All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 15 posts ] 
Author Message
 Post subject: Corrupted File Names
PostPosted: November 14th, 2017, 14:55 
Offline

Joined: May 28th, 2016, 9:16
Posts: 78
Location: Karlsruhe / Germany
Hi,

currently I have a USB Stick on my table. The customer just pulled the stick out of his Windows Machine without unmounting it. After he put the stick back in, the file names were corrupted.

The USB Stick reads without problems. With Testdisk I can't restore the Data. So I tried with R-Studio. With R-Studio I get with the Detailed Scan I got the "Root" folder with the corrupted File Names, but I also got $ROOT0001,$ROOT0002,..... Directories with readable Files and normal names in it.

So I was wondering, if there is any thing I can do about it to get eventually the whole data with it's original structure back.


Attachments:
Screenshot 2017-11-14 19.35.40.png
Screenshot 2017-11-14 19.35.40.png [ 160.89 KiB | Viewed 1342 times ]
Top
 Profile  
 
 Post subject: Re: Corrupted File Names
PostPosted: November 14th, 2017, 19:12 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 2973
Location: Adelaide, Australia
first, take an image of the complete disk (NOT the partition, the whole disk)
can do it in DMDE by:
1. Insert USB, close any windows dialogs, don't try to open it.
2. Once everything is stable, run DMDE, click on the USB disk to select it and choose OK.
3. Any errors or whatever, click ok, cancel or abort.. but don't close the main disk window
4. Right-click on drive and choose create Image / clone and at bottom in "destination" area choose "file"
Attachment:
dmde_image.jpg
dmde_image.jpg [ 65.14 KiB | Viewed 1324 times ]

now load this file into any DR program. this way you wont do any more damage to the original. It will also be a bit faster recovery attempts as well.

you will probably want to do a raw scan, and depending on the software you use, it can be alittle different setting it up. Try "R-Studio" "Recuva" "GetDataback"

I see you tried R-Studio. Probably the best result is files working, Dir structure may be lost due to FAT corruption. Guessing it is exFAT or FAT32?


Top
 Profile  
 
 Post subject: Re: Corrupted File Names
PostPosted: November 15th, 2017, 3:27 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2190
Location: Kuwait
D_R wrote:
Hi,

currently I have a USB Stick on my table. The customer just pulled the stick out of his Windows Machine without unmounting it. After he put the stick back in, the file names were corrupted.

The USB Stick reads without problems. With Testdisk I can't restore the Data. So I tried with R-Studio. With R-Studio I get with the Detailed Scan I got the "Root" folder with the corrupted File Names, but I also got $ROOT0001,$ROOT0002,..... Directories with readable Files and normal names in it.

So I was wondering, if there is any thing I can do about it to get eventually the whole data with it's original structure back.


This is a typical CONTROLLER issue, those app. will not help in most cases
seek Pro. help better and the more you leave it connected the more damage will effect the mem. chip

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
 Post subject: Re: Corrupted File Names
PostPosted: November 15th, 2017, 3:55 
Offline
User avatar

Joined: July 12th, 2014, 6:24
Posts: 74
Location: Germany
+1 controller issue. I just had a case that looked like yours (CF card from camera). RAW recovery found some cr2-files but all were damaged. With chip-off it was a full recovery except filesystem data (file names).

_________________
Daten-Engel Datenrettung (Germany)
http://www.030-datenrettung.de


Top
 Profile  
 
 Post subject: Re: Corrupted File Names
PostPosted: November 15th, 2017, 4:58 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9786
Location: Australia
I have experienced much the same problem on several occasions with my own USB-connected external HDD. In each case the directory (FAT32) was corrupted after a hung data transfer (JMicron bridge). My vote is for a logical fault.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Corrupted File Names
PostPosted: November 15th, 2017, 12:06 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 2376
Location: CDRLabs @ Chandigarh [ India ]
Well,
Do you have a image of your USB Flash Disc Can You Post It Here .Might Be We Can Figure Out What Kinda Chipoff it Is if indeed it is a chipoff case

_________________
Regards
Amarbir S Dhillon
CDRLabs Data Recovery - [ Chandigarh ,India ]
My Data Recovery Experiments - > https://www.facebook.com/chandigarhdatarecovery


Top
 Profile  
 
 Post subject: Re: Corrupted File Names
PostPosted: November 15th, 2017, 15:10 
Offline

Joined: May 28th, 2016, 9:16
Posts: 78
Location: Karlsruhe / Germany
Guys, why do you think, it's a chip off Job? There is just a corrupt Fat32. All of the Data is OK, just the Root directory Structure is broken. The client got the More or less broken directory Structure back (DE from R-Studio) and additionally the Extraction by Modification Date of 2017 and now he is happy and can work on.


