Corrupted File Names

[D_R]

Hi,

currently I have a USB Stick on my table. The customer just pulled the stick out of his Windows Machine without unmounting it. After he put the stick back in, the file names were corrupted.

The USB Stick reads without problems. With Testdisk I can't restore the Data. So I tried with R-Studio. With R-Studio I get with the Detailed Scan I got the "Root" folder with the corrupted File Names, but I also got $ROOT0001,$ROOT0002,..... Directories with readable Files and normal names in it.

So I was wondering, if there is any thing I can do about it to get eventually the whole data with it's original structure back.

Attachments

[HaQue]

first, take an image of the complete disk (NOT the partition, the whole disk)
can do it in DMDE by:
1. Insert USB, close any windows dialogs, don't try to open it.
2. Once everything is stable, run DMDE, click on the USB disk to select it and choose OK.
3. Any errors or whatever, click ok, cancel or abort.. but don't close the main disk window
4. Right-click on drive and choose create Image / clone and at bottom in "destination" area choose "file"

now load this file into any DR program. this way you wont do any more damage to the original. It will also be a bit faster recovery attempts as well.

you will probably want to do a raw scan, and depending on the software you use, it can be alittle different setting it up. Try "R-Studio" "Recuva" "GetDataback"

I see you tried R-Studio. Probably the best result is files working, Dir structure may be lost due to FAT corruption. Guessing it is exFAT or FAT32?

[einstein9]

Hi,

currently I have a USB Stick on my table. The customer just pulled the stick out of his Windows Machine without unmounting it. After he put the stick back in, the file names were corrupted.

The USB Stick reads without problems. With Testdisk I can't restore the Data. So I tried with R-Studio. With R-Studio I get with the Detailed Scan I got the "Root" folder with the corrupted File Names, but I also got $ROOT0001,$ROOT0002,..... Directories with readable Files and normal names in it.

So I was wondering, if there is any thing I can do about it to get eventually the whole data with it's original structure back.

This is a typical CONTROLLER issue, those app. will not help in most cases
seek Pro. help better and the more you leave it connected the more damage will effect the mem. chip

[pcn]

+1 controller issue. I just had a case that looked like yours (CF card from camera). RAW recovery found some cr2-files but all were damaged. With chip-off it was a full recovery except filesystem data (file names).

[fzabkar]

I have experienced much the same problem on several occasions with my own USB-connected external HDD. In each case the directory (FAT32) was corrupted after a hung data transfer (JMicron bridge). My vote is for a logical fault.

[Amarbir[CDR-Labs]]

Well,
Do you have a image of your USB Flash Disc Can You Post It Here .Might Be We Can Figure Out What Kinda Chipoff it Is if indeed it is a chipoff case

[D_R]

Guys, why do you think, it's a chip off Job? There is just a corrupt Fat32. All of the Data is OK, just the Root directory Structure is broken. The client got the More or less broken directory Structure back (DE from R-Studio) and additionally the Extraction by Modification Date of 2017 and now he is happy and can work on.

[fzabkar]

Guys, why do you think, it's a chip off Job?

When your only tool is a hammer, then every problem looks like a nail.

[HaQue]

at times it is a very good hammer.

As this Guy is a DR Pro, I am guessing he is charging for recovery. I don't know about the rest of the world but in AU anything getting near or over $100 will be getting close to being rejected. If you want to earn money for your jobs, then anything more than 2 - 3 hrs you are essentially paying out of your pocket to recover peoples DATA.

for these, sometime the controller goes crazy, starts killing blocks and as it gets to the FAT then problems are noticeable and can be blamed on just corrupt FAT.

Every time you power on a device with dodgy controller you risk more data.

It would be nice to be able to diagnose what is actually wrong with a USB drive, but how, really are you going to do it barring simple component failure?

[D_R]

I don't know about the rest of the world but in AU anything getting near or over $100 will be getting close to being rejected.

Who is going to reject the recovery? The DR-Company or the client?
And if you are talking about the client, so how does a chip off job fit into your statement?

It's one thing to put the USB-Stick into the Computer and let R-Studio do it's job. On the other hand we have the Chip-Off job, where I have to work.

If you want to earn money for your jobs, then anything more than 2 - 3 hrs you are essentially paying out of your pocket to recover peoples DATA.

I'd say, it depends on the case. Normally I work for companies. And they calculate. If a single day for one employee costs the company 800€, they have no problem to pay 1-2k to get the work of a week back.

for these, sometime the controller goes crazy, starts killing blocks and as it gets to the FAT then problems are noticeable and can be blamed on just corrupt FAT.

