0

After a friend wanted to copy pictures onto my 8 GB USB stick all data is corrupted.
The USB stick was mainly used on Windows before. Also my friend used Windows to copy the pictures. Maybe he unplugged it while the writing process was not yet finished, I don't know.

Now neither Windows nor Linux (Ubuntu 18.04) can read the data. The filenames are a complete mess with symbols and other characters (see below).

While I can ask again for the pictures, there were other files on the USB stick before which are now lost. I thought to give it a try with ddrescue and safecopy. But both run through without any error detection and the created .iso files show the same problem after mounting as the USB stick.
What can I further try to rescue the data? Any guess what is wrong with the data?

userxxx@PC:~/Desktop/broken_USB$ ll /media/userxxx/288A-C7BD1/
ls: cannot access '/media/userxxx/288A-C7BD1/τfσ¼╨σ%$.ú%a': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/ì5∙'$'\025''2╤û∩.╧σz': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/╫ß[yp╟sv.>■ö': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/û┴'\''üäe,n.'$'\017''jñ': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/'$'\003'',1∙╥╢'$'\002''π.╛jw': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/üπ¿'$'\035''Ωv`ç.'$'\016''1╪': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/ü⌐'$'\a''╪⌡▓|D.¿c`': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/zqmφ╒╬¼i.'$'\024''àv': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/≤╡l∩'$'\026''»s▐.rmm': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/'$'\f\017''<√:æ{t.⌐wz': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/<ä╒££[v▀.⌐½ò': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/╗⌡▄╩₧o.c.ô≥τ': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/≥_┼'$'\031''▄:'$'\035''°.'$'\b''I+': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/%k«çåxû'$'\b''.τäÉ': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/W═g'$'\t''║≈g╥.e≥'$'\177': Input/output error
ls: reading directory '/media/userxxx/288A-C7BD1/': Input/output error
total 35G
drwxr-xr-x  30 userxxx userxxx 4,0K Jan  1  1970  ./
drwxr-x---+  6 root    root    4,0K Okt  5 11:39  ../
-r--r--r--   1 userxxx userxxx 3,4G Apr  7  1994 '⌠╚'$'\035''∙¼ÿKI.╜y√'
d??????????  ? ?       ?          ?            ? ''$'\003'',1∙╥╢'$'\002''π.╛jw'/
-rw-r--r--   1 userxxx userxxx 1,6G Sep  7  2064 '4╜Ñ'$'\031'\''╪ⁿâ.²╕╛'
-rw-r--r--   1 userxxx userxxx 2,9G Okt 25  2059 '!'$'\005''}║╓5Sï.▓7ä'
d??????????  ? ?       ?          ?            ? ''$'\f\017''<√:æ{t.⌐wz'/
-rw-r--r--   1 userxxx userxxx 1,5G Aug  1  2085 '┤ªö▄φù'$'\033''s.k│7'
d??????????  ? ?       ?          ?            ? '<ä╒££[v▀.⌐½ò'/
-rw-r--r--   1 userxxx userxxx 1,8G Aug 26  2044 "b⌠µ¡zd'¥.s╔ "
-rw-r--r--   1 userxxx userxxx 859M Jan 16  2106 '∩cí╢╓╥σ'$'\a''.▐sⁿ'
-rw-r--r--   1 userxxx userxxx 2,7G Aug 13  2033 'c?>nob>ò.i■='
-r--r--r--   1 userxxx userxxx 2,5G Jul 30  2083 '\êFπô╧z╤.╖(c'
-rw-r--r--   1 userxxx userxxx 1,2G Jan 22  2102 '£h'$'\v''╔╧¡"ô.√ê6'
d??????????  ? ?       ?          ?            ? '≥_┼'$'\031''▄:'$'\035''°.'$'\b''I+'/
d??????????  ? ?       ?          ?            ? 'ì5∙'$'\025''2╤û∩.╧σz'/
-r--r--r--   1 userxxx userxxx 3,5G Sep 22  2070 'i▓[█jæe#.'$'\027''è\'
-r--r--r--   1 userxxx userxxx 1,4G Mai 10  2006 'iy╜ymh!'$'\030''.√▌j'
d??????????  ? ?       ?          ?            ? '%k«çåxû'$'\b''.τäÉ'/
d??????????  ? ?       ?          ?            ? '≤╡l∩'$'\026''»s▐.rmm'/
d??????????  ? ?       ?          ?            ?  ╗⌡▄╩₧o.c.ô≥τ/
-r--r--r--   1 userxxx userxxx 2,0G Jan  3  2086  Oc°W╥6WQ._≥Ç
d??????????  ? ?       ?          ?            ? '╫ß[yp╟sv.>■ö'/
-rw-r--r--   1 userxxx userxxx 168M Sep 19  2069 '>ƒ°sΓºƒJ.ìe`'
-r--r--r--   1 userxxx userxxx 2,0G Apr 10  2090 '¡t╢▌'$'\025''£àü.,'$'\024''▒'
d??????????  ? ?       ?          ?            ? 'ü⌐'$'\a''╪⌡▓|D.¿c`'/
d??????????  ? ?       ?          ?            ? 'û┴'\''üäe,n.'$'\017''jñ'/
d??????????  ? ?       ?          ?            ? 'üπ¿'$'\035''Ωv`ç.'$'\016''1╪'/
d??????????  ? ?       ?          ?            ? 'W═g'$'\t''║≈g╥.e≥'$'\177'/
-rw-r--r--   1 userxxx userxxx 1,2G Mai 29  1987 'x£ôδrpw╛.'$'\r''6«'
-r--r--r--   1 userxxx userxxx 2,0G Jun 22  2028 '°zƒ1Y?l∩.ú=w'
d??????????  ? ?       ?          ?            ? 'zqmφ╒╬¼i.'$'\024''àv'/
-rw-r--r--   1 userxxx userxxx 1,7G Sep 23  2093 "┘δS░E╧9'.¡k╗"
-r--r--r--   1 userxxx userxxx 2,4G Jan  7  2064 'πM*¡4v'\''═.'$'\023''ü╫'
d??????????  ? ?       ?          ?            ? 'τfσ¼╨σ%$.ú%a'/
-r--r--r--   1 userxxx userxxx 143M Jan  7  2027 'Ω┘'$'\v''αâôpô.ü°⌡'

