USB Flash Drive now missing Folder of Documents ; How to recover this Folder ?

[KittenKong]

16 hours ago, OneMoreFarang said:

This is a very good and free program to retrieve any lost data:

http://www.cgsecurity.org/wiki/PhotoRec

But, at least last time I used it maybe a year or two ago, it was more a program for experts and not for normal users.

 

I mentioned TestDisk a few days ago. This programme is perhaps better suited to this particular problem as the OP seems to have disappearing folders as well as disappearing files. TestDisk will recover the entire folder structure (if possible) to another drive, or repair the FAT, which seems to be what the OP needs.

 

However the OP seems determined to ignore the most simple and important bit of advice: do NOTHING with the drive until the files have been recovered.

[KittenKong]

18 hours ago, Oxx said:

It's not FAT deleting the files.  A program has told FAT to delete the files.  That could be malware.  It could be something you've done yourself by mistake.

 

I doubt that this is the case on a Linux machine. I suspect that the FAT is simply corrupted. This could be due to a faulty or fake USB stick.

 

TestDisk should be able to either repair the FAT or copy the entire folder structure to another drive, from where the individual files may eventually be recovered.

[OneMoreFarang]

3 hours ago, KittenKong said:

 

I mentioned TestDisk a few days ago. This programme is perhaps better suited to this particular problem as the OP seems to have disappearing folders as well as disappearing files. TestDisk will recover the entire folder structure (if possible) to another drive, or repair the FAT, which seems to be what the OP needs.

 

However the OP seems determined to ignore the most simple and important bit of advice: do NOTHING with the drive until the files have been recovered.

Sorry, I didn't read you post about TestDisk. I just jumped to the end and recommended PhotoRec from the same developer. It was not my idea to just repeat your good advice. Both are good programs.

And I agree the most important thing is to do nothing with the problematic drive except the recovery. But somehow many "normal users" like to ignore this kind of information...

[Our Man in the Tropics]

Just to say that immediately upon being told not to "input" any more files to the USB Flash Drive I adhered to that advice ;

However, I did copy all the Files & Folder s -- incl. Hidden Files & Hidden Folders -- to an External Hard Drive ;

And, I did notice No. of Files in External Hard Drive being less than stated No. of Files in USB Flash Drive.

And, then I decided to put that External Hard Drive away until I get proper handle on original USB Flash Drive issue ;

Indeed, I fear that the problem I have with USB Flash Drive will have replicated itself to be problem also for External Hard Drive.

I have not performed any of the pro-active advice yet ;

Because, I will have to school up on what is a very daunting journey of learning for me.

But, please do not fear that ur replies are wasted ;

I most certainly will delve as deep as I can into all of them ahead of finally, but tentatively, trying them.

Also, of course, this whole thread should serve a great many posters well ;

It may even become archived. 8-)

Meanwhile, upon searching around the topic, I found the following [ starting from the lead given by Oxx about Character OxE5 ; Somewhat ironic that reference to "Ox.." from "Oxx" 8-) ]  links : 
........................................................................................... 
https://www.google.co.th/search?client=ubuntu&channel=fs&q=character+0xE5&ie=utf-8&oe=utf-8&gws_rd=cr&dcr=0&ei=5k_9WaeGNMTYvASE4biQDQ
......................................................................................... 
https://books.google.co.th/books?id=pM0qfhtz4VgC&pg=PA59&lpg=PA59&dq=character+0xE5&source=bl&ots=lw85WTRcP2&sig=Hk3lA5CaMbVb6zZNtb5CuaHxBak&hl=en&sa=X&ved=0ahUKEwjetbzkl6TXAhWBro8KHaKECA8Q6AEIMjAC#v=onepage&q=character 0xE5&f=false 
........................................................................................ 
https://www.amazon.com/EnCase-Computer-Forensics-Official-EnCE/dp/0470901063/ref=dp_ob_title_bk
........................................................................................... 
https://www.amazon.com/Art-Memory-Forensics-Detecting-Malware/product-reviews/1118825098/ref=cm_cr_dp_d_hist_3?ie=UTF8&filterByStar=three_star&reviewerType=all_reviews#reviews-filter-bar
............................................................................................... 
https://en.wikipedia.org/wiki/Computer_forensics
................................................................................................ 
https://en.wikipedia.org/wiki/Data_recovery
...............................................................................................

 

Our Man in the Tropics

Edited November 5, 2017 by Our Man in the Tropics

[OneMoreFarang]

6 minutes ago, Our Man in the Tropics said:

Just to say that immediately upon being told not to "input" any more files to the USB Flash Drive I adhered to that advice ;

However, I did copy all the Files & Folder s -- incl. Hidden Files & Hidden Folders -- to an External Hard Drive ;

And, I did notice No. of Files in External Hard Drive being less than stated No. of Files in USB Flash Drive.

