cgsecurity.org

I am trying to recover files from a flash drive at work. It is a SanDisk Cruzer Micro, 4gb. The drive has 1 partition, and it appears as raw in windows. Testdisk seems to recognize it as FAT16, but it fails to find the partition, or any files. I will attach the Log.




Mon Aug 1 11:50:16 2022
Command line: TestDisk

TestDisk 7.2-WIP, Data Recovery Utility, July 2022
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 11.2, Cygwin 3001.4
ext2fs lib: 1.45.3, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.1
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=256058064896
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=4016045568
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=254935286272
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=4013948928
filewin32_getfilesize(\\.\E:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\E:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\E:
Hard disk list
Disk \\.\PhysicalDrive0 - 256 GB / 238 GiB - CHS 31130 255 63, sector size=512 - Intel Raid 1 Volume, S/N:Volume1, FW:1.0.
Disk \\.\PhysicalDrive1 - 4016 MB / 3829 MiB - CHS 488 255 63, sector size=512 - SanDisk Cruzer, S/N:22430311AD816CAF, FW:8.01

Partition table type (auto): Intel
Disk \\.\PhysicalDrive1 - 4016 MB / 3829 MiB - SanDisk Cruzer
Partition table type: Intel

Analyse Disk \\.\PhysicalDrive1 - 4016 MB / 3829 MiB - CHS 488 255 63
Geometry from i386 MBR: head=255 sector=63


test_FAT()
1 P FAT16 >32M 0 2 3 488 2 26 7839744
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 06
Current partition structure:
Invalid FAT boot sector
1 P FAT16 >32M 0 2 3 488 2 26 7839744
1 P FAT16 >32M 0 2 3 488 2 26 7839744

Bad sector count.
No partition is bootable

search_part()
Disk \\.\PhysicalDrive1 - 4016 MB / 3829 MiB - CHS 488 255 63

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk \\.\PhysicalDrive1 - 4016 MB / 3829 MiB - CHS 488 255 63

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Interface Advanced
Geometry from i386 MBR: head=255 sector=63


test_FAT()
1 P FAT16 >32M 0 2 3 488 2 26 7839744
sector_size 0
cluster_size 0
reserved 0
fats 0
dir_entries 0
sectors 0
media 00
fat_length 0
secs_track 0
heads 0
hidden 0
total_sect 0
check_part_i386 failed for partition type 06
1 P FAT16 >32M 0 2 3 488 2 26 7839744

fat1x_boot_sector
1 P FAT16 >32M 0 2 3 488 2 26 7839744
Boot sector
Bad

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.

1 P FAT16 >32M 0 2 3 488 2 26 7839744
rebuild_FAT_BS p_fat12 0, p_fat16 0, p_fat32 1
fat_find_type(max_offset=61312, p_fat12=0, p_fat16=0, p_fat32=1, debug=1, dump_ind=0)
No FAT found, reserved=0, fat_length=0
find_sectors_per_cluster skip_sectors=358 (skip_offset=183296)
Can't find cluster size

fat1x_boot_sector
1 P FAT16 >32M 0 2 3 488 2 26 7839744
Boot sector
Bad

A valid FAT Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

What exactly is your question?

Im wondering if recovery is possible. Ive follwed the other threads with the same issue, and it worked for them, but not for me. This sofware probably isnt enough, but I was really hoping to avoid paying for a sofware/service.

Have you tried the deep search after the normal search?

Yes, it did not find anything.

What information was located on the stick?
Is the USB stick encrypted?