flash drive not readable endmark 0xAA55

How to use TestDisk to recover lost partition
Message
Author
ddhh
Posts: 23
Joined: 08 Feb 2015, 13:14

flash drive not readable endmark 0xAA55

#1 Post by ddhh » 17 Feb 2015, 23:17

Hello Team,

I had written the text also in german forum but nobody can help me.
I hope it is ok, if you look to the german forum for the pictures. (name of the threat is "USB Stick nicht mehr lesbar endmark 0xAA55")

At the first picture you can see the filesystem in window (computeradministration), the format is a RAW system. (the flash drive is not formated)
On the second picture, you can see the marked physical drive.
Then I start testdisk with partition table type Intel. you see the message "partition sector doesn´t havet the endmark 0xAA55"
The message with Quick and deep search is "no partition found or selected for recovery".

Then I test the same with Partition Table Type None (FAT32). You can see this on the next 3 pictures.
There I can Boot and Rebuild BS.After this, I get a list of files but if I press N(o), then the clustersearch break at 70%.

I delete the testdisk 64bit version and install the 32bit version. And now the same procedure with able Type None (FAT32).
It doesn´t stop at 70%, now I get 100% and I see more files. I think these are all file on my flash drive.
I press List at the end but I get the errormessage "No file found, filesystem may be damaged". (the last two pictures)

What should I do now?
I would like to copy all these files.
I hope you can help me.

thanks and regards,

Sponsored links

ddhh
Posts: 23
Joined: 08 Feb 2015, 13:14

Re: flash drive not readable endmark 0xAA55

#2 Post by ddhh » 20 Feb 2015, 23:19

Any Idea?
here are the last 3 screens.
FAT32_3.JPG
FAT32_3.JPG (82.73 KiB) Viewed 1199 times
FAT32_5.JPG
FAT32_5.JPG (49.1 KiB) Viewed 1199 times
FAT32_6.JPG
FAT32_6.JPG (35.28 KiB) Viewed 1199 times
I can´t copy the list from the first screen.
What can I do?

ddhh
Posts: 23
Joined: 08 Feb 2015, 13:14

Re: flash drive not readable endmark 0xAA55

#3 Post by ddhh » 06 Mar 2015, 21:22

Hello,

any idea, what can I do?

ddhh
Posts: 23
Joined: 08 Feb 2015, 13:14

Re: flash drive not readable endmark 0xAA55

#4 Post by ddhh » 21 Mar 2015, 11:20

this is the new screen, do you have any idea to this one?
FAT32_V7.JPG
FAT32_V7.JPG (39.7 KiB) Viewed 1089 times
after List:
FAT32_V8.JPG
FAT32_V8.JPG (20.43 KiB) Viewed 1089 times

stumpyuk
Posts: 16
Joined: 19 Sep 2012, 11:41

Re: flash drive not readable endmark 0xAA55

#5 Post by stumpyuk » 24 Mar 2015, 16:00

Just use photorec to recover the files, is it just jpg files you want to recover?

ddhh
Posts: 23
Joined: 08 Feb 2015, 13:14

Re: flash drive not readable endmark 0xAA55

#6 Post by ddhh » 24 Mar 2015, 20:57

I used photorec.
It finds many files but without the right name (like "f3580954").
Any of this files are not possible to open.
No, there are also excel, word, pdf, ppt files and outlook mails.

ddhh
Posts: 23
Joined: 08 Feb 2015, 13:14

Re: flash drive not readable endmark 0xAA55

#7 Post by ddhh » 29 Mar 2015, 20:44

any other idea?

what doe´s it mean in my two last screens?

root cluster: 0 (there is no root cluster)
flags: 0000 (???)
info-sector: 1 (???)
backup boot: 6 (???)

RAVEN
Posts: 1
Joined: 31 Mar 2015, 23:37
Location: Tuzla, Bosnia

Re: flash drive not readable endmark 0xAA55

#8 Post by RAVEN » 31 Mar 2015, 23:44

ddhh, I have the same problem with USB stick. Problem is almost certainly caused by Sality malware. Also my USB drive was almost 100% full when error occurred.

TestDisk was unable to fix the issue, however with PhotRec I was able to recover files. During recovery process, Avast detected Sality.

I will maybe post more information soon.

User avatar
cgrenier
Site Admin
Posts: 3571
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: flash drive not readable endmark 0xAA55

#9 Post by cgrenier » 02 Apr 2015, 07:07

When using TestDisk, you can try to force the Root cluster to 2, it's the default values. You may have to enable the Expert mode in Options.

ddhh
Posts: 23
Joined: 08 Feb 2015, 13:14

Re: flash drive not readable endmark 0xAA55

#10 Post by ddhh » 15 Apr 2015, 18:42

Hi,

in which menu can I change the root cluster size?

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests