Many sectors on thumbdrive seem overwritten, chance of recovery?

[kibbler1138]

I'm no file system expert, so forgive me if I'm off base here...

My friend has been using the same 1gb thumbdrive for several years (waterproof Adata "JOGR" drive). Recently, the drive stopped being recognized in Windows - after she started using it to save her only copy of some stories she's working on. She got the "Drive must be formatted..." error message.

Note: Drive seems to be FAT16/32.

I first tried a few data recovery tools, but anything that relied on an existing file system (ie. Recuva) was of no use.

Booted Ubuntu Rescue Remix...

1. made an image of the drive with ddrescue. I followed the tutorials online and I believe I got the most complete image possible.

2. Tried testdisk - was not able to recover any partitions or rebuild the boot sector.

3. Tried photorec - was able to recover a bunch of raw files

Booted back into Windows...

1. Looked at what I got from photorec. I recovered a bunch of stuff, but none of the critical files she was looking for.

2. Loaded EaseUS Data Recovery Wizard, pulled more raw files and pulled some "lost" files, complete with file name and some directory structure.

3. Tried windows versions of testdisk/photorec, got similar results as the linux versions

4. Tried GetData, Recover MY Files, PCInspector, etc... no luck

Then, I pulled the image I made with ddrescue back into Windows and opened it with HxD (hex editor). Sectors 0 through 253,951 were all FF (255). So if I'm reading this correctly, the first 130mb or so of the drive are completely overwritten. That includes boot sector and partition table data, so no wonder nothing could restore the drive's readability.

From what I understand, if the sectors at the beginning of the image file were all 0s that might be better news... because it might leave some hope that I didn't get a complete image with ddrescue. But the fact that the data is all FF means that the original drive is completely scrubbed. I searched through the image in the hex editor looking for keywords from her lost documents and found nothing. So I'm assuming that the files she's missing are hiding under the initial "scrubbed" portion of the drive.

I'm not sure what the hardware architecture is, but is it possible that there is a recoverable hardware issue at fault here, or do my results mean the lost data is most certainly toast?

 

[fzabkar]

@kibbler1138, if the drive is indeed a FAT16/32 volume, then the boot sector, two copies of the FAT, and root directory will have been located in the overwritten section at the beginning of the drive. Therefore ISTM that your only hope lies in raw recovery.

That said, it appears that EaseUS has located a subdirectory of sorts. Perhaps you could use a tool to search for more directory fragments.

For example, DMDE (freeware) can Search For Special Sectors (see Tools menu):
http://softdm.com/

You stated that your friend is working on stories. This suggests that her important data is text based. Therefore you could use a disc editor to scan her disc image for known text strings. For example, you could search for "once upon a time ...".

You might also like to see if you can locate the Recycle Bin.

Have you examined the thumb drive directly with a disc editor, or did you just view the ddrescue image?