Every time you power on a device with dodgy controller you risk more data.

Hm? I havn't seen USB-Sticks / Controllers that are performing Refreshing procedures or wear leveling without writing commands to the Controller.

[Amarbir[CDR-Labs]]

Guys, why do you think, it's a chip off Job?

When your only tool is a hammer, then every problem looks like a nail.

Nah ,
My statement was just i wanted to have at his product ,Chances Are 50:50 if indeed its logical or physical .My experience with chipoff was a bit different as far as how the usb flash drives behave

[HaQue]

I don't know about the rest of the world but in AU anything getting near or over $100 will be getting close to being rejected.

Who is going to reject the recovery? The DR-Company or the client?
And if you are talking about the client, so how does a chip off job fit into your statement?

It's one thing to put the USB-Stick into the Computer and let R-Studio do it's job. On the other hand we have the Chip-Off job, where I have to work.

I am talking about client rejecting. I just don't see a lot of company devices here. Regular population cant lose the stuff.. unless it starts to get over $100 and then for some reason it isn't so important. Yes even chip-off needs to be around that cost.
You forgot to mention the other modes of recovery, that Franc talks about - Electronic repair and manual file system work.

If you want to earn money for your jobs, then anything more than 2 - 3 hrs you are essentially paying out of your pocket to recover peoples DATA.

I'd say, it depends on the case. Normally I work for companies. And they calculate. If a single day for one employee costs the company 800€, they have no problem to pay 1-2k to get the work of a week back.

1-2k for a flash drive simply because they need it and will pay, to me that's extortion. I wouldn't charge a thirsty man $200 for a glass of water simply because he is dying of thirst.

for these, sometime the controller goes crazy, starts killing blocks and as it gets to the FAT then problems are noticeable and can be blamed on just corrupt FAT.

Every time you power on a device with dodgy controller you risk more data.

Hm? I havn't seen USB-Sticks / Controllers that are performing Refreshing procedures or wear leveling without writing commands to the Controller.

how do we know what the controller is doing? It is one a small 8/16/32 bit computer with any one of a hundred combinations of type of its own RAM, either software or hardware blocks of code to do various wear levelling, ECC, whitening (XOR), encryption etc... we really have no insight into what they are doing.. we can see the symptom, but only guess at the cause.

seen quite a few devices with blocks missing/zero'd out, copied many times

back to my point, where I think we agree.. r-studio or chip off is going to be the way most DR shops go, unless a particular job takes their fancy

[pclab]

[/quote]
1-2k for a flash drive simply because they need it and will pay, to me that's extortion. I wouldn't charge a thirsty man $200 for a glass of water simply because he is dying of thirst.
[quote="D_R"]
[quote="HaQue"]

One of the best phrases I ever read here. My point too...

@HaQue : we will never get rich ahahhahahha

[D_R]

1-2k for a flash drive simply because they need it and will pay, to me that's extortion. I wouldn't charge a thirsty man $200 for a glass of water simply because he is dying of thirst.

Well... Others do....

What does the new iPhone X costs in Parts? 200-300 USD. Apple is selling it for over 1k. That's the free market. And in my opinion it's not extortion, because the customer still has the possibility to get the Data back simply by doing the job one more time. Or going to a local PC Shop, where they are going to kill the data.

And....
About 6 Years ago, I got some problems with the waste water pipe in my house. So I called a local company for help. They charged me 800€ for about 1,25h of work. 120€ for every starting hour. Then a fee for driving. A fee for the cleaning machine. For the inspection camera. I didn't want to pay this, but I lost in court. Compared to this, charging 1-2k for DR for a B2B Job is fair and in 99% of all cases in the Budget of the Company.

Or maybe we also should charge a fee for PC3k, Clean Room, or using a HDD-Surgery Ramp Set - Everything much more expensive than the machines of the pipe cleaning guy.

[HaQue]

you do definitely need to charge to cover costs of tools/lic/software/power/years of building knowledge etc, but some just go overboard.

if you pay for xray of monolith, spend time(your time is worth/costing you a certain amount per hour just by taking you away from other potentially easier paying jobs), deducing pinout, time dumping, time in your software re-building image, time copying image, recover data, copying to storage, notifying customer, spending time when they come in gas-bagging about random stuff.. the you could easily JUSTIFY $1,000..
BUT.. you get to a situation where many jobs will not go ahead, so your experience is less, your ability doesn't progress fast and each job is a hard slog. You just will not be successful. let alone all the time you need to research flash.

I have a situation now where I have a lot of cases that are just plain hard it is starting to be a problem.