Problem recovering data from USB memory

Hey man,

it may be that the USB is formatted in a way windows doesn't recognise.

If you have a copy of Helix handy you could connect the USB drive to your PC and see if helix recognizes it.
If it's FAT formatted use mount /dev/sdxx /mnt/sdxx to try and mount it. If this is for a forensic investigation you'd want to add -ro to that command so as to maintain evidence integrity etc.
This won't work if you've lost the partition table however.

Alternatively you could ignore the filesystem and just use foremost to try and recover the files, I'm pretty sure that's on Helix too.

Hope that helps.

If it's FAT formatted use mount /dev/sdxx /mnt/sdxx to try and mount it.

If it's FAT, Windows would recognize it.

If it's FAT, Windows would recognize it.

Very true, however in the past I've found that if the partition table is slightly damaged windows mightn't like it but Linux wouldn't have a problem mounting it.

DigiCarver,
if you feel like it, you could try using xxd (or any hex editor) to view the first few bytes of the device. You could probably get a good idea from that as to how the device is formatted.
xxd /dev/sdxx | headThen use the mount man to find the right switch to mount the device.

It's difficult to advise on the "correct" action to take without a bit more info, i.e. is this an forensic case or are you just trying to recover some files off your own personal thumb drive?

DigiCarver,

As your handle suggests, you may need to start carving … 😉

But _first_ acquire the device. Use whatever acquisition engine you like to acquire the physical device so you have a "good" image file. I would do this before I muck about trying to mount or examine the physical device.

Once you have acquired it, then you can muck about. The key in your issue is that you've dropped it on different computers and it failed to be accessed on each and every one.

It would appear the physical device has been recognized by the operating system, but there may be an issue with either the file system or the partition table. (Barring these, is this a secure device, with a lock enabled?)

Once you have your backup acquisition image, you could muck about and use a raw data viewer to examine first the partition table and then second the file system. If you're unable to identify and fix a problem in either of these, you can always carve through your image file for your files.

Regards,

farmerdude

http//www.forensicbootcd.com

http//www.onlineforensictraining.com

Why try to mount device?

May I suggest some sort of Unix/Linux distro and use a forensic version of DD (rdd-copy for example) and try to open the image with EnCase as raw-image.

Goodluck!

When I connect the USB memory to the computer, an indication in the taskbar shows that it is connected and ready to use. It is also shown in Windows Explorer as "removable disk". However, when I click on it, it doesn't show its contents, instead, it asks to insert the disk. I tried different PCs but didn't work. Please, I need some help on how to recover the data.

Regards

What kind of USB drive is it? A lot of fake USB drives exhibit this problem. See http//www.seoulcc.org/consumer-alert-sony/Report_on_Sony_Thumb_Drives.pdf for a full report on these drives.

But the short answer is that if it is a fake drive, the data is gone, because there was no flash memory where the data was being written to…

bj

Thanks to all of you for your replies,

The type of USB is PQI. I used HELIX software but it didn't recognize it (neither the file system nor its size), however it detects a removable disk. that is why I couldn't acquire the data. I noticed also that the LED light of the device never turned ON. I think this may lead to a conclusion

Thanks again

DigiCarver,

Remember, when one tool fails try another. Never rely on a single tool. Because Helix didn't work here doesn't mean all Linux boot CDs would have the same result. Go try another and see if your mileage varies. There are many out there.

Were there any events logged when you attached this device? These may help. You could also turn on usb snoop (I don't know if Helix has it, FBCD does), attach the device, and see what information is returned.

Cheers!

farmerdude

http//www.forensicbootcd.com

http//www.onlineforensictraining.com

If all software fails then it could be a physical problem.There is always the possibility that this drive has a PCB problem, you could try testing the components for continuity and resistance using a multimeter.

Open the device and probe around the circuitry, you may also see and burned out components visually, or maybe when you open the device one of the fuses, crystal etc may have fallen off after a said client has dropped it. Maybe there could be some short (I see a lot of badly soldered chips on cheaper thumbrives), check the tracks and solder on the USB connection for cracks or bridges.

At the moment you need to determine is it logical of physical, grab a sewing needle and run it along the pins of the chips, are any loose?

If at the end of the day you decide the problem is physical, obtain a donor drive same capacity same manufacturer. Go to chipquik.com and order some of this product in It's great for not overheating chips during desolder! works well on SSD's too -) Note the direction of pin 1 on the chips and the direction it is soldered on, mark it with a marker if you like. Follow the instructions on the chipquik website…apply flux to the pins of the chips, melt a small amount of chipquik along the pins, heat it all evenly and remove with a vacuum pickup tool.

Clean the pads on the donor drive, clean the pins on the USB chips the data is to be restored from. Apply liquid solder or solid solder to the pads and pins.Align the chips and solder pin1 in place with a solder iron and then solder the pin on the opposite corner in place, Apply solder paste along the pads and pins. Use a rework station with pencil blower for the next part $100 - $200 for a cheap one. Use the pencil blower to reflow the solder up (use on a low setting you don't want to blast solder under the chips) you want the heat to gently heat the pins and the solder will wick up the pins securing the device to the pads. When the job is complete test the pins are not loose by running a needle over the pins, if you find any loose ones just apply more solder and resolder them. Clean up the excess solder paste with flux and a small brush. Check for visible signs of bridges where the solder crosses two pins. If all looks good allow the device to cool and plug in and aquire -)

I hope this helps! And good luck!