Recovering data from an unstable flash drive

By | September 16, 2020

Recovering data from an unstable flash drive often proves to be a lot harder than recovering data that was lost due to deletion or accidental formatting. This is due to the fact that data recovery software is written to address issues at the ‘data level’ while often instability issues are at the ‘disk level’. What I will discus in this post basically is true for all types of drives (flash or spinning) although there are differences.

Three levels of data recovery

DeepSpar, a manufacturer of professional data recovery hardware discriminates three levels of data recovery:

  1. Data level: These include logical issues which basically means meta data that is needed to locate files are corrupt or missing. Data recovery software can be used to work around these problems by reconstructing a virtual file system.
  2. Disk level or Drive instability issues: These often provide a too large challenge for data recovery software due to read access problems. As data recovery software has no direct access to the hardware and lacks the ability to monitor and adjust drive access it is at the grace of the operating system to handle such problems. This means data recovery software is no better equipped to deal with such issues than say, Windows Explorer. If disk access takes too long Windows may simply decide to disconnect such a drive.
  3. Drive level: Problems at this level require hardware repairs. In case of a conventional hard drive, the read/write heads may need to be replaced. In case of flash based storage devices the PCB may require repairs or in a worst case NAND chips have to be dumped directly, from that logical image has to be re-assembled.

In other words, in order to be able to use data recovery software, issues at drive and disk level need to be addressed first. In this post I will leave drive level out of consideration. Such issues will need to be addressed by a full blown data recovery lab. Disk level issues may be do-able if you’re willing to take a risk. The cost of this risk is say roughly $250-$500. These are prices many specialized data recovery services and labs charge for this type of data recoveries. These services and labs have a better chance or reducing the risk of total failure and to recover your data.

Dealing with Disk level or Drive Instability Issues

The OS

Hurdle one is the operating system. Of course a major task of any OS is to give you access to your data. In order to do so it will investigate what it can find on drives attached to the system. It will read and interpret meta data, update various logs and so on. When dealing with an unstable drive it’s however what you do not want it to do! Only reading meta data alone accounts for megabytes worth of data. An accidental read error in any of those meta data structures will trigger the drives own error recovery routines, and if those fail, the OS will request the data again and again. Both Linux and Windows can however be instructed to leave a drive alone to circumvent this problem to a degree.

Logical data recovery software

Although we’re dealing with a flash based drive rather than a disk, the principle remains largely the same. Instability issues are frequently caused by read errors. Since data recovery software relies in Windows to access and process those sectors, it can not do anything else than wait until Windows is done. However, it is not uncommon for Windows to disconnect a drive when processing takes too long. In my testing many data recovery software will stubbornly try copying remaining sectors (read error returned each time) or simply freeze.

Drive cloning or imaging

To deal with this at the DIY level you would need to isolate the data level issues from disk level issues. What I mean is, you first try cloning/imaging the drive (to address the disk level issue) and then run data recovery software to address the data level issue. If a drive is however bad enough you will run into the limitations of software based drive cloning and imaging: Bad sectors will take an incredible amount of time to process and the drives own error recovery procedures (re-reads) can not be prevented. So not only will take imaging impractically long, it will also further deteriorate the drive’s condition with the potential danger of it failing completely.

At some point the drive may become unresponsive completely and in such a case power cycling it is the only way to get it going again. On some drives this happens every 100 Megabytes for example. Power cycling can then sometimes be automated (see https://youtu.be/DHykaRlfRwc and https://youtu.be/v1ql6yNS0qk). However, for spinning drives power cycling is stressful to.

Okay, so what can a professional service do?

If we leave physical repairs out of the equation, a professional data recovery service has to perform the same balancing act: The get the data we need to read the drive, but reading it stresses the already unstable drive. So ultimate goal is to get the data while stressing the drive as little as possible so it survives for at least the duration of the recovery. And by recovery I basically mean the drive imaging / cloning process. As soon as we have that more than half the battle is won!

Machines!

Some times data recovery machines come as sexy little units ..

Some times data recovery machines come as sexy little units ..

The solution data recovery services and labs use are hardware based. Unfortunately this is without exception expensive equipment often requiring yearly license fees. The idea is to use hardware that:

  • Isolates the drive from the OS (to prevent destructive mounting and reads, read/write logfile below)
  • Allows monitoring of drive behavior (Speed alone can be very telling but also error/response codes)
  • And allows disk access parameters to be tweaked (By specifying time-outs prevent drive from doing error recovery)
  • Automatic software/hardware resets or power cycling based on certain events
  • Even more advanced hardware even allows manipulation of the firmware of drives (stop self scanning for example)

Windows mounting a drive – read/write actions logged, LBA address[no. sectors]:

