OldGuy said:
I plugged it in and accidentally hit the Music option in the popup.
Media Player opened and started doing something with the drive.
An option box was present to Cancel which I did.
I pulled the USB flash and later plugged it back in.
The whole directory is garbage!
Yes, I have backed up 95% of the data so it is not a total disaster.
But it has 31GBytes of data that I would like to recover to copy all to
a backup drive.
I would like to try to recover if only for the experience.
What is the best free recovery tool?
The very first thing you do, is image the stick sector by sector,
so you have a copy of the scrambled state. This is in case some
subsequent step, messes it up further.
http://www.chrysocome.net/downloads/dd-0.6beta3.zip
http://www.chrysocome.net/dd
dd if=\\?\Device\Harddisk1\Partition0 of=C:\users\username\myUSBkey.bin bs=1048576 count=32000
The count number, you work out the value by first running
"dd --list" and getting the whole key size of Partition0.
The entries in "dd --list" are in the same order as Disk Management
and you should be able to correlate the items and figure out the
raw USB key size that way. The reason this extra complexity is needed,
is the last time I tested 0.6beta3, it still could not reliably
detect the end of a USB key, when copying off the content. It
does work for hard drives, or floppies, or even a CD. But it
seems to have a problem determining it hit the end of the USB
key. Thus, I end up recommending speliing out the block size
and count of blocks. 1048576*32000 = 33,554,432,000 and that
would be appropriate, if that was the listed size in "dd --list".
When I'm doing those, I also keep a copy of factor.exe handy.
Linux has a copy of "factor" as well, and if you do something like
factor 33554432000
it will spell out all the factors...
33554432000: 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 5 5 5
|<------------ 10485786 ------------->|
2^20 of those is 1048576 and is roughly the size of a USB flash
chip page. Flash pages keep getting bigger all the time, and are
a power_of_two number. And for efficient transfer, I try to select
a "good number". It especially helps with flash life, if writing
the image of the USB key, back to the key later (doing a restore).
When restoring, you simply reverse the command.
dd if=C:\users\username\myUSBkey.bin of=\\?\Device\Harddisk1\Partition0 bs=1048576 count=32000
And that kind of command is "forensic" in the sense that it collects
as much information as possible, without trying to decode the files
or file system itself. The partition could be HFS+ and the
utility would not care.
Once you've made that preliminary backup, only then is it
safe to attempt to use CHKDSK on the USB key. CHKDSK is
destructive, as it works "in place", and it is always a
gamble as to whether the results will be good or not.
By all means experiment... but with a good backup in hand.
When the file system is busted, and other backup programs
will not run, there is always "dd" (and a little arithmetic
to go with the work).
Paul
