photorec revealed 2 files which were small files with .apple extensions.

f0032832.apple 16 kb
f0032896.apple 2,097,151 kb

testdisk did not reveal any files.

recuva did not reveal any files with deep scan.


For disk investigator, I see the slider bar but confused about knowing which sectors I am scrolling by?

I will try to paste full results below:

0000 EB 58 90 4D 53 44 4F 53 . X . M S D O S 235 88 144 77 83 68 79 83
0008 35 2E 30 00 02 20 22 00 5 . 0 . . " . 53 46 48 0 2 32 34 0
0010 02 00 00 00 00 F8 00 00 . . . . . . . . 2 0 0 0 0 248 0 0
0018 3F 00 FF 00 00 00 00 00 ? . . . . . . . 63 0 255 0 0 0 0 0
0020 BF 9F BA 03 A3 3B 00 00 . . . . . ; . . 191 159 186 3 163 59 0 0
0028 00 00 00 00 02 00 00 00 . . . . . . . . 0 0 0 0 2 0 0 0
0030 01 00 06 00 00 00 00 00 . . . . . . . . 1 0 6 0 0 0 0 0
0038 00 00 00 00 00 00 00 00 . . . . . . . . 0 0 0 0 0 0 0 0
0040 00 00 29 5C 0D B6 80 4E . . ) \ . . . N 0 0 41 92 13 182 128 78
0048 4F 20 4E 41 4D 45 20 20 O N A M E 79 32 78 65 77 69 32 32
0050 20 20 46 41 54 33 32 20 F A T 3 2 32 32 70 65 84 51 50 32
0058 20 20 33 C9 8E D1 BC F4 3 . . . . . 32 32 51 201 142 209 188 244
0060 7B 8E C1 8E D9 BD 00 7C { . . . . . . | 123 142 193 142 217 189 0 124
0068 88 4E 02 8A 56 40 B4 08 . N . . V @ . . 136 78 2 138 86 64 180 8
0070 CD 13 73 05 B9 FF FF 8A . . s . . . . . 205 19 115 5 185 255 255 138
0078 F1 66 0F B6 C6 40 66 0F . f . . . @ f . 241 102 15 182 198 64 102 15
0080 B6 D1 80 E2 3F F7 E2 86 . . . . ? . . . 182 209 128 226 63 247 226 134
0088 CD C0 ED 06 41 66 0F B7 . . . . A f . . 205 192 237 6 65 102 15 183
0090 C9 66 F7 E1 66 89 46 F8 . f . . f . F . 201 102 247 225 102 137 70 248
0098 83 7E 16 00 75 38 83 7E . ~ . . u 8 . ~ 131 126 22 0 117 56 131 126
00A0 2A 00 77 32 66 8B 46 1C * . w 2 f . F . 42 0 119 50 102 139 70 28
00A8 66 83 C0 0C BB 00 80 B9 f . . . . . . . 102 131 192 12 187 0 128 185
00B0 01 00 E8 2B 00 E9 48 03 . . . + . . H . 1 0 232 43 0 233 72 3
00B8 A0 FA 7D B4 7D 8B F0 AC . . } . } . . . 160 250 125 180 125 139 240 172
00C0 84 C0 74 17 3C FF 74 09 . . t . < . t . 132 192 116 23 60 255 116 9
00C8 B4 0E BB 07 00 CD 10 EB . . . . . . . . 180 14 187 7 0 205 16 235
00D0 EE A0 FB 7D EB E5 A0 F9 . . . } . . . . 238 160 251 125 235 229 160 249
00D8 7D EB E0 98 CD 16 CD 19 } . . . . . . . 125 235 224 152 205 22 205 25
00E0 66 60 66 3B 46 F8 0F 82 f ` f ; F . . . 102 96 102 59 70 248 15 130
00E8 4A 00 66 6A 00 66 50 06 J . f j . f P . 74 0 102 106 0 102 80 6
00F0 53 66 68 10 00 01 00 80 S f h . . . . . 83 102 104 16 0 1 0 128
00F8 7E 02 00 0F 85 20 00 B4 ~ . . . . . . 126 2 0 15 133 32 0 180
0100 41 BB AA 55 8A 56 40 CD A . . U . V @ . 65 187 170 85 138 86 64 205
0108 13 0F 82 1C 00 81 FB 55 . . . . . . . U 19 15 130 28 0 129 251 85
0110 AA 0F 85 14 00 F6 C1 01 . . . . . . . . 170 15 133 20 0 246 193 1
0118 0F 84 0D 00 FE 46 02 B4 . . . . . F . . 15 132 13 0 254 70 2 180
0120 42 8A 56 40 8B F4 CD 13 B . V @ . . . . 66 138 86 64 139 244 205 19
0128 B0 F9 66 58 66 58 66 58 . . f X f X f X 176 249 102 88 102 88 102 88
0130 66 58 EB 2A 66 33 D2 66 f X . * f 3 . f 102 88 235 42 102 51 210 102
0138 0F B7 4E 18 66 F7 F1 FE . . N . f . . . 15 183 78 24 102 247 241 254
0140 C2 8A CA 66 8B D0 66 C1 . . . f . . f . 194 138 202 102 139 208 102 193
0148 EA 10 F7 76 1A 86 D6 8A . . . v . . . . 234 16 247 118 26 134 214 138
0150 56 40 8A E8 C0 E4 06 0A V @ . . . . . . 86 64 138 232 192 228 6 10
0158 CC B8 01 02 CD 13 66 61 . . . . . . f a 204 184 1 2 205 19 102 97
0160 0F 82 54 FF 81 C3 00 02 . . T . . . . . 15 130 84 255 129 195 0 2
0168 66 40 49 0F 85 71 FF C3 f @ I . . q . . 102 64 73 15 133 113 255 195
0170 4E 54 4C 44 52 20 20 20 N T L D R 78 84 76 68 82 32 32 32
0178 20 20 20 00 00 00 00 00 . . . . . 32 32 32 0 0 0 0 0
0180 00 00 00 00 00 00 00 00 . . . . . . . . 0 0 0 0 0 0 0 0
0188 00 00 00 00 00 00 00 00 . . . . . . . . 0 0 0 0 0 0 0 0
0190 00 00 00 00 00 00 00 00 . . . . . . . . 0 0 0 0 0 0 0 0
0198 00 00 00 00 00 00 00 00 . . . . . . . . 0 0 0 0 0 0 0 0
01A0 00 00 00 00 00 00 00 00 . . . . . . . . 0 0 0 0 0 0 0 0
01A8 00 00 00 00 0D 0A 52 65 . . . . . . R e 0 0 0 0 13 10 82 101
01B0 6D 6F 76 65 20 64 69 73 m o v e d i s 109 111 118 101 32 100 105 115
01B8 6B 73 20 6F 72 20 6F 74 k s o r o t 107 115 32 111 114 32 111 116
01C0 68 65 72 20 6D 65 64 69 h e r m e d i 104 101 114 32 109 101 100 105
01C8 61 2E FF 0D 0A 44 69 73 a . . . . D i s 97 46 255 13 10 68 105 115
01D0 6B 20 65 72 72 6F 72 FF k e r r o r . 107 32 101 114 114 111 114 255
01D8 0D 0A 50 72 65 73 73 20 . . P r e s s 13 10 80 114 101 115 115 32
01E0 61 6E 79 20 6B 65 79 20 a n y k e y 97 110 121 32 107 101 121 32
01E8 74 6F 20 72 65 73 74 61 t o r e s t a 116 111 32 114 101 115 116 97
01F0 72 74 0D 0A 00 00 00 00 r t . . . . . . 114 116 13 10 0 0 0 0
01F8 00 AC CB D8 00 00 55 AA . . . . . . U . 0 172 203 216 0 0 85 170

