fixing a USB disk on key (Win 7)

[zmau]

Hi!

I just got back from a nice trip in Sri Lanka (VERY nice).

All my pictures have been copied to a USB DOK (Since the camera can not hold all pictures).
I had started to copy all of the pictures whne I got home (Win 7 - 64 bit), and after about 20 pictures the system stopped copying with a funny message.
The message was something like "the file has been changed". The message contained some error code (I did not record it, sorry).
Now I can not access the USB disk any more (It says that the disk should be formated before usage).
Of course I did not format. Intead I used "HDD Raw Copy Tool" to make a raw copy.

Funny, but I was unable to find a guide for this situation.

The pictures are very important to me. What should I do now ?


Thanks
zmau

[ShaneWard]

Might have corrupted the main partition on the USB stick. I am not sure that scanning the drive with scandisk will work. Might have to use a recovery software.

Shane

[pcimage]

You've made a raw copy, right?

Why not scan that with some recovery software, like rstudio or getdataback?

[labtech]

1) What is the capacity of the flash drive?
2) What is the size of the copy?

[zmau]

Thank you all.
My problem was that I could not find a recovery tool that worked.

It looks that getdataback did the job very nicely. I did not try rstudio (So I do not know if it would have worked).
I bought the getdataback bundle (which costed me 119$).

labtech: The DOK size is 8 GB (I bought in in the trip so there is no brand name....). The size of the copy is ‎5.67 GB Why does it matter ?


Thanks
zmau

[labtech]

Often people fall victim to fake flash drives. So, wanted to rule that out.
Though the copy is not the exact same size (maybe you chose compressed version image type), it seems like things worked out.

[zmau]

Hi all once again.

I have some more information.....

I had noticed that not all files had been recovered, so I tryed rstudio (the other tool that was suggested by "pcimage").
The results were disapointing. It did not find almost anything, and I was not able to see what it did find.

So, the bottom line is that I am missing about 20-50 pictures (out of about 1000). Is there another tool to try ?
Do not get me wrong, I am pretty happy.


Thanks again
zmau

[LarrySabo]

PhotoRec has recovered photos for me with less damage than GetDataBack on occasion.

[HaQue]

You can send the USB drive to a DR pro and he can unsolder the NAND to try and read the Chip directly. There may be a possibility of more recovery.

[Keatah]

Sounds like this is a matter of file-carving.

[fzabkar]

http://www.mediacarve.com/
http://foremost.sourceforge.net/

Could we see sector 0 of the copy? I'm curious to see why the size of your raw copy is only 5.67GB.

[jerovsek]

Hello,

try this one http://www.powerdatarecovery.com
Version 6.5 is free for home users. You can donate, if program is usefull for you.
Otherwise send it ot DR.

[zmau]

Thank you all :

Sorry for the long time to answer. It tool me a long time to use the second tool....

Here is some more information:
I had tries PhotoRec which was suggested by LarrySabo.
This tool works differently then GetDataBack, and for me it gave a lot of work (To process the output).

Explanation:
GetDataBack tries to restore the original file system, and then finds the files (With the original file names).
The pictures where orgenized by folders (Every time I download from the Camera I create a new folder). and GetDataBack did not find just one forlder. So, the results where very convinient to process.
PhotoRec ont the other hand just scans the DOK for files (Pictures movies etc.).
The resuls where 3 folders with about a thousand pictures each:
1) Many "pictures" where not really a picture.
2) Many files where duplicated tripled and even more then that (some in different folders).
I guess that this is a result of different algoritms.
3) The files had new names so it was hard to have the picture's order.
It would have helped me to use a "duplicate file finder" immediately after PhotoRec gave it's output (maybe they can incorporate it into their tool ???). I thought about it very late.

After a lot of work I went to compare with the results of GetDataBack.
GetDataBack gave me 1436 pictures.
PhotoRec gave me 1279 (WHich I think stil contains duplicates).
Still it was worth it, because PhotoRec found most of the lost pictures.

I am a little tired to try more tools.....

fzabkar

Could we see sector 0 of the copy

1) Please give me instruction as to how can I give you "sector 0 of the copy". First of all how can I extract it from the file.
2) I can mail you the DOK if you want. Just give me an address.
Nice pictures (just do not spread them).



Thanks
zmau

[LarrySabo]

zmau,

Thanks for the update. I recommended PhotoRec because of a small test I did a couple of years ago. Here is what I posted about my results in another forum at the time...

Had a job to recover pictures from a 4GB flash drive last week and thought the following results comparison might be of interest:

- Recuva undeleted 197 pictures, of which 177 were readable (not "X"ed out)
- GetDataBack FAT recovered 221 usable pictures, plus some partial images
- PhotoRec (free for private and commercial use!) recovered 354 good images!

PhotoRec also recovers other file types and was pretty fast. I'm definitely going to experiment with using it in addition to my other recovery programs in the future. Surprising how it was so successful at recovering pictures that were "broken" or incomplete when recovered using the other programs.

[fzabkar]

1) Please give me instruction as to how can I give you "sector 0 of the copy". First of all how can I extract it from the file.

Sector 0 would be the first 512 bytes (= 0x200 in hexadecimal) of the image file. You could use a hex editor such as HxD to view this file.

[HaQue]

Had a job to recover pictures from a 4GB flash drive last week and thought the following results comparison might be of interest:

- Recuva undeleted 197 pictures, of which 177 were readable (not "X"ed out)
- GetDataBack FAT recovered 221 usable pictures, plus some partial images
- PhotoRec (free for private and commercial use!) recovered 354 good images!

PhotoRec also recovers other file types and was pretty fast. I'm definitely going to experiment with using it in addition to my other recovery programs in the future.
Surprising how it was so successful at recovering pictures that were "broken" or incomplete when recovered using the other programs.

It is possible that Recuva and GetDataBack recover the files only, meaning they recover from the source what they can find and copy back to your target only this, corruptions of the files as well as good files.

PhotoRec possibly could recover the files and do some analysis of the file and fix up the file header to make the photo display correctly, or mostly correctly.. a byte or two corrupted in a picture file header can have some pretty major effects, and if PhotoRec was smart enough I guess it would be fairly easy to fix up the header.
speculation though.