userxxx@PC:~/Desktop/broken_USB$ sudo ddrescue -v /dev/sdh1 usb.iso ddrescue.log
GNU ddrescue 1.22
About to copy 8102 MBytes from '/dev/sdh1' to 'usb.iso'
    Starting positions: infile = 0 B,  outfile = 0 B
    Copy block size: 128 sectors       Initial skip size: 256 sectors
Sector size: 512 Bytes

     ipos:    8102 MB, non-trimmed:        0 B,  current rate:   4718 kB/s
     opos:    8102 MB, non-scraped:        0 B,  average rate:  10140 kB/s
non-tried:        0 B,  bad-sector:        0 B,    error rate:       0 B/s
  rescued:    8102 MB,   bad areas:        0,        run time:     13m 18s
pct rescued:  100.00%, read errors:        0,  remaining time:         n/a
                              time since last successful read:         n/a
Finished

Update
With sudo photorec I was able to rescue lots of files, as it detects by far not only picture files.
Unfortunately, the folder structure and the filenames are lost.

Any ideas why there are no errors detected but I can still not access the USB drive normally? Could be something wrong with the partition table or similar?

Philipp Leitl
  • 91
  • 1
  • 3
  • Guess: The stick is a cheap Chinese fake that reports a lot more storage than it has. Writing to the "extra" storage has overwritten earlier blocks, namely those that contained the filenames. You can check this by looking at the whole 8 GB you copied, and check for repetitions. – dirkt Oct 05 '20 at 18:13
  • Thanks for your idea! Any hint how to do this? Which tool / command to use? – Philipp Leitl Oct 05 '20 at 18:38
  • Simplest way I can think off is `hexdump -C your-dump-file | less` with an editor open to cut-and-paste (or maybe the same command in two terminals), then go e.g. to the beginning and to the exact middle, and compare visually. More complicated ways are using `dd` or `split` to split it into parts at the right boundaries, and `bdiff` or something similar to compare. `binwalk` with entropy view may also be interesting. – dirkt Oct 06 '20 at 05:02
  • I started `hexdump -C my-file > my-file.hexdump` but stopped it after the new file reached 26 GB. I opened the hexdump file with vim and had a look. For the first 860.000 lines there is no meaningful data, just endless repetitions of some special characters followed by the alphabet in capital and then in small letters, sometimes it's only one character repeated for several lines. Looks like the data stored in the first blocks is gone only not replaced with other data but with some meaningless sequence. – Philipp Leitl Oct 06 '20 at 09:15
  • No, you need to compare it at meaningful addresses (under the assumption that e.g. the stick cuts off the higher bits; if it does something more tricky, you may be out of luck). Looking at the first 860.000 lines is not going to help. In particular if you can't recognize the "no meaningful data" (which is the FAT, assuming you formatted it for FAT). – dirkt Oct 06 '20 at 10:59
  • 1
    I found a tool which takes care of that: `f3` (Fight Flash Fraud). With `f3probe` one can check if the reported size is the real flash memory size. I formatted my USB stick and ran `f3probe`. It reported the device is "the real thing", so I actually provides the announced 8 GB. Something else must have compromised it in the first place. – Philipp Leitl Oct 07 '20 at 12:41

0 Answers0