#9 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:01:22 PM

Posted 05 April 2012 - 09:56 AM

The sector number is to the left of the slider bar on the bottom. You can type 1600000 in it to jump right to that sector.

James

Edited by NeverSayDie, 05 April 2012 - 09:57 AM.


#10 joenorwood77

joenorwood77
  • Topic Starter

  • Members
  • 60 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:22 AM

Posted 05 April 2012 - 08:52 PM

It appears to be all zeros...

#11 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:01:22 PM

Posted 05 April 2012 - 08:57 PM

Well at least now you know for sure and you are certainly capable of fixing something like this yourself in the future. You did really well with using some very complicated and advanced tools.

James

#12 joenorwood77

joenorwood77
  • Topic Starter

  • Members
  • 60 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:22 AM

Posted 06 April 2012 - 10:42 AM

Thanks James. I truly appreciate you sharing those resources and steps with me on how to use those tools.

So it does sound like it is nearly, if not completely impossible to recover the data which was on this flash drive? Is this something I should hold on to in case technology improves in the area of data recovery in future years to where I might be able to recover the data at some point? Or must I completely accept I will never be able to see that data again?

#13 James Litten

James Litten

    Ԁǝǝ˥q


  • BC Advisor
  • 1,946 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:01:22 PM

Posted 06 April 2012 - 12:22 PM

It's gone.

Recovering anything would be very expensive (like more than buying a new house, cars, pool and personal golf course expensive) or would have to be data that is critical to national security (which would be recovered at taxpayers' expense but there would be a lot of questions and red tape and no guarantee that you would be given the recovered data :) )

It has always been my understanding (maybe someone else is aware of something else but I tend to read current reports about this type of stuff) that reading the history of a bit on a platter drive is much easier than reading the history of a bit on a semiconductor NAND gate.

I am not aware of any tools or techniques coming out in the next few years that would allow me to recover that in my humble lab.

James




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users