Recovering data from a chip (MicroSD)

[DaveC426913]

TL;DR Summary

My computer tries to scan the chip but never finishes. Looking for options to recover data

My boy gave me his MicroSD (Kingston 16Gb Class 4) phone chip to see if I can recover the data. His phone apparently told him it was corrupt. He tried it in a new phone and apparently it "sort of" worked. Until an update came along. I'm not sure if this is two distinct issues (the corruption them the switch to a new phone) but it seems they are independent.

Anyway, when I pop the chip into my laptop it will not do anything until Win 10 has essentially read the entire chip. By this I mean the address bar at the top of Explorer becomes a green progress bar. Presumably, it is scanning the memory, though it gives no explicit indication that it is doing so.
It won't even show me the context menu when I right-click on the icon. The icon is inscrutable.

The progress bar never finishes. It goes green all the way over to the right of the bar and then just sits there forever. It never goes further and it never gives up and provides an error.

Short of physically sending it to a Data Recovery Service (which will cost some fraction of a grand and makes no guarantees), is there anything I might do to encourage to give up its secrets?

 

[cosmik debris]

Summary:: My computer tries to scan the chip but never finishes. Looking for options to recover data

I suppose the first thing I would try is to make a copy using something like Ghost or dd in Linux. Since these are straight bit copies it probably won't help but it is what I would try first.

Cheers

 

[anorlunda]

The directory structure may be damaged. Would a hex, or ASCII dump of the readable parts sans directory info count as recovery for your son's purposes?

 

[DaveC426913]

The directory structure may be damaged. Would a hex, or ASCII dump of the readable parts sans directory info count as recovery for your son's purposes?

Only if I can turn it back into usable data.

 

[DaveC426913]

I suppose the first thing I would try is to make a copy using something like Ghost or dd in Linux. Since these are straight bit copies it probably won't help but it is what I would try first.

Is there a Windoze equivalent? Otherwise I'd better hup-to-it and go find a Linux friend.

 

[phinds]

... is there anything I might do to encourage to give up its secrets?

Well, you could threaten to send it to Texas if it doesn't behave.

 

[anorlunda]

Only if I can turn it back into usable data.

It depends on what you need. If your son needs to retrieve his girlfriends phone number, an ASCII dump would probably do it. But to reassemble a 5MB JPG file scattered over many sectors from a hex dump would take you a year's work.

Try searching for disk forensic tools.

 

[DaveC426913]

Pix and audio files.

 

[sysprog]

Based on the problem description, I suspect a counterfeit Kingston -- you can download CrystalDiskInfo from https://crystalmark.info/en/software/ to check passively for that possibility.

Some tools for detecting fakes, including CrystalDiskMark, use methods that write data; they will not try to overwrite existing files, but to be on the safe side, you should make your recovery attempts in advance of using any testing software that requires any write access.

Most fakes have between 512MB and 1GB of usable space, with the manufacturer's area set to falsely report larger values for size and speed.

If the filesystem is directly Windows-compatible, I think your simplest and best procedural option is as follows:

​

1. Create a new folder/directory to hold any recovered files -- for later convenience, use a DOS-friendly name, e.g. recover4.​

​

2. Plug the device into a USB port. If something tries to autorun (autorun should always be disabled on general principles anyway), or Windows Explorer starts searching the device, cancel the process. That could be as simple as X-ing the window, or as annoying as having to open Task Manager (taskmgr.exe) to get to the process and stop it.​

​

3. Open a command prompt (cmd.exe).​

​

4. Navigate to your new folder/directory, e.g. C:\recover4 -- do not navigate to the misbehaving device.​

​

5. While you're in the new folder/directory, using the drive letter assigned for the misbehaving device, e.g. F:\, issue the following xcopy command: $\mathtt { \text {xcopy F:\*.* /s /c /e} }$​

​

The /s means include subdirectories, the /c means ignore errors, and the /e means copy even empty directories. When the xcopy command is used without a destination specified, the default behavior of using the current folder/directory occurs. If you want to issue the command from some other folder/directory, you must specify the destination, or you'll pollute your current folder/directory -- this is what that xcopy command would look like: $\mathtt { \text {xcopy F:\*.* C:\recover4 /s /c /e} }$

The xcopy will result in all ordinarily readable content being copied from the misbehaving device to the new folder/directory. It should also 'echo' the list of files being copied. If it just hangs and shows no activity for a few minutes, then if anything on the device may be recoverable, to access it you'll need to use a tool that can examine and copy on a more directly physical basis.

