I have this (possibly faulty) USB flash drive that has been handed by a friend to me. I have no idea what happened to it nor can I be 100% sure about the previous filesystem, however it's 99,9% certain it was FAT32.
My system is windows 7 64bit, when I plug the drive in and try to explore its contents windows prompts me whether I want to format the drive or not.
The drive on its case has no signatures, TestDisk labels it as NX216 Flash Reader, a 4GB stick.
I tried using a number of programs (recuva, restoration, wise data recovery and data recovery) but none of them want to even start working with the drive, so I have to assume TestDisk works on a lower level then the mentioned applications.
I tried following the procedure that Fiona posted here http://forum.cgsecurity.org/phpBB3/usb- ... html#p2614 as the conditions appeared similar, but the situation remain unchanged. The boot sector is still marked as bad.
I also tried using PhotoRec on the drive but it could not render any files.
Here's the log generated by TestDisk
Code: Select all
Mon Apr 22 16:28:16 2013
Command line: TestDisk
TestDisk 6.14-WIP, Data Recovery Utility, April 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows 7 (7601) SP1
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-04-22T08:36:13
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250058268160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=4009754624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250058268160
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4009754624
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=49902780416
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=200046997504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=4651384832
filewin32_getfilesize(\\.\F:) GetFileSize err Incorrect function.
filewin32_setfilepointer(\\.\F:) SetFilePointer err Incorrect function.
Warning: can't get size for \\.\F:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=4009754624
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 32301 240 63, sector size=512 - ST3250410AS, S/N:202020202020202020202020523641593456424d, FW:3.AAF
Disk /dev/sdb - 4009 MB / 3824 MiB - CHS 487 255 63, sector size=512 - NX216 FLASH READER, FW:1.0E
Drive E: - 4651 MB / 4435 MiB - CHS 1108 64 32, sector size=2048 - TSSTcorp CDDVDW SH-S223C, FW:SB04
Partition table type default to Intel
Disk /dev/sdb - 4009 MB / 3824 MiB - NX216 FLASH READER
Partition table type: None
Interface Advanced
P Unknown 0 0 1 487 125 22 7831552
Change partition type:
P FAT32 0 0 1 487 125 22 7831552
fat32_boot_sector
P FAT32 0 0 1 487 125 22 7831552
Boot sector
Bad
Backup boot sector
Bad
Sectors are identical.
A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.
P FAT32 0 0 1 487 125 22 7831552
rebuild_FAT_BS p_fat12 0, p_fat16 0, p_fat32 1
fat_find_type(max_offset=61248, p_fat12=0, p_fat16=0, p_fat32=1, debug=1, dump_ind=0)
No FAT found, reserved=0, fat_length=0
find_sectors_per_cluster skip_sectors=358 (skip_offset=183296)
Can't find cluster size
fat32_boot_sector
P FAT32 0 0 1 487 125 22 7831552
Boot sector
Bad
Backup boot sector
Bad
Sectors are identical.
A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.
Code: Select all
<?xml version='1.0' encoding='UTF-8'?>
<dfxml xmloutputversion='1.0'>
<metadata
xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
xmlns:dc='http://purl.org/dc/elements/1.1/'>
<dc:type>Carve Report</dc:type>
</metadata>
<creator>
<package>PhotoRec</package>
<version>6.14-WIP</version>
<build_environment>
<compiler>GCC 4.7, Cygwin 1007.17</compiler>
<compilation_date>2013-04-22T08:36:13</compilation_date>
<library name='libext2fs' version='1.42.2'/>
<library name='libewf' version='20120504'/>
<library name='libjpeg' version='80'/>
<library name='libntfs' version='10:0:0'/>
</build_environment>
<execution_environment>
<os_sysname>Windows</os_sysname>
<os_release>Windows 7 (7601) SP1</os_release>
<os_version>Windows 7 (7601) SP1</os_version>
<host>user-PC</host>
<arch>i686</arch>
<uid>400</uid>
<start_time>2013-04-22T16:02:02+0200</start_time>
</execution_environment>
</creator>
<source>
<image_filename>/dev/sdb</image_filename>
<sectorsize>512</sectorsize>
<device_model>NX216 FLASH READER</device_model>
<image_size>4009754624</image_size>
<volume>
<byte_runs>
<byte_run offset='0' img_offset='0' len='4009754624'/>
</byte_runs>
</volume>
</source>
<configuration>
</configuration>
Obviously, there are many pictures on it and my friend would like getting them back, I'd like to be fairly certain if I have to tell him there isn't much that can be done about it.
Professional (as in expensive) data recovery services are out of the question.
Thanks for your time.