USB Access Problem

[wfc569]

Tools->Update Custer maps

Tools->Cluster Map

then you start "navigating" the "bottom window", (with cursor keys) you will see how clusters from 331 to 370 are not allocated, (and thus may contain the "beginning" of the excel file), if you continue (right cursor arrow) up to vcn 271 and go beyond it over vcn 272, you see that the filename changes, BUT if you go "backwards" (left cursor arrow) you will notice how the "same" area is now linked to "other files".

*********************************************************************************************************************************************************

OK, i followed your instruction and went through the cluster map for those lines regarding the “Yahoo v Impulse System.xls” file. Like you said, this file if fragmented. Please correct me if I am wrong.... if I have a "good" USB stick, the cluster map will show consecutive sequence for each file and cluster # will match to file attributes in the upper panel. Currently, my cluster map is just like a scramble egg.... correct?

I like to continue diving into this topic of manual recovery of a file..... Since DMDE provides the cluster map for a file, can I use the cursor arrow to locate other "fragmented" - “Yahoo v Impulse System.xls” piece and perform something like "cut and paste" so I can glue them in the same cluster area in order to fix the fragmentation issue? If my approach is not a good idea, would you recommend a way to piece back fragmented file together?

thanks

[jaclaz]

OK, i followed your instruction and went through the cluster map for those lines regarding the “Yahoo v Impulse System.xls” file. Like you said, this file if fragmented. Please correct me if I am wrong.... if I have a "good" USB stick, the cluster map will show consecutive sequence for each file and cluster # will match to file attributes in the upper panel. Currently, my cluster map is just like a scramble egg.... correct?

Yes (meaning No ) you are wrong.

There is nothing particularly "bad" in a file being fragmented (actually it is quite normal that a file, expecially a "growing one" becomes fragmented over time or - more simply - the deletion of files creates "empty spots" here and there that are later filled by a single larger file that then becomes fragmented.

On a healthy filesystem this is "normal" and there are no issues whatsoever because the exact position (and sequence) of clusters where the file is stored are recorded in the FAT table(s).

The issue here is that the FAT tables of that stick - for whatever reason - have been overwritten/are invalid.

The "patch" I sent you is made of an adequate bootsector and of two empty FAT tables assembled together with the (valid) ROOT directory already existing on the stick.

This allows for "normal" listing of the files/dirs, but the DMDE (or any other program) has only the info to where the files starts - and since the FAT tables are empty it assumes that the file is contiguous, i.e. it "virtually maps" enough clusters to contain the file size starting from it's starting address.

If you prefer, all filesystems after some use do become "scrambled eggs", but you normally have a slow motion video of the scrambling that you can virtualy play backwards to make again the eggs "as they were".

I like to continue diving into this topic of manual recovery of a file..... Since DMDE provides the cluster map for a file, can I use the cursor arrow to locate other "fragmented" - “Yahoo v Impulse System.xls” piece and perform something like "cut and paste" so I can glue them in the same cluster area in order to fix the fragmentation issue?

No.

Sorry but you have not yet grasped the above illustrated concept, the cluster map that DMDE provides is a "virtual one" or, if you prefer it represents the FAT tables how they should have been if ...

If my approach is not a good idea, would you recommend a way to piece back fragmented file together?

The idea is not bad, only (and simply) it doesn't work like that.

Imagine that you have a toy shop.

A mad employee opens (say) 100 boxes of (different) puzzles and puts the contents all together in a bag.

Your mission, should you accept it is to re-compose all puzzles in order to put back all the right pieces of the puzzles in the right box, then put together the pieces of the single puzzle you are interested in.

And you don't know if the mad employee (being mad) did not hide, destroy or paint "white" a certain number of pieces, both of the puzzle you want to rebuild and/or of the other puzzles.

So, you have two questions that only have very vague answers:

Can it be done? Yes or no, it depends.

How long will it take? Cannot say, it greatly depends on the original contents of the file and of the contents of all the other files, to continue in the puzzles example if the one you want to put together depicts a wiinter panorama oof a city and all the other 99 represent beaches, sea views, reproductions of still life paintings, etc. it will be easier, if all 100 represent winter panoramas, it woud be really tough.

The puzzles examples are good because they introduce the concept of "art", data recovery is as I see it a (very marginal ) form of "art", let's say painting, in due time you can learn allright the techniques used in it, but if you are not an artist, the resuts will not be good to the eye.

More seriously when it comes to manual recovery, it is "artisan work", you need experience and (deep) knowledge of the matter but you also grow your own "style" and abilities, when it comes to it, it is perfectly possible that one expert can make nothing of it (or take "forever" in doing it) while another one may put together "the pieces" quickly and successfully, there is simply no way to know in advance.

jaclaz

Edited October 17, 2012 by jaclaz

[wfc569]

Many thanks for this thorough explanation. In my mind, when I encounter an issue, I like understand it and try to solve it along the way if I have to learn along the side. In the beginning of this process, i totally had no idea about data recovery, slowly but surely, I start getting some idea how data works in the computer world.

Although I don't have a computer science degree under my belt, I am interested in learning how to do this data recovery technique if you think this is something can be taught over the world wide web. If, for whatever the reason, you think this is beyond the purpose of this forum, I totally understand and respect that. Still, I really appreciate all the explanation and instruction received from you through out this exercise.

thanks

[jaclaz]

Many thanks for this thorough explanation. In my mind, when I encounter an issue, I like understand it and try to solve it along the way if I have to learn along the side. In the beginning of this process, i totally had no idea about data recovery, slowly but surely, I start getting some idea how data works in the computer world.

Good, this is the "right" approach.

Although I don't have a computer science degree under my belt, I am interested in learning how to do this data recovery technique if you think this is something can be taught over the world wide web. If, for whatever the reason, you think this is beyond the purpose of this forum, I totally understand and respect that. Still, I really appreciate all the explanation and instruction received from you through out this exercise.

There is no need whatever for a computer science degree, as a matter of fact I have personally met "IT specialists" that deemed tasks similar to this one "impossible", yet *somehow* they were later proved to be perfectly possible .

In your case the issue is that there is no way to know ab initio IF it is possible or if the result, if possible, would be satisfactory.

I see it more a matter of evaluating the costs/benefits of such a task, after all it is an Excel spreadsheet of which - at least from the directory structure I saw - you seemingly have earlier versions (and I presume that a copy of such earlier version is still avaialble "somewhere" - like in your home or office PC) so you have to evaluate:

• the time that will take you to re-update the spreadsheet (from an earlier version)
  
• the time that it would take you to re-create it from scratch
  
• the time that it would take you to learn how to (hopefully) recover that file
  
• the time that it will take you to actually analyze and (hopefully) recover that file
  
• the value you atttribute to your time (and thus the price that you may be wanting to pay a profesional for it)
  

Of course I cannot make an "online course" on the matter (provided that I have the capabilities/knowledge to make one ), as said - unlike other much simpler cases seen (and often but not always solved) - through the forum, you are in a "difficult" situation with a huge number of "bifurcations", and exploring all the possible paths, with the aggravation of "not-real-time" comminication is not a viable possibility.

I can give you the "basics" (of which some I already gave you) and suggest you the (hopefully) "right" "generic" approach and possibly a few links to read, but not much else.

jaclaz

[wfc569]

thx for the candid suggestion!! I understand my case is probably on the complicated side so my hope to get my data back is not high....

If not too much of trouble from your end, I really appreciate for any pointers you can share on learning how to do data recovery. I don't plan to re-format my USB stick any time soon and have a new one ordered so I can keep this damaged one. Maybe use it as a learning opportunity.

[jaclaz]

Here is a good "base pointer":

http://www.forensicswiki.org/wiki/FAT

(and ALL links in it)

After reading that introductory page (and before perusing the links) go through this site:

http://thestarman.pcministry.com/asm/mbr/index.html

several important bits and pieces of info, starting here:

http://thestarman.pcministry.com/asm/mbr/DataRecovery.htm

Since - at the moment - you have a FAT16 issue, an exceptionally good resource (if you can still find a copy of it *somewhere* would be the (paper) manual for Norton Utilities (for DOS or the "for Win95" or "for NT") that AFAICR has some very good examples of manual rebuilding of FAT tables, this one (example to make it clear, you want something with Peter Norton depicted on it , NOT any of the later crappy Symantec "wonders"):

http://www.ebay.co.uk/itm/Symantec-Norton-Utilities-Version-3-0-Windows-95-/230830439307?pt=US_Drivers_Utilities_Software&hash=item35be90fb8b

jaclaz

[wfc569]

many thx, jaclaz. I will spend some time browsing through these links and try to see if I can pick up a trick or two... Meanwhile, I will probably have to seek professional assistance and try to get my data recovered. Unfortunately, I just rebuilt my home PC few weeks ago and moved most of my data to that damaged USB stick. Although I did manage to find some back up data in a separate external hard drive, I may still lose some data saved this year if I can not recover data from the damaged USB.