# Recovering data from a chip (MicroSD)

Gold Member

## Summary:

My computer tries to scan the chip but never finishes. Looking for options to recover data

## Main Question or Discussion Point

My boy gave me his MicroSD (Kingston 16Gb Class 4) phone chip to see if I can recover the data. His phone apparently told him it was corrupt. He tried it in a new phone and apparently it "sort of" worked. Until an update came along. I'm not sure if this is two distinct issues (the corruption them the switch to a new phone) but it seems they are independent.

Anyway, when I pop the chip in to my laptop it will not do anything until Win 10 has essentially read the entire chip. By this I mean the address bar at the top of Explorer becomes a green progress bar. Presumably, it is scanning the memory, though it gives no explicit indication that it is doing so.
It won't even show me the context menu when I right-click on the icon. The icon is inscrutable.

The progress bar never finishes. It goes green all the way over to the right of the bar and then just sits there forever. It never goes further and it never gives up and provides an error.

Short of physically sending it to a Data Recovery Service (which will cost some fraction of a grand and makes no guarantees), is there anything I might do to encourage to give up its secrets?

Related Computing and Technology News on Phys.org
Summary:: My computer tries to scan the chip but never finishes. Looking for options to recover data
I suppose the first thing I would try is to make a copy using something like Ghost or dd in Linux. Since these are straight bit copies it probably won't help but it is what I would try first.

Cheers

anorlunda
Mentor
The directory structure may be damaged. Would a hex, or ASCII dump of the readable parts sans directory info count as recovery for your son's purposes?

Gold Member
The directory structure may be damaged. Would a hex, or ASCII dump of the readable parts sans directory info count as recovery for your son's purposes?
Only if I can turn it back into usable data.

Gold Member
I suppose the first thing I would try is to make a copy using something like Ghost or dd in Linux. Since these are straight bit copies it probably won't help but it is what I would try first.
Is there a Windoze equivalent? Otherwise I'd better hup-to-it and go find a Linux friend.

phinds
Gold Member
2019 Award
... is there anything I might do to encourage to give up its secrets?
Well, you could threaten to send it to Texas if it doesn't behave.

anorlunda
Mentor
Only if I can turn it back into usable data.
It depends on what you need. If your son needs to retrieve his girlfriends phone number, an ASCII dump would probably do it. But to reassemble a 5MB JPG file scattered over many sectors from a hex dump would take you a year's work.

Try searching for disk forensic tools.

Gold Member
Pix and audio files.

Based on the problem description, I suspect a counterfeit Kingston -- you can download CrystalDiskInfo from https://crystalmark.info/en/software/ to check passively for that possibility.

Some tools for detecting fakes, including CrystalDiskMark, use methods that write data; they will not try to overwrite existing files, but to be on the safe side, you should make your recovery attempts in advance of using any testing software that requires any write access.

Most fakes have between 512MB and 1GB of usable space, with the manufacturer's area set to falsely report larger values for size and speed.

If the filesystem is directly Windows-compatible, I think your simplest and best procedural option is as follows:
1. Create a new folder/directory to hold any recovered files -- for later convenience, use a DOS-friendly name, e.g. recover4.​
2. Plug the device into a USB port. If something tries to autorun (autorun should always be disabled on general principles anyway), or Windows Explorer starts searching the device, cancel the process. That could be as simple as X-ing the window, or as annoying as having to open Task Manager (taskmgr.exe) to get to the process and stop it.​
3. Open a command prompt (cmd.exe).​
4. Navigate to your new folder/directory, e.g. C:\recover4 -- do not navigate to the misbehaving device.
5. While you're in the new folder/directory, using the drive letter assigned for the misbehaving device, e.g. F:\, issue the following xcopy command: $\mathtt { \text {xcopy F:\*.* /s /c /e} }$​
The /s means include subdirectories, the /c means ignore errors, and the /e means copy even empty directories. When the xcopy command is used without a destination specified, the default behavior of using the current folder/directory occurs. If you want to issue the command from some other folder/directory, you must specify the destination, or you'll pollute your current folder/directory -- this is what that xcopy command would look like: $\mathtt { \text {xcopy F:\*.* C:\recover4 /s /c /e} }$

The xcopy will result in all ordinarily readable content being copied from the misbehaving device to the new folder/directory. It should also 'echo' the list of files being copied. If it just hangs and shows no activity for a few minutes, then if anything on the device may be recoverable, to access it you'll need to use a tool that can examine and copy on a more directly physical basis.

