I'm no file system expert, so forgive me if I'm off base here...
My friend has been using the same 1gb thumbdrive for several years (waterproof Adata "JOGR" drive). Recently, the drive stopped being recognized in Windows - after she started using it to save her only copy of some stories she's working on. She got the "Drive must be formatted..." error message.
Note: Drive seems to be FAT16/32.
I first tried a few data recovery tools, but anything that relied on an existing file system (ie. Recuva) was of no use.
Booted Ubuntu Rescue Remix...
1. made an image of the drive with ddrescue. I followed the tutorials online and I believe I got the most complete image possible.
2. Tried testdisk - was not able to recover any partitions or rebuild the boot sector.
3. Tried photorec - was able to recover a bunch of raw files
Booted back into Windows...
1. Looked at what I got from photorec. I recovered a bunch of stuff, but none of the critical files she was looking for.
2. Loaded EaseUS Data Recovery Wizard, pulled more raw files and pulled some "lost" files, complete with file name and some directory structure.
3. Tried windows versions of testdisk/photorec, got similar results as the linux versions
4. Tried GetData, Recover MY Files, PCInspector, etc... no luck
Then, I pulled the image I made with ddrescue back into Windows and opened it with HxD (hex editor). Sectors 0 through 253,951 were all FF (255). So if I'm reading this correctly, the first 130mb or so of the drive are completely overwritten. That includes boot sector and partition table data, so no wonder nothing could restore the drive's readability.
From what I understand, if the sectors at the beginning of the image file were all 0s that might be better news... because it might leave some hope that I didn't get a complete image with ddrescue. But the fact that the data is all FF means that the original drive is completely scrubbed. I searched through the image in the hex editor looking for keywords from her lost documents and found nothing. So I'm assuming that the files she's missing are hiding under the initial "scrubbed" portion of the drive.
I'm not sure what the hardware architecture is, but is it possible that there is a recoverable hardware issue at fault here, or do my results mean the lost data is most certainly toast?
My friend has been using the same 1gb thumbdrive for several years (waterproof Adata "JOGR" drive). Recently, the drive stopped being recognized in Windows - after she started using it to save her only copy of some stories she's working on. She got the "Drive must be formatted..." error message.
Note: Drive seems to be FAT16/32.
I first tried a few data recovery tools, but anything that relied on an existing file system (ie. Recuva) was of no use.
Booted Ubuntu Rescue Remix...
1. made an image of the drive with ddrescue. I followed the tutorials online and I believe I got the most complete image possible.
2. Tried testdisk - was not able to recover any partitions or rebuild the boot sector.
3. Tried photorec - was able to recover a bunch of raw files
Booted back into Windows...
1. Looked at what I got from photorec. I recovered a bunch of stuff, but none of the critical files she was looking for.
2. Loaded EaseUS Data Recovery Wizard, pulled more raw files and pulled some "lost" files, complete with file name and some directory structure.
3. Tried windows versions of testdisk/photorec, got similar results as the linux versions
4. Tried GetData, Recover MY Files, PCInspector, etc... no luck
Then, I pulled the image I made with ddrescue back into Windows and opened it with HxD (hex editor). Sectors 0 through 253,951 were all FF (255). So if I'm reading this correctly, the first 130mb or so of the drive are completely overwritten. That includes boot sector and partition table data, so no wonder nothing could restore the drive's readability.
From what I understand, if the sectors at the beginning of the image file were all 0s that might be better news... because it might leave some hope that I didn't get a complete image with ddrescue. But the fact that the data is all FF means that the original drive is completely scrubbed. I searched through the image in the hex editor looking for keywords from her lost documents and found nothing. So I'm assuming that the files she's missing are hiding under the initial "scrubbed" portion of the drive.
I'm not sure what the hardware architecture is, but is it possible that there is a recoverable hardware issue at fault here, or do my results mean the lost data is most certainly toast?