Hey guys,

Working on a Sandisk Titanium Cruzer 2.0gb. It came in and appeared to be an empty drive, no files can be seen. In winhex, the data looks encrypted. The drive did not ask me for a password, when plugged in. The customer did provide me with a password and said they had one on it. So I then installed the U3 AutoRun utility on a PC. This revealed the standard documents folder and the utility itself inside the drive(this is what you get on a completely fresh drive).

Would formatting the disc cause this scenario? I tried to reproduce it on a similar thumb drive, but it would never encrypt the data, and the deleted files could still be found in a hex editor.

I also tried gdb and some other software to search for files in case of a format

Any way to get anything off of this case?

before formatting ur U3, and while there was password on it
@ this point, there is a U3 DOS command utility which scans the U3 and tells you if has password or not

but after formatting it using the utility of sandisk, i guess its gone

there are many portable Secure Appz for U3 which Secure Format which i belive ur client has one on it

BTW, i have many of the same one that u have, comes with built-in U3 Appz
and it is one of them as i mentioned before

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

It is only my guess that the user formatted the disk. I think this because the drive has an empty file system, with the rest of the drive full of data that looks encrypted.

Why would I not be able to see this data as unencrypted in a hex viewer? Shouldn't everything that gets accessed get unencrypted as long as the drive isn't locked?

As a said, this Sandisk U3 comes with built-in Appz
Trial, AV, secure format, and some other tools

probably one of them either the Copy/data Protection (encryption) tools
OR/AND
Secure format

thats why u cannot find/see the data inside

Also keep in mind, formatting Flash is not like formatting hdd`s
more options/data u will have in hdd`s compared to USB flash

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

Is there anyway to restore these built in appz and apply the pw/key to the remaining data?

Does the key get changed with each new password?

Once SECURELY formatted = All Gone

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein