USB HDD - Unknown USBC Sector

[gps31]

Today Received one Seagate 1TB Desktop HDD with err askking Format the Partition.

Background:

1TB desktop hdd is connected with USB box(unknown brand) to System Then windows asked to Format the Partition.

Problem:

On Checking Sectors in HxD editor the sector 2048 looks

NTFS BS is in 2049

Further checking in First 4GB image there are 7102 Sectors begin with USBC.. , All sectors are not same they are different)

Example Sectors 2048 2064 2328 2376 2384 2392 is attached here

6-USBC.zip

(3 KiB) Downloaded 228 times

(Remove Zip Ext - Open in Hex Editor)

Removing sector 2048 (2049 become 2048) got some Partial Directory Structure

Is there any Automated Solution for this?

[Amarbir[CDR-Labs]]

Hello ,
GPS Joep sir has done some work on this ,I have never come across this issue ,But shifting sectors like the way you did is the solution ,In PC 3000 this can be done with Data Extractor IMHO

BTW : Try changing this drives heads

[fzabkar]

If there is no automatic solution, I could write a tool to remove these sectors.

[Arch Stanton]

ISOBuster is supposed to detect and take care of it.

If there's just a few of them you can take care of it in hex editor like I did here: https://youtu.be/xfhu96N5JR4. Blogpost has become a but messy as I looked into it every now and then and then dropped it again: https://www.disktuna.com/sudden-appeara ... and-files/.

So idea is decode USBC sector to find out how many sectors it was writing at the time. Let's say 8. We shift sector 2 - 7 up one LBA (and so overwriting the USBC sector). We fill sector 8 with zeros.

[Arch Stanton]

Removing sector 2048 (2049 become 2048) got some Partial Directory Structure

What do you mean 'remove'? You should not just remove the sector from a disk image, it will affect everything following it! That would truly shift everything following it by one sector for each USBC sector you remove. Overwriting it on original media will affect recovery: If sector was first sector of a directory then your recovery software may not detect the directory at all.

[Arch Stanton]

So idea is decode USBC sector to find out how many sectors it was writing at the time. Let's say 8. We shift sector 2 - 7 up one LBA (and so overwriting the USBC sector). We fill sector 8 with zeros.

So this I wrote down wrong, sorry. I can no longer edit the message.

We shift up 2nd upto 8th sector one LBA, then fill 8 th sector with zeros (assuming block of 8 sectors was written, again you need to decode the USBC sector to get actual value and take WORD value at offset 22 (zero base), MSB first). So in your example \x10 (16 decimal).

So this (assuming 8 sectors):

USBC
SECTOR 2
SECTOR 3
SECTOR 4
SECTOR 5
SECTOR 6
SECTOR 7
SECTOR 8

becomes this:

SECTOR 1 (was 2)
SECTOR 2 (was 3)
SECTOR 3 …
SECTOR 4
SECTOR 5
SECTOR 6
SECTOR 7
ZERO FILLED SECTOR

So yes, we lost one sector, but we did already when block of sectors was written.

[Doomer]

USBC is a USB bulk mass storage signature - https://social.msdn.microsoft.com/Forum ... ?forum=wdk

basically it's a USB packet that ended up written to a data sector, clearly USB chip firmware glitch.

[Amarbir[CDR-Labs]]

USBC is a USB bulk mass storage signature - https://social.msdn.microsoft.com/Forum ... ?forum=wdk

basically it's a USB packet that ended up written to a data sector, clearly USB chip firmware glitch.

Dommer Sir ,
If its a Firmware Glitch Then Replacement of Heads is no solution the way i was thinking .

[Amarbir[CDR-Labs]]

Today Received one Seagate 1TB Desktop HDD with err askking Format the Partition.

Background:

1TB desktop hdd is connected with USB box(unknown brand) to System Then windows asked to Format the Partition.

Problem:

On Checking Sectors in HxD editor the sector 2048 looks

2048.jpg

NTFS BS is in 2049

Further checking in First 4GB image there are 7102 Sectors begin with USBC.. , All sectors are not same they are different)

Example Sectors 2048 2064 2328 2376 2384 2392 is attached here

6-USBC.zip

(Remove Zip Ext - Open in Hex Editor)

Removing sector 2048 (2049 become 2048) got some Partial Directory Structure

Is there any Automated Solution for this?

GPS ,
Joep sir has summed it up very well here -> https://www.disktuna.com/sudden-appeara ... and-files/

[Arch Stanton]

Today Received one Seagate 1TB Desktop HDD with err askking Format the Partition.

Background:

1TB desktop hdd is connected with USB box(unknown brand) to System Then windows asked to Format the Partition.

Problem:

On Checking Sectors in HxD editor the sector 2048 looks

2048.jpg

NTFS BS is in 2049

Further checking in First 4GB image there are 7102 Sectors begin with USBC.. , All sectors are not same they are different)

Example Sectors 2048 2064 2328 2376 2384 2392 is attached here

6-USBC.zip

(Remove Zip Ext - Open in Hex Editor)

Removing sector 2048 (2049 become 2048) got some Partial Directory Structure

Is there any Automated Solution for this?

GPS ,
Joep sir has summed it up very well here -> https://www.disktuna.com/sudden-appeara ... and-files/

Yeah, it's a bit messy and while back when I was still wondering about this I made some false assumptions that are still in that post. I need to clean it up a little.