0

After a friend wanted to copy pictures onto my 8 GB USB stick all data is corrupted.
The USB stick was mainly used on Windows before. Also my friend used Windows to copy the pictures. Maybe he unplugged it while the writing process was not yet finished, I don't know.

Now neither Windows nor Linux (Ubuntu 18.04) can read the data. The filenames are a complete mess with symbols and other characters (see below).

While I can ask again for the pictures, there were other files on the USB stick before which are now lost. I thought to give it a try with ddrescue and safecopy. But both run through without any error detection and the created .iso files show the same problem after mounting as the USB stick.
What can I further try to rescue the data? Any guess what is wrong with the data?

userxxx@PC:~/Desktop/broken_USB$ ll /media/userxxx/288A-C7BD1/
ls: cannot access '/media/userxxx/288A-C7BD1/τfσ¼╨σ%$.ú%a': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/ì5∙'$'\025''2╤û∩.╧σz': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/╫ß[yp╟sv.>■ö': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/û┴'\''üäe,n.'$'\017''jñ': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/'$'\003'',1∙╥╢'$'\002''π.╛jw': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/üπ¿'$'\035''Ωv`ç.'$'\016''1╪': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/ü⌐'$'\a''╪⌡▓|D.¿c`': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/zqmφ╒╬¼i.'$'\024''àv': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/≤╡l∩'$'\026''»s▐.rmm': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/'$'\f\017''<√:æ{t.⌐wz': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/<ä╒££[v▀.⌐½ò': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/╗⌡▄╩₧o.c.ô≥τ': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/≥_┼'$'\031''▄:'$'\035''°.'$'\b''I+': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/%k«çåxû'$'\b''.τäÉ': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/W═g'$'\t''║≈g╥.e≥'$'\177': Input/output error
ls: reading directory '/media/userxxx/288A-C7BD1/': Input/output error
total 35G
drwxr-xr-x  30 userxxx userxxx 4,0K Jan  1  1970  ./
drwxr-x---+  6 root    root    4,0K Okt  5 11:39  ../
-r--r--r--   1 userxxx userxxx 3,4G Apr  7  1994 '⌠╚'$'\035''∙¼ÿKI.╜y√'
d??????????  ? ?       ?          ?            ? ''$'\003'',1∙╥╢'$'\002''π.╛jw'/
-rw-r--r--   1 userxxx userxxx 1,6G Sep  7  2064 '4╜Ñ'$'\031'\''╪ⁿâ.²╕╛'
-rw-r--r--   1 userxxx userxxx 2,9G Okt 25  2059 '!'$'\005''}║╓5Sï.▓7ä'
d??????????  ? ?       ?          ?            ? ''$'\f\017''<√:æ{t.⌐wz'/
-rw-r--r--   1 userxxx userxxx 1,5G Aug  1  2085 '┤ªö▄φù'$'\033''s.k│7'
d??????????  ? ?       ?          ?            ? '<ä╒££[v▀.⌐½ò'/
-rw-r--r--   1 userxxx userxxx 1,8G Aug 26  2044 "b⌠µ¡zd'¥.s╔ "
-rw-r--r--   1 userxxx userxxx 859M Jan 16  2106 '∩cí╢╓╥σ'$'\a''.▐sⁿ'
-rw-r--r--   1 userxxx userxxx 2,7G Aug 13  2033 'c?>nob>ò.i■='
-r--r--r--   1 userxxx userxxx 2,5G Jul 30  2083 '\êFπô╧z╤.╖(c'
-rw-r--r--   1 userxxx userxxx 1,2G Jan 22  2102 '£h'$'\v''╔╧¡"ô.√ê6'
d??????????  ? ?       ?          ?            ? '≥_┼'$'\031''▄:'$'\035''°.'$'\b''I+'/
d??????????  ? ?       ?          ?            ? 'ì5∙'$'\025''2╤û∩.╧σz'/
-r--r--r--   1 userxxx userxxx 3,5G Sep 22  2070 'i▓[█jæe#.'$'\027''è\'
-r--r--r--   1 userxxx userxxx 1,4G Mai 10  2006 'iy╜ymh!'$'\030''.√▌j'
d??????????  ? ?       ?          ?            ? '%k«çåxû'$'\b''.τäÉ'/
d??????????  ? ?       ?          ?            ? '≤╡l∩'$'\026''»s▐.rmm'/
d??????????  ? ?       ?          ?            ?  ╗⌡▄╩₧o.c.ô≥τ/
-r--r--r--   1 userxxx userxxx 2,0G Jan  3  2086  Oc°W╥6WQ._≥Ç
d??????????  ? ?       ?          ?            ? '╫ß[yp╟sv.>■ö'/
-rw-r--r--   1 userxxx userxxx 168M Sep 19  2069 '>ƒ°sΓºƒJ.ìe`'
-r--r--r--   1 userxxx userxxx 2,0G Apr 10  2090 '¡t╢▌'$'\025''£àü.,'$'\024''▒'
d??????????  ? ?       ?          ?            ? 'ü⌐'$'\a''╪⌡▓|D.¿c`'/
d??????????  ? ?       ?          ?            ? 'û┴'\''üäe,n.'$'\017''jñ'/
d??????????  ? ?       ?          ?            ? 'üπ¿'$'\035''Ωv`ç.'$'\016''1╪'/
d??????????  ? ?       ?          ?            ? 'W═g'$'\t''║≈g╥.e≥'$'\177'/
-rw-r--r--   1 userxxx userxxx 1,2G Mai 29  1987 'x£ôδrpw╛.'$'\r''6«'
-r--r--r--   1 userxxx userxxx 2,0G Jun 22  2028 '°zƒ1Y?l∩.ú=w'
d??????????  ? ?       ?          ?            ? 'zqmφ╒╬¼i.'$'\024''àv'/
-rw-r--r--   1 userxxx userxxx 1,7G Sep 23  2093 "┘δS░E╧9'.¡k╗"
-r--r--r--   1 userxxx userxxx 2,4G Jan  7  2064 'πM*¡4v'\''═.'$'\023''ü╫'
d??????????  ? ?       ?          ?            ? 'τfσ¼╨σ%$.ú%a'/
-r--r--r--   1 userxxx userxxx 143M Jan  7  2027 'Ω┘'$'\v''αâôpô.ü°⌡'

