USB stick no longer working - Lost partition with value data

[jaclaz]

Photorec is actually recovering quite a few files from the disk image!

Good :, that is a sign that you have likely bought a "fake" USB stick (or anyway that a "wrap-around kind of issue happened because of some error of the controller/settings) and what you got is "just" the "wrap-around" issue.

The second image you posted is identical to first one, which confirms how the error you got initially with DSFO could be ignored, but also that filesystem oriented recovery is impossible on that stick.

Remember that Photorec cannot find the "original" filenames, and often it may mistake a file type for another (just as an example Office .xlsx and .docx files may be retrieved/recognized as .zip (mainly because they actually ARE ZIP files ).

It is recommended to "post-process" the results from PhotoRec:

http://www.cgsecurity.org/wiki/After_Using_PhotoRec

http://builtbackwards.com/projects/photorec-sorter/

to first group recovered files, then, if you have issues, you may want to use TriD on the files that have not been identified properly:

http://mark0.net/soft-trid-e.html

jaclaz, thank you so much for your help so far.

You are welcome, I am sure .

Normally the last file(s) that you saved won't be recoverable, BUT if what happened is a "pure" wrap-around issue, you may want to try re-sequencing the image.

Translation/example:

Imagine that you have what the OS/filesystem thinks to be a (very, very small) 10 sector device:

0123456789

and you want to write on it the words hello and world, if the device actually has 10 sectors you would have something like:

0123456789

helloworld

BUT if it has, say, only seven sectors you would get something *like*:

0123456

rldlowo

By appending a second copy of the image, like:

01234560123456

rldloworldlowo

It is sometimes possible that also the "world" can be retrieved.

In your case, the "queer" fact is that the image is larger that the original device, so it is possible that this wrapping around happened at "controller" level and you are actually have already a re-sequenced image.

jaclaz