sgakagiz

I have a SanDisk U3 8GB USB drive (memory stick). On friday, I was using it as normal, all working fine, and I hibernated the computer with the drive plugged in as I have done many times before.

3 days later, upon plugging it into the computer afterbooting (again, normal practice for me; no problems before), I see 5 files listed (over 20000 normally on there). The five files take up ~60MB of space, but viewing the properties of the drive, I see ~3.81Gb listed as used (what I expected).

I've read the sticky and it does not apply to me as I'm seeing part of the filesystem.

Details of the drive
Over 1 year old
used daily
Recently had a scandisk (windows XP booting), and a few errors corected, but seemed to be fine

What I would like to happen
Recovery of the data. I've a backup from a little over 2 months ago, but that's quite old for me. I thought I had one from last week. I know I should have backed it up earlier, but I missed it.

What I've done
I immediately created an image of the drive (using 'find and mount').
I tried running freeware such as PCI inspector 4.x to find the files and the filesystem (partially good, but seemed to give many duplicate files and recovered files <4kb)
I've tried Running DDR for memory sticks, but I can't tell how good the data is that it is finding.
Used someone else's computer to read the USB drive and replicated the results I saw (5 files, more space taken up than should be for those 5 files)

I've run a scan with Testdisk, with the following results:
Intel selected as partition type
4 partitions with errors stating that the partitions are too large and erroneous.
recognised as Novell, and 3 other types see second post for more information

None as type
1 partition found, labelled as healthy (green), recognised as FAT32 (correct), and of the right size. However, I can't write that partition as 'none' is selected as the type, despite it being recognised as correct (see next post, attachments)

I've tried the steps mentioned in the sticky, but to no avail as it does not recognise the 'boot sector' (it should not have one), and states that the At this point, my knowledge of data recovery is meeting its limit and I don't know how/if to continue. I am more than happy to provide screenshots from testdisk/otherwise.

Thanks in Advance
sgakagiz

Attached Images

	USB used amount of space.jpg (59.1 KB, 1 views)
	USB file listing.jpg (95.0 KB, 1 views)

sgakagiz

Screenshots from testdisk.
Intel one is *before* the quick test (after wards it complains of no partition found, even with deeper analysis)

The no type one is after the quick test

Attached Images

	testdisk intel partition selected.jpg (133.1 KB, 1 views)
	testdisk_no_type_selected.jpg (54.0 KB, 0 views)

raptor_pa

Work on the image, not the original.
USB sticks use the same basic file structure as HDDs but also ar constantly shifting data around - for wear leveling. And to maintain the level of charge on the stick.
Did you scan and mount the partition with find and mount? And all drive have an Master Boot Record - the MBR contains the partition table and the definition of the filesystem type.
If you can find the partition with F&M and the files are there when you mount it, then copy them out. If not try the demo of r-studio to scan the drive. It is also possible that one of the chips has failed and only part of the file system can be identified.

sgakagiz

Yes, I was able to get a copy of the image out with find and mount. I've made a backup copy of the image so that I can start over if needed. It was when working on an image that I saw those screenshots initially, though admittedly the ones I posted were from the USB drive itself (it was late last night).

My problem is that I'm not sure how to continue from here as I see 4 partitions labelled as bootable.

When I analysed an old image (2009_04_04.img), I noticed a few things. This older image is slightly smaller than the new one (8,027,850,752 bytes instead of 8,036,098,560 bytes). Testdisk finds no partitions on this image, but 'find and mount' does, and I can see my old data.

In the current problem image (2009_11_09.img), retrieved by find and mount, all the errors above are reproduced. I'm going to need some handholding along the way, and I'm trying to work out what to do, but am at a loss. This current image is the one that shows only 5 files.

raptor_pa

Did you deep scan with find and mount? Scan with find and mount and check each partition it finds to see if the files are found, then mount the pratition as a drive letter. If that fails, scan with r-studio to look for the files.

sgakagiz

Yes. A deep scan ('thorough scan' in v2.31) with Find and mount only produced the same partition which I could mount but had 5 files and a large amount of used space.

A scan with R-studio, also found the partition, but found a large number of folders containing some of the files, but by no means all of the files. Using Rstudio to check the some files under 64k, they seemed broadly intact. The folder structure is somewhat intact, but I've got a plethora of folders I seem to be missing.

raptor_pa

This is sounding like file system damage, not MBR damage. It may or may not be a physical issue - solid state devices are much harder to determine that. It may be a 'best recovery'situation where some of the data is no longer available.