userxxx@PC:~/Desktop/broken_USB$ sudo ddrescue -v /dev/sdh1 usb.iso ddrescue.log
GNU ddrescue 1.22
About to copy 8102 MBytes from '/dev/sdh1' to 'usb.iso'
    Starting positions: infile = 0 B,  outfile = 0 B
    Copy block size: 128 sectors       Initial skip size: 256 sectors
Sector size: 512 Bytes

     ipos:    8102 MB, non-trimmed:        0 B,  current rate:   4718 kB/s
     opos:    8102 MB, non-scraped:        0 B,  average rate:  10140 kB/s
non-tried:        0 B,  bad-sector:        0 B,    error rate:       0 B/s
  rescued:    8102 MB,   bad areas:        0,        run time:     13m 18s
pct rescued:  100.00%, read errors:        0,  remaining time:         n/a
                              time since last successful read:         n/a
Finished

Update
With sudo photorec I was able to rescue lots of files, as it detects by far not only picture files.
Unfortunately, the folder structure and the filenames are lost.

Any ideas why there are no errors detected but I can still not access the USB drive normally? Could be something wrong with the partition table or similar?

6
  • Guess: The stick is a cheap Chinese fake that reports a lot more storage than it has. Writing to the "extra" storage has overwritten earlier blocks, namely those that contained the filenames. You can check this by looking at the whole 8 GB you copied, and check for repetitions.
    – dirkt
    Commented Oct 5, 2020 at 18:13
  • Thanks for your idea! Any hint how to do this? Which tool / command to use? Commented Oct 5, 2020 at 18:38
  • Simplest way I can think off is hexdump -C your-dump-file | less with an editor open to cut-and-paste (or maybe the same command in two terminals), then go e.g. to the beginning and to the exact middle, and compare visually. More complicated ways are using dd or split to split it into parts at the right boundaries, and bdiff or something similar to compare. binwalk with entropy view may also be interesting.
    – dirkt
    Commented Oct 6, 2020 at 5:02
  • I started hexdump -C my-file > my-file.hexdump but stopped it after the new file reached 26 GB. I opened the hexdump file with vim and had a look. For the first 860.000 lines there is no meaningful data, just endless repetitions of some special characters followed by the alphabet in capital and then in small letters, sometimes it's only one character repeated for several lines. Looks like the data stored in the first blocks is gone only not replaced with other data but with some meaningless sequence. Commented Oct 6, 2020 at 9:15
  • 1
    I found a tool which takes care of that: f3 (Fight Flash Fraud). With f3probe one can check if the reported size is the real flash memory size. I formatted my USB stick and ran f3probe. It reported the device is "the real thing", so I actually provides the announced 8 GB. Something else must have compromised it in the first place. Commented Oct 7, 2020 at 12:41

0

You must log in to answer this question.

Browse other questions tagged .