Recover a flash drive turned RAW – Partition Wizard and TestDisk.

jumanji · 29 Nov 2012

Of late a lot of interest has been generated in using the Partition Recovey Wizard of MiniTools Partition Wizard (PW).

Venerable gregrocker brought out a new feature – extending a partition with even non-adjacent space - in the MiniTools Partition Wizard (PW) here: https://www.sevenforums.com/software/265776-amazing-new-partition-wizard-feature.html

On the data recovery front, there is little, if any, documented evidence of the Partition Recovery Wizard in it being deployed to restore a partition that had turned RAW.Traditionally TestDisk (TD), with many advanced features, has been the tool of choice in the freeware category.

So, in a way, this writeup exploring PW for data recovery from a RAW drive, is a first of its kind. Side by side, I have also used TD. Be ready for some surprises.

The MBR partition table and Volumes boot sector are the two places where the partition information is stored. When Windows is unable to read this for any reason, it reports it as RAW (though the data is still there).

I had no drive that had turned RAW and so I had to “manufacture”. This was done by zero filling the first sector.

For this experimental exploration, I used two flash drives 1. a more recent 16GB SanDisk Cruzer Blade and 2. an almost first generation 1GB imation flash drive.

These were first lowlevel formatted with HDD LLF Low Level Format Tool v4.25 followed by a FAT32 Full Format with HP USB Disk Storage Format Tool v2.2.3. A generous amount of files were written for recovery later.

Making the Flash drive RAW:

Zero filling the first sector using HxD Hex Editor - turns the flash drive to RAW

The resulting Flash drive - RAW. Windows wants you to format it (but data is still there).

Recovery with TestDisk: SanDisk Cruzer Blade 16GB

Run TestDisk

1. At the first screen select “No Log” ENTER

2. Select the drive to analyse, choose “Proceed” ENTER

3. Select partition type – Intel for a PC. ENTER

4.Select “Analyse” ENTER. The drive/partition will be analysed. At this screen the message “ Partition sector doesn’t have the endmark 0xAA55 “ appeared.(This happened even in the case of the other Imation 1 GB flash drive. So I would presume that this will happen with every flash drive.)

5. Select “Quick Search” ENTER

6. Press “Y” if the partitions were created under Vista or later – “N” if not. "Y" if you do not know.

7. Partition identified correctly.

8. At this stage I pressed “P” to list the files and check whether it can see the files. It
showed all the files. I copied one file to a partition on my internal drive and checked
that it played. I terminated TestDisk after this since I have to now try Partition Wizard.

If one wants to write the partition table, instead of “P”, press ENTER to continue, select ‘Write” ENTER . Quit TestDisk and reboot your PC. (Since this is a flash drive, safely remove it and plug it in.) Later I made a repeat of this exercise starting from the lowlevel format and confirmed that it was successful.

Recovery with Partition Wizard: SanDisk Cruzer Blade 16GB

Run Partition Wizard 7.

The flash drive is shown as “unallocated” and without a drive letter.

Click on Partition Recovery Wizard and Next.

In the Partition Recovery Wizard screen, select the flash drive to be recovered and click on Next.

Select Full Disk, and then Next.

Select Quick Scan, Next

The partition was found. Select and double click on it. The Partition Explorer shows the files on it. (Unlike in TestDisk, one cannot copy the files at this stage. The partition has to be necessarily restored.)

Close the Partition Explorer and click on Finish.

The Main Screen shows the restored Flash Drive but still without a drive letter.

Right click on the drive, click on Change letter and give a drive letter.

Click on Apply to execute the two pending operations.

The partition is restored and the flash drive is now functional and you can access the files and folders.

First sector as restored by TestDisk:

First Sector as restored by Partition Wizard:

Recovery with TestDisk: imation 1GB flash drive

When I tried the recovery operation on the imation flash drive, there was no change upto step 7 ( where it found the partition and indicated everything is OK) mentioned in the SanDisk drive recovery above.

However, when it found the partition and I hit “P” to list the files, it came to a cropper. “can’t open filesystem. File system seems damaged.” !!!!!!!!!!!!

When I went back to the earlier screen and did “Write” ENTER it was “Partition write error”

Operation abandoned.

Curious to explore what happens when I try it on the fully functional imation Flash drive, I ran TestDisk on it.

On the fourth screen “Analyse” ENTER, it said “ Bad sector count” ( End 127 –122- 59) “No partition bootable”

On the Fifth screen “Quick Search” ENTER, it did find the bootable partition with the correct count (End 127 254 63)

“P” to list the files, only brought the message “can’t open filesystem. File system seems damaged.” ( This,the first flash drive I bought years ago paying an astronomical price, is still working fine)

Recovery with Partition Wizard: imation 1GB flash drive

By contrast, recovery with Partition Recovery Wizard in PW, went off without any event, restoring the flash drive.

