After a friend wanted to copy pictures onto my 8 GB USB stick all data is corrupted.
The USB stick was mainly used on Windows before. Also my friend used Windows to copy the pictures. Maybe he unplugged it while the writing process was not yet finished, I don't know.
Now neither Windows nor Linux (Ubuntu 18.04) can read the data. The filenames are a complete mess with symbols and other characters (see below).
While I can ask again for the pictures, there were other files on the USB stick before which are now lost. I thought to give it a try with ddrescue and safecopy. But both run through without any error detection and the created .iso files show the same problem after mounting as the USB stick.
What can I further try to rescue the data? Any guess what is wrong with the data?
userxxx@PC:~/Desktop/broken_USB$ ll /media/userxxx/288A-C7BD1/
ls: cannot access '/media/userxxx/288A-C7BD1/τfσ¼╨σ%$.ú%a': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/ì5∙'$'\025''2╤û∩.╧σz': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/╫ß[yp╟sv.>■ö': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/û┴'\''üäe,n.'$'\017''jñ': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/'$'\003'',1∙╥╢'$'\002''π.╛jw': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/üπ¿'$'\035''Ωv`ç.'$'\016''1╪': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/ü⌐'$'\a''╪⌡▓|D.¿c`': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/zqmφ╒╬¼i.'$'\024''àv': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/≤╡l∩'$'\026''»s▐.rmm': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/'$'\f\017''<√:æ{t.⌐wz': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/<ä╒££[v▀.⌐½ò': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/╗⌡▄╩₧o.c.ô≥τ': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/≥_┼'$'\031''▄:'$'\035''°.'$'\b''I+': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/%k«çåxû'$'\b''.τäÉ': Input/output error
ls: cannot access '/media/userxxx/288A-C7BD1/W═g'$'\t''║≈g╥.e≥'$'\177': Input/output error
ls: reading directory '/media/userxxx/288A-C7BD1/': Input/output error
total 35G
drwxr-xr-x 30 userxxx userxxx 4,0K Jan 1 1970 ./
drwxr-x---+ 6 root root 4,0K Okt 5 11:39 ../
-r--r--r-- 1 userxxx userxxx 3,4G Apr 7 1994 '⌠╚'$'\035''∙¼ÿKI.╜y√'
d?????????? ? ? ? ? ? ''$'\003'',1∙╥╢'$'\002''π.╛jw'/
-rw-r--r-- 1 userxxx userxxx 1,6G Sep 7 2064 '4╜Ñ'$'\031'\''╪ⁿâ.²╕╛'
-rw-r--r-- 1 userxxx userxxx 2,9G Okt 25 2059 '!'$'\005''}║╓5Sï.▓7ä'
d?????????? ? ? ? ? ? ''$'\f\017''<√:æ{t.⌐wz'/
-rw-r--r-- 1 userxxx userxxx 1,5G Aug 1 2085 '┤ªö▄φù'$'\033''s.k│7'
d?????????? ? ? ? ? ? '<ä╒££[v▀.⌐½ò'/
-rw-r--r-- 1 userxxx userxxx 1,8G Aug 26 2044 "b⌠µ¡zd'¥.s╔ "
-rw-r--r-- 1 userxxx userxxx 859M Jan 16 2106 '∩cí╢╓╥σ'$'\a''.▐sⁿ'
-rw-r--r-- 1 userxxx userxxx 2,7G Aug 13 2033 'c?>nob>ò.i■='
-r--r--r-- 1 userxxx userxxx 2,5G Jul 30 2083 '\êFπô╧z╤.╖(c'
-rw-r--r-- 1 userxxx userxxx 1,2G Jan 22 2102 '£h'$'\v''╔╧¡"ô.√ê6'
d?????????? ? ? ? ? ? '≥_┼'$'\031''▄:'$'\035''°.'$'\b''I+'/
d?????????? ? ? ? ? ? 'ì5∙'$'\025''2╤û∩.╧σz'/
-r--r--r-- 1 userxxx userxxx 3,5G Sep 22 2070 'i▓[█jæe#.'$'\027''è\'
