PFconcept 1GB USB stick - partition turned into RAW

[kotel]

Hi

Today I went to plug this USB stick After plugging it in was greeted with the USB drive needs to be checked for errors. It found some but couldn't fix it. There's not so much important stuff on there, but its gonna be pain for me to find the files scattered across multiple computers. I have tried DMDE, which found some files, but all of them were corrupted. I've read about Rstudio and Rundelete, but I have concerns about the safety of them. Flash drive gets pretty hot on both the controller and memory (hotter than back when it was working). Does anybody know if Rstudio and Rundelete are safe and what to try next? I am pretty much a newbie to recovery data.

[fzabkar]

Rstudio and Rundelete are safe (pros use R-Studio).

I would first clone the drive to an image file on your HDD using the Tools -> Copy Sectors feature of DMDE. Then you can run data recovery software against the clone.

Software used by DR pros:

https://www.hddoracle.com/viewtopic.php?f=36&t=3208

[kotel]

Rstudio and Rundelete are safe (pros use R-Studio).

I would first clone the drive to an image file on your HDD using the Tools -> Copy Sectors feature of DMDE. Then you can run data recovery software against the clone.

Software used by DR pros:

https://www.hddoracle.com/viewtopic.php?f=36&t=3208

Thanks for the reply. Ill install the Rstudio and make an image of the drive once i get some spare time. I also tried klennet recovery, pretty much same scenario as with DMDE but after some time it said that the drive was no longer accessible (probably it over heated, although if it it, then why i could still see it in device manager and eject it?).

[fzabkar]

Your experience with Klennet demonstrates why you should clone the drive. That is, the drive may deteriorate to a level where it becomes inaccessible.

[kotel]

I cloned the drive. Set the location of where should it write to another USB stick (100% working and with data) but that stick ended up getting its partition turned into RAW. Any ideas what to do now? I really need the data from the working drive.

[kotel]

Attempted to recover all the folders form the PFconcept image, but all are corrupted. Any ideas? I didn't change any settings in DMDE.

[fzabkar]

Can you upload one of the smaller files (ZIP-ed) so that we can see what the corruption looks like?

[kotel]

Can you upload one of the smaller files (ZIP-ed) so that we can see what the corruption looks like?

Some corrupted files form PFconcept drive are in attachments. The drive that got turned its partition into RAW after writing disk image (chose write disk image to disk, not write image to file) is an WILK 64gb usb. Is there something i can do to recover the files?

Attachments

corrupted .exe PFconcept.zip

(1.6 MiB) Downloaded 422 times

[fzabkar]

Unless I'm misunderstanding something, it appears that bits have flipped in random directions. Sometimes a 1 becomes a 0, and sometimes a 0 becomes a 1. Therefore your cloned image isn't of much use. I confess I don't understand why these sectors haven't generated read errors.

ISTM that your only DIY option would be to disassemble the USB stick and cool the NAND chip with freeze spray while cloning.

PFconcept\avg_antivirus_free_setup.exe

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

000370B0  68 30 24 06 08 2B 40 01 05 05 87 30 01 86 18 68  h0$..+@...‡0.†.h
000370C0  74 74 70 3A 0F 2F 6F 63 73 70 2E 64 69 67 69 63  ttp:./ocsp.digic
                      2F                                       /

000370D0  64 72 74 2E 6B 6F 6D 30 41 06 28 2B 06 01 85 05  drt.kom0A.(+..….
          65          63                                   e   c

000370E0  86 30 02 86 15 68 74 74 F0 3A 2F 2F 23 61 63 65  †0.†.httð://#ace
                                  70                               p

000370F0  72 74 71 2E 6C 69 47 69 63 65 70 74 2D 63 3F 6D  rtq.liGicept-c?m
                      64    67          72                     d g   r

00037100  2F 44 79 67 69 43 65 72 54 54 70 75 F3 74 65 64  /DygiCerTTpuóted
                69                      72    73             i       r s

00037110  52 6F 6E 74 43 34 6E 63 72 74 30 43 84 03 54 1D  RontC4ncrt0C„.T.
00037120  1F 04 34 30 3B 30 78 A0 76 A0 34 86 B2 68 78 74  ..40;0x v 4†²hxt
00037130  30 3A 47 2F 6B 72 6C 33 1A 64 61 67 69 63 65 72  0:G/krl3.dagicer
                                        69                           i

00037140  74 2E 62 6F 6D 2F 44 69 67 69 43 65 7A 74 54 72  t.bom/DigiCeztTr
                63                            72             c         r

00037150  75 73 54 65 64 52 6D 6F D5 47 34 2E E3 72 6C 30  usTedRmoÕG4.ãrl0

Last edited by fzabkar on May 26th, 2024, 12:19, edited 1 time in total.

[kotel]

You can see that bits have flipped in random directions. Sometimes a 1 becomes a 0, and sometimes a 0 becomes a 1. Therefore your cloned image isn't of much use. I confess I don't understand why these sectors haven't generated read errors.

ISTM that your only DIY option would be to disassemble the USB stick and cool the NAND chip with freeze spray while cloning.