 

[sysprog]

If the SD card is formatted for an Android or an iPhone, then you should try the Linux methods, as @cosmik debris suggested. There are tools for mounting UNIX-style filesystems on Windows, but it would be easier to just boot from a Live Linux, e.g. Scientific Linux, on CD, DVD, or USB.

 

[DaveC426913]

Based on the problem description, I suspect a counterfeit Kingston

Really? Did not know that was a thing.

He's had this in his phone for who knows how long. I'd think he'd have discovered if it ould only hold a few photos and/or songs.

Open a command prompt (cmd.exe).​

​

This make me wonder if the fastest test is simply to use the DOS cmd to view the chip's contents.

 

[sysprog]

Are you plugging the phone in or instead using a chip reader USB?

 

[sysprog]

If he's had the phone for a long time, and used the SD card to store more than half its rated capacity, then probably the card is not counterfeit, but yes, that is a 'thing', especially with new higher capacities.

 

[sysprog]

This make me wonder if the fastest test is simply to use the DOS cmd to view the chip's contents.

Right. DIR /s ought to show something.

 

[DaveC426913]

Right. DIR /s ought to show something.

First things first. If I change drive to E:/ - and I don't even get a command prompt back - that's bad ...

 

[sysprog]

In my post I underlined to NOT try to navigate to the misbehaving device. Please say how the drive is attached -- is it via a phone, or some other connection?

 

[sysprog]

When you merely list a directory, you get the behavior of interrupt 21h code 47h (get current/working directory), but when you switch to the device, you get boot sector load, etc. -- that's how some old malware used to spread.

 

[sysprog]

Please try using: $\mathtt {\text {dir E: /s } }$

 

[Tom.G]

Try looking here for recovery utilities:
https://www.pcworld.com/article/251252/roundup_6_data_recovery_tools_for_portable_storage.html

The one at the bottom of the first page (I haven't looked further), "PhotoRec", is free and the review looks decent; haven't tried it though.

Also search the site for Disk Copy, Recover, Recovery,... etc.

Cheers,
Tom

 

[cosmik debris]

Is there a Windoze equivalent? Otherwise I'd better hup-to-it and go find a Linux friend.

There is a product called Ghost but I am sure there are others. Also there are hardware devices which will clone a drive. They are fairly cheap.

Cheers

 

[DaveC426913]

There is a product called Ghost but I am sure there are others. Also there are hardware devices which will clone a drive. They are fairly cheap.

Will they be able to do anything with a drive that won't even return a prompt though?

This may possibly be the solid-state equivalent of a disc drive that won't even spin up - the best software in the world isn't going to read data off a drive that won't spin up.

 

[cosmik debris]

Will they be able to do anything with a drive that won't even return a prompt though?

This may possibly be the solid-state equivalent of a disc drive that won't even spin up - the best software in the world isn't going to read data off a drive that won't spin up.

Yes, that's true, but you don't know that yet.

Cheers

 

[DaveC426913]

Yes, that's true, but you don't know that yet.

Cheers

I suppose. Though I do assume that, if DOS can't even return a prompt then no software is going to be able to even access it. But that is likely a poor assumption - since that's what disc recovery s/w is supposed to be able to do.

 

[Vanadium 50]

In my post I underlined to NOT try to navigate to the misbehaving device.

This is like helping my mother. She calls and says, "My computer is giving me an error message". I ask her to go to her computer and read it to me, but not to touch anything. Tappa-tappa-tappa-tap-click-click-click later, and then she says "I can't read you the error message because it's gone now."