-r--r--r-- 1 userxxx userxxx 1,4G Mai 10 2006 'iy╜ymh!'$'\030''.√▌j'
d?????????? ? ? ? ? ? '%k«çåxû'$'\b''.τäÉ'/
d?????????? ? ? ? ? ? '≤╡l∩'$'\026''»s▐.rmm'/
d?????????? ? ? ? ? ? ╗⌡▄╩₧o.c.ô≥τ/
-r--r--r-- 1 userxxx userxxx 2,0G Jan 3 2086 Oc°W╥6WQ._≥Ç
d?????????? ? ? ? ? ? '╫ß[yp╟sv.>■ö'/
-rw-r--r-- 1 userxxx userxxx 168M Sep 19 2069 '>ƒ°sΓºƒJ.ìe`'
-r--r--r-- 1 userxxx userxxx 2,0G Apr 10 2090 '¡t╢▌'$'\025''£àü.,'$'\024''▒'
d?????????? ? ? ? ? ? 'ü⌐'$'\a''╪⌡▓|D.¿c`'/
d?????????? ? ? ? ? ? 'û┴'\''üäe,n.'$'\017''jñ'/
d?????????? ? ? ? ? ? 'üπ¿'$'\035''Ωv`ç.'$'\016''1╪'/
d?????????? ? ? ? ? ? 'W═g'$'\t''║≈g╥.e≥'$'\177'/
-rw-r--r-- 1 userxxx userxxx 1,2G Mai 29 1987 'x£ôδrpw╛.'$'\r''6«'
-r--r--r-- 1 userxxx userxxx 2,0G Jun 22 2028 '°zƒ1Y?l∩.ú=w'
d?????????? ? ? ? ? ? 'zqmφ╒╬¼i.'$'\024''àv'/
-rw-r--r-- 1 userxxx userxxx 1,7G Sep 23 2093 "┘δS░E╧9'.¡k╗"
-r--r--r-- 1 userxxx userxxx 2,4G Jan 7 2064 'πM*¡4v'\''═.'$'\023''ü╫'
d?????????? ? ? ? ? ? 'τfσ¼╨σ%$.ú%a'/
-r--r--r-- 1 userxxx userxxx 143M Jan 7 2027 'Ω┘'$'\v''αâôpô.ü°⌡'
userxxx@PC:~/Desktop/broken_USB$ sudo ddrescue -v /dev/sdh1 usb.iso ddrescue.log
GNU ddrescue 1.22
About to copy 8102 MBytes from '/dev/sdh1' to 'usb.iso'
Starting positions: infile = 0 B, outfile = 0 B
Copy block size: 128 sectors Initial skip size: 256 sectors
Sector size: 512 Bytes
ipos: 8102 MB, non-trimmed: 0 B, current rate: 4718 kB/s
opos: 8102 MB, non-scraped: 0 B, average rate: 10140 kB/s
non-tried: 0 B, bad-sector: 0 B, error rate: 0 B/s
rescued: 8102 MB, bad areas: 0, run time: 13m 18s
pct rescued: 100.00%, read errors: 0, remaining time: n/a
time since last successful read: n/a
Finished
Update
With sudo photorec
I was able to rescue lots of files, as it detects by far not only picture files.
Unfortunately, the folder structure and the filenames are lost.
Any ideas why there are no errors detected but I can still not access the USB drive normally? Could be something wrong with the partition table or similar?
hexdump -C your-dump-file | less
with an editor open to cut-and-paste (or maybe the same command in two terminals), then go e.g. to the beginning and to the exact middle, and compare visually. More complicated ways are usingdd
orsplit
to split it into parts at the right boundaries, andbdiff
or something similar to compare.binwalk
with entropy view may also be interesting.hexdump -C my-file > my-file.hexdump
but stopped it after the new file reached 26 GB. I opened the hexdump file with vim and had a look. For the first 860.000 lines there is no meaningful data, just endless repetitions of some special characters followed by the alphabet in capital and then in small letters, sometimes it's only one character repeated for several lines. Looks like the data stored in the first blocks is gone only not replaced with other data but with some meaningless sequence.f3
(Fight Flash Fraud). Withf3probe
one can check if the reported size is the real flash memory size. I formatted my USB stick and ranf3probe
. It reported the device is "the real thing", so I actually provides the announced 8 GB. Something else must have compromised it in the first place.