Top
 Profile  
 
 Post subject: Re: Corrupted File Names
PostPosted: November 15th, 2017, 15:13 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9786
Location: Australia
D_R wrote:
Guys, why do you think, it's a chip off Job?

When your only tool is a hammer, then every problem looks like a nail.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Corrupted File Names
PostPosted: November 15th, 2017, 19:56 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 2973
Location: Adelaide, Australia
at times it is a very good hammer.

As this Guy is a DR Pro, I am guessing he is charging for recovery. I don't know about the rest of the world but in AU anything getting near or over $100 will be getting close to being rejected. If you want to earn money for your jobs, then anything more than 2 - 3 hrs you are essentially paying out of your pocket to recover peoples DATA.

for these, sometime the controller goes crazy, starts killing blocks and as it gets to the FAT then problems are noticeable and can be blamed on just corrupt FAT.

Every time you power on a device with dodgy controller you risk more data.

It would be nice to be able to diagnose what is actually wrong with a USB drive, but how, really are you going to do it barring simple component failure?


Top
 Profile  
 
 Post subject: Re: Corrupted File Names
PostPosted: November 16th, 2017, 10:16 
Offline

Joined: May 28th, 2016, 9:16
Posts: 78
Location: Karlsruhe / Germany
HaQue wrote:
I don't know about the rest of the world but in AU anything getting near or over $100 will be getting close to being rejected.

Who is going to reject the recovery? The DR-Company or the client?
And if you are talking about the client, so how does a chip off job fit into your statement?

It's one thing to put the USB-Stick into the Computer and let R-Studio do it's job. On the other hand we have the Chip-Off job, where I have to work.

HaQue wrote:
If you want to earn money for your jobs, then anything more than 2 - 3 hrs you are essentially paying out of your pocket to recover peoples DATA.

I'd say, it depends on the case. Normally I work for companies. And they calculate. If a single day for one employee costs the company 800€, they have no problem to pay 1-2k to get the work of a week back.

HaQue wrote:
for these, sometime the controller goes crazy, starts killing blocks and as it gets to the FAT then problems are noticeable and can be blamed on just corrupt FAT.

Every time you power on a device with dodgy controller you risk more data.


Hm? I havn't seen USB-Sticks / Controllers that are performing Refreshing procedures or wear leveling without writing commands to the Controller.


Top
 Profile  
 
 Post subject: Re: Corrupted File Names
PostPosted: November 16th, 2017, 11:05 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 2376
Location: CDRLabs @ Chandigarh [ India ]
fzabkar wrote:
D_R wrote:
Guys, why do you think, it's a chip off Job?

When your only tool is a hammer, then every problem looks like a nail.



Nah ,
My statement was just i wanted to have at his product ,Chances Are 50:50 if indeed its logical or physical .My experience with chipoff was a bit different as far as how the usb flash drives behave

_________________
Regards
Amarbir S Dhillon
CDRLabs Data Recovery - [ Chandigarh ,India ]
My Data Recovery Experiments - > https://www.facebook.com/chandigarhdatarecovery


Top
 Profile  
 
 Post subject: Re: Corrupted File Names
PostPosted: November 17th, 2017, 0:01 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 2973
Location: Adelaide, Australia
D_R wrote:
HaQue wrote:
I don't know about the rest of the world but in AU anything getting near or over $100 will be getting close to being rejected.

Who is going to reject the recovery? The DR-Company or the client?
And if you are talking about the client, so how does a chip off job fit into your statement?

It's one thing to put the USB-Stick into the Computer and let R-Studio do it's job. On the other hand we have the Chip-Off job, where I have to work.