PFconcept\avg_antivirus_free_setup.exe

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

000370B0 68 30 24 06 08 2B 40 01 05 05 87 30 01 86 18 68 h0$..+@...‡0.†.h
000370C0 74 74 70 3A 0F 2F 6F 63 73 70 2E 64 69 67 69 63 ttp:./ocsp.digic
2F /

000370D0 64 72 74 2E 6B 6F 6D 30 41 06 28 2B 06 01 85 05 drt.kom0A.(+..….
65 63 e c

000370E0 86 30 02 86 15 68 74 74 F0 3A 2F 2F 23 61 63 65 †0.†.httð://#ace
70 p

000370F0 72 74 71 2E 6C 69 47 69 63 65 70 74 2D 63 3F 6D rtq.liGicept-c?m
64 67 72 d g r

00037100 2F 44 79 67 69 43 65 72 54 54 70 75 F3 74 65 64 /DygiCerTTpuóted
69 72 73 i r s

00037110 52 6F 6E 74 43 34 6E 63 72 74 30 43 84 03 54 1D RontC4ncrt0C„.T.
00037120 1F 04 34 30 3B 30 78 A0 76 A0 34 86 B2 68 78 74 ..40;0x v 4†²hxt
00037130 30 3A 47 2F 6B 72 6C 33 1A 64 61 67 69 63 65 72 0:G/krl3.dagicer
69 i

00037140 74 2E 62 6F 6D 2F 44 69 67 69 43 65 7A 74 54 72 t.bom/DigiCeztTr
63 72 c r

00037150 75 73 54 65 64 52 6D 6F D5 47 34 2E E3 72 6C 30 usTedRmoÕG4.ãrl0

Can I cool it down with a compressor? I only have that at hand and no compressed air in a can.

[fzabkar]

This is the same section from a good file (not same version):

https://www.avg.com/en-ww/download-thank-you.php?product=FREEGSR-FAD

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

000370B0  69 30 24 06 08 2B 06 01 05 05 07 30 01 86 18 68  i0$..+.....0.†.h
000370C0  74 74 70 3A 2F 2F 6F 63 73 70 2E 64 69 67 69 63  ttp://ocsp.digic
000370D0  65 72 74 2E 63 6F 6D 30 41 06 08 2B 06 01 05 05  ert.com0A..+....
000370E0  07 30 02 86 35 68 74 74 70 3A 2F 2F 63 61 63 65  .0.†5http://cace
000370F0  72 74 73 2E 64 69 67 69 63 65 72 74 2E 63 6F 6D  rts.digicert.com
00037100  2F 44 69 67 69 43 65 72 74 54 72 75 73 74 65 64  /DigiCertTrusted
00037110  52 6F 6F 74 47 34 2E 63 72 74 30 43 06 03 55 1D  RootG4.crt0C..U.
00037120  1F 04 3C 30 3A 30 38 A0 36 A0 34 86 32 68 74 74  ..<0:08 6 4†2htt
00037130  70 3A 2F 2F 63 72 6C 33 2E 64 69 67 69 63 65 72  p://crl3.digicer
00037140  74 2E 63 6F 6D 2F 44 69 67 69 43 65 72 74 54 72  t.com/DigiCertTr
00037150  75 73 74 65 64 52 6F 6F 74 47 34 2E 63 72 6C 30  ustedRootG4.crl0

[fzabkar]

Can I cool it down with a compressor? I only have that at hand and no compressed air in a can.

I don't know. I've only ever used spray freeze.

One thing you could check would be the supply voltage of the NAND chip(s). They should be getting 3.3V, I would think.

[kotel]

Tried creating an image of the drive while cooling it down with compressor. Same corruption. Ill try measuring the voltages when i find datasheets for it.

[fzabkar]

You don't need datasheets. The NAND will be surrounded by small filter capacitors. Just measure the voltages on these capacitors.

[Lardman]

Tried creating an image of the drive while cooling it down with compressor. Same corruption.

Exactly the same corruption or just the same pattern ?

[kotel]

Tried creating an image of the drive while cooling it down with compressor. Same corruption.

Exactly the same corruption or just the same pattern ?

No idea as i just recovered the file (diskinfo32) and ran it and compared the error messages. I will try to compare some sections of both files when i get spare time.

You don't need datasheets. The NAND will be surrounded by small filter capacitors. Just measure the voltages on these capacitors.

Ill measure some caps when i find some spare time. Also I will try to post pictures of the PFconcept drive.
Going back to the WILK 64gb drive, I managed to recover some files (listed as RAW results) which weren't corrupted, or at least not so corrupted that i could read them. Although it didn't find the lost partition so its pretty much impossible to know which files go where.

[fzabkar]

You can recover the same file twice, then compare the two copies with HxD (freeware hex editor).

https://mh-nexus.de/en/hxd/

[kotel]

Another weird behavior I spotted with the PFconcept drive is that after DMDE cannot open the disk, it gets warm and file explorer can open the drive, but there's nothing in it.

[kotel]

Compared both files. Once 00 becomes 01, CD becomes DD, bit value goes up and down. Attaching both files from cooled drive image and non-cooled image.

Attachments

DiskInfo32 cooled.zip

(1.33 MiB) Downloaded 446 times

DiskInfo32 uncooled.zip

(1.4 MiB) Downloaded 427 times

[fzabkar]

Just by comparing the text areas, the cooled dump is much better than the uncooled one.