Page 1 of 3

flash drive not readable endmark 0xAA55

Posted: 17 Feb 2015, 23:17
by ddhh
Hello Team,

I had written the text also in german forum but nobody can help me.
I hope it is ok, if you look to the german forum for the pictures. (name of the threat is "USB Stick nicht mehr lesbar endmark 0xAA55")

At the first picture you can see the filesystem in window (computeradministration), the format is a RAW system. (the flash drive is not formated)
On the second picture, you can see the marked physical drive.
Then I start testdisk with partition table type Intel. you see the message "partition sector doesn´t havet the endmark 0xAA55"
The message with Quick and deep search is "no partition found or selected for recovery".

Then I test the same with Partition Table Type None (FAT32). You can see this on the next 3 pictures.
There I can Boot and Rebuild BS.After this, I get a list of files but if I press N(o), then the clustersearch break at 70%.

I delete the testdisk 64bit version and install the 32bit version. And now the same procedure with able Type None (FAT32).
It doesn´t stop at 70%, now I get 100% and I see more files. I think these are all file on my flash drive.
I press List at the end but I get the errormessage "No file found, filesystem may be damaged". (the last two pictures)

What should I do now?
I would like to copy all these files.
I hope you can help me.

thanks and regards,

Re: flash drive not readable endmark 0xAA55

Posted: 20 Feb 2015, 23:19
by ddhh
Any Idea?
here are the last 3 screens.
FAT32_3.JPG
FAT32_3.JPG (82.73 KiB) Viewed 4818 times
FAT32_5.JPG
FAT32_5.JPG (49.1 KiB) Viewed 4818 times
FAT32_6.JPG
FAT32_6.JPG (35.28 KiB) Viewed 4818 times
I can´t copy the list from the first screen.
What can I do?

Re: flash drive not readable endmark 0xAA55

Posted: 06 Mar 2015, 21:22
by ddhh
Hello,

any idea, what can I do?

Re: flash drive not readable endmark 0xAA55

Posted: 21 Mar 2015, 11:20
by ddhh
this is the new screen, do you have any idea to this one?
FAT32_V7.JPG
FAT32_V7.JPG (39.7 KiB) Viewed 4708 times
after List:
FAT32_V8.JPG
FAT32_V8.JPG (20.43 KiB) Viewed 4708 times

Re: flash drive not readable endmark 0xAA55

Posted: 24 Mar 2015, 16:00
by stumpyuk
Just use photorec to recover the files, is it just jpg files you want to recover?

Re: flash drive not readable endmark 0xAA55

Posted: 24 Mar 2015, 20:57
by ddhh
I used photorec.
It finds many files but without the right name (like "f3580954").
Any of this files are not possible to open.
No, there are also excel, word, pdf, ppt files and outlook mails.

Re: flash drive not readable endmark 0xAA55

Posted: 29 Mar 2015, 20:44
by ddhh
any other idea?

what doe´s it mean in my two last screens?

root cluster: 0 (there is no root cluster)
flags: 0000 (???)
info-sector: 1 (???)
backup boot: 6 (???)

Re: flash drive not readable endmark 0xAA55

Posted: 31 Mar 2015, 23:44
by RAVEN
ddhh, I have the same problem with USB stick. Problem is almost certainly caused by Sality malware. Also my USB drive was almost 100% full when error occurred.

TestDisk was unable to fix the issue, however with PhotRec I was able to recover files. During recovery process, Avast detected Sality.

I will maybe post more information soon.

Re: flash drive not readable endmark 0xAA55

Posted: 02 Apr 2015, 07:07
by cgrenier
When using TestDisk, you can try to force the Root cluster to 2, it's the default values. You may have to enable the Expert mode in Options.

Re: flash drive not readable endmark 0xAA55

Posted: 15 Apr 2015, 18:42
by ddhh
Hi,

in which menu can I change the root cluster size?