Page 1 of 1

Lost data 16GB USB Stick

Posted: 13 Nov 2013, 12:14
by FCKUSB
Hello

My USB stick stoped working in the middle of a file transfer.
Result: now the USB stick isn't recognized anymore. Windows says "the volume is empty, do you want to format it?"

Image

If I choose "Intel" volume here is what I get:

Image

Image

Image

Image

Image

I know it was a NTFS partition with clustr size 32 because the program "Getdataback for NTFS" finds some fragments of the file system. But the files and directories recovered by Getdataback are only some old data. I rcover the same data with Photorec. The important files are recent outlook .pst files which I can't find.

Image

If I choose "non-partitioned media", same result: no partition found, with many read errors.

So what do you think I can/should do to get my data back?
Can I recrate my NTFS partition table?
Also, how do I know if the USB stick is physically damaged (burned chips?)

Re: Lost data 16GB USB Stick

Posted: 21 Nov 2013, 22:58
by cgrenier
Try to create an image of your USB key, use gnu ddrescue for that

Code: Select all

ddrescue /dev/sdb usb.dd usb.log
http://www.cgsecurity.org/wiki/Damaged_Hard_Disk

Re: Lost data 16GB USB Stick

Posted: 22 Nov 2013, 05:20
by FCKUSB
Now the USB stick dosn't appear as a unformated stick anymore, but as a disk reader without media.
Fortunately, I have a 16Gb image of the USB stick I made just before that. It's a multifile .img file I made with 001Micron USB Stick recovery tool

Re: Lost data 16GB USB Stick

Posted: 22 Nov 2013, 08:13
by Fiona
Looks like your flash memory is not recognized anymore but only the built in controller of your USB thumb.
Partition read error and read errors of each sector often indicates that memory management like LBA (-> logical block addressing) doesn't fit anymore.
Might be probably a case for datarevovery lab?
You can have a try to mount your image using a cli, (command line interface) running administrator privileges, and photorec or testdisk.
Info:
http://www.cgsecurity.org/wiki/Media_Image

Fiona

Re: Lost data 16GB USB Stick

Posted: 22 Nov 2013, 11:06
by FCKUSB
Yes, thank you, this is also what I though.
I can recover fragments with Photorec from the Image, (like from the stick some days ago) but not the files I'm looking for.
starting from the image, how can I reconstruct the NTFS partition using Testdisk? what are the options I must choose?

Re: Lost data 16GB USB Stick

Posted: 23 Nov 2013, 15:15
by cgrenier
Run "testdisk image.dd", the partition table type should be PC/Intel if you have created an image of the whole disk/usb key, try Analyse, Quick Search, if your partition is found, choose Write, otherwise Deeper Search...

Re: Lost data 16GB USB Stick

Posted: 25 Nov 2013, 14:09
by FCKUSB
It does not open the image file. it says
"TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Unable to open file or device Clé16Go.img"

It's a multifile .img image I have no clue what format uses 001Micron USB Drive Recovery, but it's the only image I have from the disc.