So, Partition Wizard did recover pendrives that turned RAW.

Why TestDisk failed on the imation drive? My only hypothesis is that as a first generation device the hardware and firmware in it could be slightly different from what it is in the current day devices. That said, it is to the credit of PW, that it could recover even that device.

A SevenForums exclusive presentation. :)

Golden · 29 Nov 2012

Extremely useful write-up!!! We seem to be getting many RAW volumes recently so this will be a good reference...........it would also make a nice tutorial with only little effort.

kado897 · 29 Nov 2012

Very useful jumamji. +1

F5ing · 03 Dec 2012

More great work jumanji. Very thorough and nicely written. And good to know that PW was successful on all counts.

I wonder if Testdisk would've succeeded if "Enter to continue" was selected in step 7 rather than listing the files. I think that would've continued on to reach the "Deeper Search" option. When the deeper search finished you could then select the option to list/copy files before writing corrections.

jumanji · 03 Dec 2012

F5ing said:

......I wonder if Testdisk would've succeeded if "Enter to continue" was selected in step 7 rather than listing the files. I think that would've continued on to reach the "Deeper Search" option. When the deeper search finished you could then select the option to list/copy files before writing corrections.

Yep, I intend to try that later ( right now I am relaxing a bit, after packing all my pendrives into the Caselogic case :) ) but when TestDisk does find the partition in QuickSearch one would expect it to find the files and/or rewrite the table - as it happened in the case of the SanDisk drive.

If that does not happen, then there is a problem with the pendrive. I wouldn't even call it a problem, since those pendrives function normally otherwise. It is only that that something in those is different.

(When a tool created with a particular brand pendrive does not work as intended , the general recommendation is that to create that tool on a different brand pendrive and that mostly resolves the problem.)

F5ing · 04 Dec 2012

A well deserved break. You've done some great work.

You know, it seems that simply wiping the first sector shouldn't have caused a problem with Testdisk, even if it was on a first gen flash drive. How did the file table get miscombobulated?

I guess it would be interesting to see what was in that first sector before the wipe. Did you, by any chance, make an image of it before testing?

jumanji · 04 Dec 2012

If what you mean is the picture of the first sector of the pendrive as it rolled out from the factory, the answer is no.

All my pendrives would have received a full zero wipe (Lowlevel format) or a full format with the HP tool or both at sometime or other and no longer virgins. :)

That said, after the full zero wipe and full format, I did backup the first sector with BOOTICE BOOTICE – Partition Flash Drive – Edit Boot Sector | Portable USB Applications so that I can restore it in case I go wrong in the middle of the experiment and need to restart from the beginning. That came in handy whenever I missed a screenshot and I couldn't go back to get it. ( And I had never before thought of looking into the first sector anytime, leave alone saving it.:))

Since then the one thought that has been ringing in my mind is that why not one take this backup immediately after purchasing a pendrive and save it? In case the pendrive turns RAW anytime ( due to corrupt first sector), one can restore it and check if it resolves the problem. Not still sure whether my thinking is flawed.:)

F5ing · 05 Dec 2012

Yeah, I was more interested in what was in the first sector immediately before wiping. Just to try and understand why Testdisk had a problem with the quick search.

The more I think about this, the more I think that Testdisk must go through the deeper search before there's any chance for it to be able to recover anything. I'm now having a hard time trying to think of how a quick search would've found anything remotely recoverable anyway (ie, the FAT32 partition it identified but wasn't able to do anything with).

Since then the one thought that has been ringing in my mind is that why not one take this backup immediately after purchasing a pendrive and save it? In case the pendrive turns RAW anytime ( due to corrupt first sector), one can restore it and check if it resolves the problem. Not still sure whether my thinking is flawed.

I actually used to make those same backups with new pendrives. I quit doing that, though. I had never lost pendrive data before, and I always had backups of the critical data that I put on them anyway (never know when you might lose one). On top of that I realized how easy it was to recover data from them anyway.

avinashrawat · 19 Nov 2013

@jumanji
I face same kind of problem in my Toshiba 8 GB pendrive. I try with both utility Test Disk and Mini Tool Partition Wizard but not recover my USB. Also try with Easeus Data Recovery Professional wizard.Please help me.

jumanji · 20 Nov 2013

Sorry, due to my crippled condition I peep into SevenForums only when I am up and running to the extent permitted by my Ortho and do not scan all the subforums in the limited time..

Please start a new thread under Hardware and Devices subforum and restate your problem in as much detail as possible.

You may also do well to post screenshots how your pen drive looks in Windows Disk Management and Partition Wizard.

Even if I do not respond, there are others who may chip in and help you.