If the SD card is formatted for an Android or an iPhone, then you should try the Linux methods, as @cosmik debris suggested. There are tools for mounting UNIX-style filesystems on Windows, but it would be easier to just boot from a Live Linux, e.g. Scientific Linux, on CD, DVD, or USB.

Gold Member
Based on the problem description, I suspect a counterfeit Kingston
Really? Did not know that was a thing.

He's had this in his phone for who knows how long. I'd think he'd have discovered if it ould only hold a few photos and/or songs.

Open a command prompt (cmd.exe).​
This make me wonder if the fastest test is simply to use the DOS cmd to view the chip's contents.

Are you plugging the phone in or instead using a chip reader USB?

If he's had the phone for a long time, and used the SD card to store more than half its rated capacity, then probably the card is not counterfeit, but yes, that is a 'thing', especially with new higher capacities.

This make me wonder if the fastest test is simply to use the DOS cmd to view the chip's contents.
Right. DIR /s ought to show something.

Gold Member
Right. DIR /s ought to show something.
First things first. If I change drive to E:/ - and I don't even get a command prompt back - that's bad ...

In my post I underlined to NOT try to navigate to the misbehaving device. Please say how the drive is attached -- is it via a phone, or some other connection?

When you merely list a directory, you get the behavior of interrupt 21h code 47h (get current/working directory), but when you switch to the device, you get boot sector load, etc. -- that's how some old malware used to spread.

Please try using: $\mathtt {\text {dir E: /s } }$

Tom.G
Last edited:
Is there a Windoze equivalent? Otherwise I'd better hup-to-it and go find a Linux friend.
There is a product called Ghost but I am sure there are others. Also there are hardware devices which will clone a drive. They are fairly cheap.

Cheers

Gold Member
There is a product called Ghost but I am sure there are others. Also there are hardware devices which will clone a drive. They are fairly cheap.
Will they be able to do anything with a drive that won't even return a prompt though?

This may possibly be the solid-state equivalent of a disc drive that won't even spin up - the best software in the world isn't going to read data off a drive that won't spin up.

Will they be able to do anything with a drive that won't even return a prompt though?

This may possibly be the solid-state equivalent of a disc drive that won't even spin up - the best software in the world isn't going to read data off a drive that won't spin up.
Yes, that's true, but you don't know that yet.

Cheers

Gold Member
Yes, that's true, but you don't know that yet.

Cheers
I suppose. Though I do assume that, if DOS can't even return a prompt then no software is going to be able to even access it. But that is likely a poor assumption - since that's what disc recovery s/w is supposed to be able to do.

Staff Emeritus
2019 Award
In my post I underlined to NOT try to navigate to the misbehaving device.
This is like helping my mother. She calls and says, "My computer is giving me an error message". I ask her to go to her computer and read it to me, but not to touch anything. Tappa-tappa-tappa-tap-click-click-click later, and then she says "I can't read you the error message because it's gone now."

Dave, what should should have done is copied the SD card to another one using dd (Linux) or similar (WIndows). Put the old one away and try to recover the copy. But taking the only copy of the data you have and writing to that copy may not have a favorable outcome.

Gold Member
In my post I underlined to NOT try to navigate to the misbehaving device. Please say how the drive is attached -- is it via a phone, or some other connection?
Sorry. I don't know how I missed this post.

I know as soon as I navigate to it in Windows, all sorts of hijinks occurs.
So I won't/didn't.
Does that apply to the DOS command line too? I thought that would be stripped down.

I am plugging the chip directly into the slot on my lappie.