Dave, what should should have done is copied the SD card to another one using dd (Linux) or similar (WIndows). Put the old one away and try to recover the copy. But taking the only copy of the data you have and writing to that copy may not have a favorable outcome.

 

[DaveC426913]

In my post I underlined to NOT try to navigate to the misbehaving device. Please say how the drive is attached -- is it via a phone, or some other connection?

Sorry. I don't know how I missed this post.

I know as soon as I navigate to it in Windows, all sorts of hijinks occurs.
So I won't/didn't.
Does that apply to the DOS command line too? I thought that would be stripped down.

I am plugging the chip directly into the slot on my lappie.

 

[Tom.G]

The paranoid approach (or CYA approach):

Windows does a write to the directory every time a file is accessed (read).

Well, DOS isn't quite as bad, mostly just risky from operators errors.

My detailed information on those SD chips is limited, but since they have Auto wear-levelling (and maybe re-allocation ?) algorithms built in, just powering them up may make them worse. On Hard Disk Drives it will almost always make them worse.

Treat them as you would a fire in your house; are you going to try to blow it out, grab a fire extinguisher, or call the fire department. Yeah, it depends on whether someone dropped a match on a concrete floor or there is an attic fire blocking access. With the SD card you don't know which you have.

If the data is important use the fire department option and apply some Recovery Software! First step is use the recovery software to make a copy if at all possible. Then work on the copy. Or if it's really important, make a copy of the copy and work on that second generation. Copying the original just could have been the last access you will ever get!

Well, enough scary stories. Take your pick.

Cheers,
Tom

p.s. Please keep us updated. Every data point we can get can help us all when the situation strikes us.

 

[sysprog]

@Vanadium 50 I think @DaveC426913 was only trying to switch his command prompt to the letter for the misbehaving device; not actually trying to write anything to the device. I recommended against switching to the device, in particular because he reported that he gets a hang when tries that. Recovery methods in general don't try preliminarily to set a misbehaving device as the 'home drive'; they treat it as a foreign unknown until more is known.

 

[sysprog]

@DaveC426913, I think that Clonezilla live might be a good option. If you are going to use that, please DO NOT DISREGARD ANY WARNINGS. The warnings appear in pink boxes and-or red lettering there, so they're conspicuous enough that they should not easily go unnoticed by a person who is reading the instructions.

The image file that you get from running Clonezilla live is not something that is suitable for you to mount or to browse directly. The contemplated method is that after you have made the image file, you restore it to another device, and then go after the files that you want as they may appear on the other device. That's along the lines of the conservative approach that @Tom.G suggested.

Given that you are able to plug the SD card directly in, please let us know what happens when you do not try to navigate to the device and set its top level as the home directory, but instead, from a command prompt, please try using: $\mathtt {\text {dir E: /s } }$

 

[MikeeMiracle]

You could close the card but I would not overly worry if you cannot, you will have to be unlucky to lose more data because of it. This is more relevant if you want to recover a deleted file from an accessible drive as you do not want the actual data overwritten by writing new data to it which you cannot do in its present state. Physical spinning disks as well as SSD's will detect any physically bad sectors and will move the data around to knwo good sectors, potentially overwritting any data you wish to recover, this is why you have been asked to clone the disk. As far as I am aware I am unsure that SD cards have this functionality.

Put it into a PC card reader and use dedicated recovery software on the PC to read the contents. All storage is like a book, as well as the data stopred on it there is an index which states where the data is actually held on that disk. When you open a file on your computer it does not read the whole drive looking for it, it looks at the index to tell it where the data is. If that index is corrupt, then you will not be able to read and it will appear corrupt. Using dedicated recovery software, that software will read the entire disk for data, in effect creating it's own index in the process. From there it will tell you what files it has discovered and which can be recovered.

 

[MantraFiltration]

There is a product called Disk Drill. Also there are hardware devices which will clone a drive.

 

[sysprog]

Yes, @MantraFiltration, that's right.