I am talking about client rejecting. I just don't see a lot of company devices here. Regular population cant lose the stuff.. unless it starts to get over $100 and then for some reason it isn't so important. Yes even chip-off needs to be around that cost.
You forgot to mention the other modes of recovery, that Franc talks about - Electronic repair and manual file system work.
D_R wrote:
HaQue wrote:
If you want to earn money for your jobs, then anything more than 2 - 3 hrs you are essentially paying out of your pocket to recover peoples DATA.

I'd say, it depends on the case. Normally I work for companies. And they calculate. If a single day for one employee costs the company 800€, they have no problem to pay 1-2k to get the work of a week back.

1-2k for a flash drive simply because they need it and will pay, to me that's extortion. I wouldn't charge a thirsty man $200 for a glass of water simply because he is dying of thirst.
D_R wrote:
HaQue wrote:
for these, sometime the controller goes crazy, starts killing blocks and as it gets to the FAT then problems are noticeable and can be blamed on just corrupt FAT.

Every time you power on a device with dodgy controller you risk more data.


Hm? I havn't seen USB-Sticks / Controllers that are performing Refreshing procedures or wear leveling without writing commands to the Controller.

how do we know what the controller is doing? It is one a small 8/16/32 bit computer with any one of a hundred combinations of type of its own RAM, either software or hardware blocks of code to do various wear levelling, ECC, whitening (XOR), encryption etc... we really have no insight into what they are doing.. we can see the symptom, but only guess at the cause.

seen quite a few devices with blocks missing/zero'd out, copied many times

back to my point, where I think we agree.. r-studio or chip off is going to be the way most DR shops go, unless a particular job takes their fancy


Top
 Profile  
 
 Post subject: Re: Corrupted File Names
PostPosted: November 17th, 2017, 4:38 
Offline
User avatar

Joined: July 12th, 2010, 4:38
Posts: 1031
Location: Portugal
[/quote]
1-2k for a flash drive simply because they need it and will pay, to me that's extortion. I wouldn't charge a thirsty man $200 for a glass of water simply because he is dying of thirst.
[quote="D_R"]
[quote="HaQue"]

One of the best phrases I ever read here. My point too...

@HaQue : we will never get rich ahahhahahha

_________________
http://www.facebook.com/PCLAB.Assistencia.Tecnica
ACELab partner


Top
 Profile  
 
 Post subject: Re: Corrupted File Names
PostPosted: November 17th, 2017, 7:04 
Offline

Joined: May 28th, 2016, 9:16
Posts: 78
Location: Karlsruhe / Germany
HaQue wrote:
1-2k for a flash drive simply because they need it and will pay, to me that's extortion. I wouldn't charge a thirsty man $200 for a glass of water simply because he is dying of thirst.


Well... Others do....

What does the new iPhone X costs in Parts? 200-300 USD. Apple is selling it for over 1k. That's the free market. And in my opinion it's not extortion, because the customer still has the possibility to get the Data back simply by doing the job one more time. Or going to a local PC Shop, where they are going to kill the data.

And....
About 6 Years ago, I got some problems with the waste water pipe in my house. So I called a local company for help. They charged me 800€ for about 1,25h of work. 120€ for every starting hour. Then a fee for driving. A fee for the cleaning machine. For the inspection camera. I didn't want to pay this, but I lost in court. Compared to this, charging 1-2k for DR for a B2B Job is fair and in 99% of all cases in the Budget of the Company.

Or maybe we also should charge a fee for PC3k, Clean Room, or using a HDD-Surgery Ramp Set - Everything much more expensive than the machines of the pipe cleaning guy. :twisted:


Top
 Profile  
 
 Post subject: Re: Corrupted File Names
PostPosted: November 17th, 2017, 7:58 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 2973
Location: Adelaide, Australia
you do definitely need to charge to cover costs of tools/lic/software/power/years of building knowledge etc, but some just go overboard.

if you pay for xray of monolith, spend time(your time is worth/costing you a certain amount per hour just by taking you away from other potentially easier paying jobs), deducing pinout, time dumping, time in your software re-building image, time copying image, recover data, copying to storage, notifying customer, spending time when they come in gas-bagging about random stuff.. the you could easily JUSTIFY $1,000..
BUT.. you get to a situation where many jobs will not go ahead, so your experience is less, your ability doesn't progress fast and each job is a hard slog. You just will not be successful. let alone all the time you need to research flash.

I have a situation now where I have a lot of cases that are just plain hard it is starting to be a problem.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 15 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group