Successful Read: 0[16]
Successful Read: 0[1]
Successful Read: 7[4]
Successful Read: 2[1]
Successful Read: 2048[1]
Successful Read: 2048[32]
Successful Read: 3907027119[1]
Successful Read: 6293504[8]
Successful Read: 5912104[24]
Successful Read: 5912128[24]
Write Attempt 35: 5912136[8] – RCRD $LogFile
Successful Read: 6043168[8]
Successful Read: 6293504[64]
Write Attempt 36: 5912112[8] – RSTR $LogFile
Write Attempt 37: 5912104[8] – RSTR $LogFile
Write Attempt 38: 5912120[8] – RCRD $LogFile
Write Attempt 39: 5912112[8] – RSTR $LogFile
Successful Read: 2072[256]
Successful Read: 6174248[4096]
Successful Read: 6178344[6144]
Successful Read: 0[16]
Successful Read: 6184488[16384]
Successful Read: 0[1]
Successful Read: 6200872[16384]
Successful Read: 12734209[1]
Successful Read: 6217256[16384]
Successful Read: 12734209[1]
Successful Read: 6233640[16384]
Successful Read: 0[16]
Successful Read: 6250024[2048]
Successful Read: 6252072[2048]
Successful Read: 6254120[10240]
Successful Read: 6264360[6144]
Successful Read: 6270504[8192]
Successful Read: 6278696[8192]
Successful Read: 6286888[6593]
Successful Read: 4836864[9]
Successful Read: 4967952[5]
Successful Read: 2328[8]
Successful Read: 2400[8]
Successful Read: 4965200[8]
Successful Read: 4869960[40]
Successful Read: 4890408[32]
Successful Read: 4931400[40]
Successful Read: 4939560[32]
Successful Read: 6293576[8]
Successful Read: 4967944[8]
Successful Read: 6293488[8]
Successful Read: 6293568[8]
Successful Read: 4967352[126]
Successful Read: 4967478[2]
Successful Read: 4911936[8]
Successful Read: 4910920[512]
Write Attempt 40: 5912128[8] – RCRD $LogFile
Write Attempt 41: 5912120[8] – RCRD $LogFile
Write Attempt 42: 5912128[8] – RCRD $LogFile
Successful Read: 0[16]
Successful Read: 6293584[8]
Successful Read: 0[16]
Successful Read: 12734209[1]
Successful Read: 0[16]
Successful Read: 0[1]
Successful Read: 12734209[1]
Successful Read: 0[16]
Successful Read: 12734209[1]
Successful Read: 0[16]
Successful Read: 0[1]
Successful Read: 12734209[1]
Successful Read: 0[16]
Successful Read: 12734209[1]
Successful Read: 0[16]
Write Attempt 43: 5912136[8] – RCRD $LogFile
Write Attempt 44: 5912120[8] – RCRD $LogFile
Write Attempt 45: 5912104[8] – RSTR $LogFile
Successful Read: 0[16]
Successful Read: 0[1]
Successful Read: 12734209[1]
Successful Read: 0[16]
Successful Read: 12734209[1]
Successful Read: 0[16]
Successful Read: 0[1]
Successful Read: 12734209[1]
Successful Read: 0[16]
Successful Read: 12734209[1]
Successful Read: 0[16]
Write Attempt 46: 2400[8] – INDX (MFT ‘\’ – Root Directory)
Write Attempt 47: 5912128[8] – RCRD $LogFile
Write Attempt 48: 5912112[8] – RSTR $LogFile
Write Attempt 49: 6293560[8] – MFT 28: ‘$Repair’
Write Attempt 50: 5912120[8] – RCRD $LogFile
Write Attempt 51: 5912104[8] – RSTR $LogFile

Note that failed reads will cause the OS to re-read sectors several times, and if those attempts fail, to start the process all over again. This is causes undesired stress on the drive and will cause the OS to freeze and eventually ‘drop’ the drive.

And add  some experience ..

This hardware can be controlled by software. Some times the sole purpose of the hardware/software is strictly isolating, monitoring and adjusting disk access while additional software is used to create the disk image. Other tools even offer integrated drive imaging and logical data recovery.

But it’s mainly the ability to monitor and adjust drive behavior and prevent the drive from self destructing.

Something as simple as automatically powering down a drive when idle for more than a few seconds can make a world of difference: An idle drive will start doing maintenance, something you do not want an unstable drive to do. These are measures, seemingly simple, that will increase the chances the drive stays alive and will give us the data.

Experience comes into play when interpreting drive behavior determining how to tweak the different parameters. But by tweaking for example read time-outs alone, stress on a drive and time needed to image can be reduced dramatically (4 hours to image the drive rather than 20 greatly improves the chances the drive unstable will survive).  What kind of reset to use if an unrecoverable error occurs? A software reset is less stressful than a power cycle in many cases. However certain drives go into a sort of panic mode that will not process software resets and the only way to pull them out is a power cycle.

DiskTuna Data Recovery Service

I offer a photo repair service for quite a while now. Frequently people send me photos that are the ‘product’ of file recovery attempts. Most times recovery is performed using end user file recovery software but by sometimes data recovery services too. If a file is incorrectly recovered it will be corrupt because it simply hasn’t got all photo data or even none at all. In such cases the only thing that makes sense to go back to the source and try recovering the files intact.

So occasionally I allowed for people to send memory cards to me so I could try recovering them. Issues vary from severely corrupt file systems (data level issues) but sometimes it was a struggle to even get a card to read (disk level issues). When I considered offering a photo and memory card data recovery service I knew I needed something that would:

  • Allow me to to a degree guarantee that I would never write to the patient drive
  • Prevent Windows from freezing when confronted with patient (Windows is my main OS)
  • Allow me to work with unstable drives at least. At this point I have no desire yet to do chip-off recovery though I may very well expand into that direction in the future

DeepSpar data recovery hardware

So, people who send in their memory cards for recovery can be certain every precaution is taken to reduce risk of further damage and to achieve best possible results. Creating a drive image is always the vital first step in the data recovery process. Using special data recovery hardware will also allow me to process cards that can not be using software alone.

 

 

 

 

Leave a Reply

Your email address will not be published. Required fields are marked *