Unformatted USB flash drive

Message

mkey · #1 Post by **mkey** » 22 Apr 2013, 16:01

Hello.

I have this (possibly faulty) USB flash drive that has been handed by a friend to me. I have no idea what happened to it nor can I be 100% sure about the previous filesystem, however it's 99,9% certain it was FAT32.
My system is windows 7 64bit, when I plug the drive in and try to explore its contents windows prompts me whether I want to format the drive or not.

The drive on its case has no signatures, TestDisk labels it as NX216 Flash Reader, a 4GB stick.
I tried using a number of programs (recuva, restoration, wise data recovery and data recovery) but none of them want to even start working with the drive, so I have to assume TestDisk works on a lower level then the mentioned applications.

I tried following the procedure that Fiona posted here http://forum.cgsecurity.org/phpBB3/usb- ... html#p2614 as the conditions appeared similar, but the situation remain unchanged. The boot sector is still marked as bad.

I also tried using PhotoRec on the drive but it could not render any files.

Here's the log generated by TestDisk

Code: Select all

Mon Apr 22 16:28:16 2013
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, April 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-04-22T08:36:13
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250058268160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=4009754624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250058268160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4009754624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=49902780416
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=200046997504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=4651384832
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=4009754624
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 32301 240 63, sector size=512 - ST3250410AS, S/N:202020202020202020202020523641593456424d, FW:3.AAF
Disk /dev/sdb - 4009 MB / 3824 MiB - CHS 487 255 63, sector size=512 - NX216 FLASH READER, FW:1.0E
Drive E: - 4651 MB / 4435 MiB - CHS 1108 64 32, sector size=2048 - TSSTcorp CDDVDW SH-S223C, FW:SB04

Partition table type default to Intel
Disk /dev/sdb - 4009 MB / 3824 MiB - NX216 FLASH READER
Partition table type: None

Interface Advanced
   P Unknown                  0   0  1   487 125 22    7831552
Change partition type:
   P FAT32                    0   0  1   487 125 22    7831552

fat32_boot_sector
   P FAT32                    0   0  1   487 125 22    7831552
Boot sector
Bad

Backup boot sector
Bad

Sectors are identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.

   P FAT32                    0   0  1   487 125 22    7831552
rebuild_FAT_BS p_fat12 0, p_fat16 0, p_fat32 1
fat_find_type(max_offset=61248, p_fat12=0, p_fat16=0, p_fat32=1, debug=1, dump_ind=0)
No FAT found, reserved=0, fat_length=0
find_sectors_per_cluster skip_sectors=358 (skip_offset=183296)
Can't find cluster size

fat32_boot_sector
   P FAT32                    0   0  1   487 125 22    7831552
Boot sector
Bad

Backup boot sector
Bad

Sectors are identical.

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.

Here's the xml log from PhotoRec

Code: Select all

<?xml version='1.0' encoding='UTF-8'?>
<dfxml xmloutputversion='1.0'>
  <metadata 
  xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML' 
  xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' 
  xmlns:dc='http://purl.org/dc/elements/1.1/'>
    <dc:type>Carve Report</dc:type>
  </metadata>
  <creator>
    <package>PhotoRec</package>
    <version>6.14-WIP</version>
    <build_environment>
      <compiler>GCC 4.7, Cygwin 1007.17</compiler>
      <compilation_date>2013-04-22T08:36:13</compilation_date>
      <library name='libext2fs' version='1.42.2'/>
      <library name='libewf' version='20120504'/>
      <library name='libjpeg' version='80'/>
      <library name='libntfs' version='10:0:0'/>
    </build_environment>
    <execution_environment>
      <os_sysname>Windows</os_sysname>
      <os_release>Windows 7 (7601) SP1</os_release>
      <os_version>Windows 7 (7601) SP1</os_version>
      <host>user-PC</host>
      <arch>i686</arch>
      <uid>400</uid>
      <start_time>2013-04-22T16:02:02+0200</start_time>
    </execution_environment>
  </creator>
  <source>
    <image_filename>/dev/sdb</image_filename>
    <sectorsize>512</sectorsize>
    <device_model>NX216 FLASH READER</device_model>
    <image_size>4009754624</image_size>
    <volume>
      <byte_runs>
        <byte_run offset='0' img_offset='0' len='4009754624'/>
      </byte_runs>
    </volume>
  </source>
  <configuration>
  </configuration>

My experience with file and drive recovery is very limited, what I'd like to get here is a decent estimate about the current state of this flash drive, that is unless any files can be recovered from it.
Obviously, there are many pictures on it and my friend would like getting them back, I'd like to be fairly certain if I have to tell him there isn't much that can be done about it.
Professional (as in expensive) data recovery services are out of the question.

Thanks for your time.