Recover data from empty space
Hi, Habr. In the New Year holidays, it was possible to write about an interesting case (although we have quite a few such cases in DATALABS ). And it is interesting because of the completely zero USB flash drive, we successfully recovered the data. If you wonder how? Welcome under the category…
Windows offers to format the drive in cases when it cannot determine the file structure on the device, so it offers to create a new one by formatting.
In our case, data is needed and cannot be formatted. We look disk editor, what happened to the file structure.
WinHex:
Opanki ... That's it! All 32 gigabytes are filled with zeros ... There is no data! Chef, it's all gone.
Immediately ask the client, did not give anyone? and that evil comrade didn’t run repair utilities? Answer: No, immediately to you.
If no one “flashed” the flash drive and did not write it with a pattern, then it could not be reset in a moment, it takes time and action.
Ok, Russians don't give up. Solder the microcircuit and see the contents of the memory directly, bypassing the controller. In this case there are two crystals in one case. Together with the service information there are two dumps of 18GB each.
There are no zeros in the dump, but this still doesn’t say anything, since the controller writes data not in an explicit form on modern flash drives, but through the XOR operation.
If all blocks are the same, then yes, the drive is flooded with the same. But we are lucky they are different, and this is the data!
It is necessary to pick up the bark, and assemble the blocks in the desired sequence according to the controller algorithm.
Poshamanim Rostov complex
And vaul, 26 gigabytes of data, 9000 files, 900 of them are broken. Unfortunately, we have no right to upload a picture with the data, as in our office confidentiality is paramount.
In conclusion of this mini-story with a happy ending (the client was upset at first that there were only zeros there), you need to write why not all files recovered correctly.
The quality of modern memory chips is very sad, and despite the loud statements by manufacturers that we have done a huge number of write cycles ... the statistics show the opposite. Depreciation occurs very quickly, compared to flash drives that were measured in megabytes. Well, let's not talk about it here and now.
Regarding this case, the flash drive was dying and “signaled” about it indirectly, namely: the disk check was started, the result of the check disk is the FOUND folder, it is present in the recovered data. These were already the first bells that it “pours in”.
The controller saw that the number of bad memory cells is already huge and made such a “feint with ears” as, returning zeroes to the interface.
We also had to read bad sectors, repeated reading, some of them were able to read or recover from the ECC. As a result, the client is satisfied. And that all began, from an empty place ...