flash drive not readable endmark 0xAA55

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
ddhh
Posts: 23
Joined: 08 Feb 2015, 13:14

flash drive not readable endmark 0xAA55

#1 Post by ddhh »

Hello Team,

I had written the text also in german forum but nobody can help me.
I hope it is ok, if you look to the german forum for the pictures. (name of the threat is "USB Stick nicht mehr lesbar endmark 0xAA55")

At the first picture you can see the filesystem in window (computeradministration), the format is a RAW system. (the flash drive is not formated)
On the second picture, you can see the marked physical drive.
Then I start testdisk with partition table type Intel. you see the message "partition sector doesn´t havet the endmark 0xAA55"
The message with Quick and deep search is "no partition found or selected for recovery".

Then I test the same with Partition Table Type None (FAT32). You can see this on the next 3 pictures.
There I can Boot and Rebuild BS.After this, I get a list of files but if I press N(o), then the clustersearch break at 70%.

I delete the testdisk 64bit version and install the 32bit version. And now the same procedure with able Type None (FAT32).
It doesn´t stop at 70%, now I get 100% and I see more files. I think these are all file on my flash drive.
I press List at the end but I get the errormessage "No file found, filesystem may be damaged". (the last two pictures)

What should I do now?
I would like to copy all these files.
I hope you can help me.

thanks and regards,

ddhh
Posts: 23
Joined: 08 Feb 2015, 13:14

Re: flash drive not readable endmark 0xAA55

#2 Post by ddhh »

Any Idea?
here are the last 3 screens.
FAT32_3.JPG
FAT32_3.JPG (82.73 KiB) Viewed 4819 times
FAT32_5.JPG
FAT32_5.JPG (49.1 KiB) Viewed 4819 times
FAT32_6.JPG
FAT32_6.JPG (35.28 KiB) Viewed 4819 times
I can´t copy the list from the first screen.
What can I do?

ddhh
Posts: 23
Joined: 08 Feb 2015, 13:14

Re: flash drive not readable endmark 0xAA55

#3 Post by ddhh »

Hello,

any idea, what can I do?

ddhh
Posts: 23
Joined: 08 Feb 2015, 13:14

Re: flash drive not readable endmark 0xAA55

#4 Post by ddhh »

this is the new screen, do you have any idea to this one?
FAT32_V7.JPG
FAT32_V7.JPG (39.7 KiB) Viewed 4709 times
after List:
FAT32_V8.JPG
FAT32_V8.JPG (20.43 KiB) Viewed 4709 times

stumpyuk
Posts: 16
Joined: 19 Sep 2012, 11:41

Re: flash drive not readable endmark 0xAA55

#5 Post by stumpyuk »

Just use photorec to recover the files, is it just jpg files you want to recover?

ddhh
Posts: 23
Joined: 08 Feb 2015, 13:14

Re: flash drive not readable endmark 0xAA55

#6 Post by ddhh »

I used photorec.
It finds many files but without the right name (like "f3580954").
Any of this files are not possible to open.
No, there are also excel, word, pdf, ppt files and outlook mails.

ddhh
Posts: 23
Joined: 08 Feb 2015, 13:14

Re: flash drive not readable endmark 0xAA55

#7 Post by ddhh »

any other idea?

what doe´s it mean in my two last screens?

root cluster: 0 (there is no root cluster)
flags: 0000 (???)
info-sector: 1 (???)
backup boot: 6 (???)

RAVEN
Posts: 1
Joined: 31 Mar 2015, 23:37
Location: Tuzla, Bosnia

Re: flash drive not readable endmark 0xAA55

#8 Post by RAVEN »

ddhh, I have the same problem with USB stick. Problem is almost certainly caused by Sality malware. Also my USB drive was almost 100% full when error occurred.

TestDisk was unable to fix the issue, however with PhotRec I was able to recover files. During recovery process, Avast detected Sality.

I will maybe post more information soon.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: flash drive not readable endmark 0xAA55

#9 Post by cgrenier »

When using TestDisk, you can try to force the Root cluster to 2, it's the default values. You may have to enable the Expert mode in Options.

ddhh
Posts: 23
Joined: 08 Feb 2015, 13:14

Re: flash drive not readable endmark 0xAA55

#10 Post by ddhh »

Hi,

in which menu can I change the root cluster size?

Locked