And, then I decided to put that External Hard Drive away until I get proper handle on original USB Flash Drive issue ;

Indeed, I fear that the problem I have with USB Flash Drive will have replicated itself to be problem also for External Hard Drive.

I have not performed any of the pro-active advice yet ;

Because, I will have to school up on what is a very daunting journey of learning for me.

But, please do not fear that ur replies are wasted ;

I most certainly will delve as deep as I can into all of them ahead of finally, but tentatively, trying them.

Also, of course, this whole thread should serve a great many posters well ;

It may even become archived. 8-)

Meanwhile, upon searching around the topic, I found the following [ starting from the lead given by Oxx about Character OxE5 ; Somewhat ironic that reference to "Ox.." from "Oxx" 8-) ]  links : 
........................................................................................... 
https://www.google.co.th/search?client=ubuntu&channel=fs&q=character+0xE5&ie=utf-8&oe=utf-8&gws_rd=cr&dcr=0&ei=5k_9WaeGNMTYvASE4biQDQ
......................................................................................... 
https://books.google.co.th/books?id=pM0qfhtz4VgC&pg=PA59&lpg=PA59&dq=character+0xE5&source=bl&ots=lw85WTRcP2&sig=Hk3lA5CaMbVb6zZNtb5CuaHxBak&hl=en&sa=X&ved=0ahUKEwjetbzkl6TXAhWBro8KHaKECA8Q6AEIMjAC#v=onepage&q=character 0xE5&f=false 
........................................................................................ 
https://www.amazon.com/EnCase-Computer-Forensics-Official-EnCE/dp/0470901063/ref=dp_ob_title_bk
........................................................................................... 
https://www.amazon.com/Art-Memory-Forensics-Detecting-Malware/product-reviews/1118825098/ref=cm_cr_dp_d_hist_3?ie=UTF8&filterByStar=three_star&reviewerType=all_reviews#reviews-filter-bar
............................................................................................... 
https://en.wikipedia.org/wiki/Computer_forensics
................................................................................................ 
https://en.wikipedia.org/wiki/Data_recovery
...............................................................................................

 

Our Man in the Tropics

Obviously it's good if you learn how to solve this problem for now and maybe for the future. But I wonder why you don't just ask a computer expert to do this work. A professional or even an advanced user should be able to retrieve your data (or whatever is still available from that data) in an hour or two...

[Our Man in the Tropics]

10 minutes ago, OneMoreFarang said:

Obviously it's good if you learn how to solve this problem for now and maybe for the future. But I wonder why you don't just ask a computer expert to do this work. A professional or even an advanced user should be able to retrieve your data (or whatever is still available from that data) in an hour or two...

I have like most people sensitive personal information on that device ;

including Passwords.

 

I put my computer into a service centre here before but to find the whole floor gathered around to peer & jeer & giggle at photos that some women sent to me of themselves.

 

I would not trust any technician now not to routinely copy & exploit even non-photo data of innocent owners of the data.

 

Also, when I put a device in for recovery before in Bangkok ;

They quoted THB 9,000 + said that they not guarantee that they could retrieve all the info + said that the device would be destroyed in the process of attempting to recover the info.

I retrieved the device on the advice of very learned Falang who said that he believed the problem I was encountering [ crashed laptop ; Mouse-Pad not work ] could be solved by simply inserting External Mouse ;

And, yes, that was the solution.

 

Our Man in the Tropics

Edited November 5, 2017 by Our Man in the Tropics

[KittenKong]

9 hours ago, Our Man in the Tropics said:

Just to say that immediately upon being told not to "input" any more files to the USB Flash Drive I adhered to that advice ;

However, I did copy all the Files & Folder s -- incl. Hidden Files & Hidden Folders -- to an External Hard Drive ;

And, I did notice No. of Files in External Hard Drive being less than stated No. of Files in USB Flash Drive.

And, then I decided to put that External Hard Drive away until I get proper handle on original USB Flash Drive issue ;

Indeed, I fear that the problem I have with USB Flash Drive will have replicated itself to be problem also for External Hard Drive.

 

The problem with that is that your operating system apparently cannot properly see all the folders and files on your USB key. If it cant see them it cant copy them.

 

But, put very simply, TestDisk bypasses the operating system and accesses the drive in a different way which should allow it to see everything: even things that are marked as deleted or damaged or which are otherwise invisible to the operating system. It can also repair damaged indexes on the drive, which can also make files invisible to the operating system.

 

This is why it is the correct tool to use and the one most likely to help you.

[KittenKong]

11 hours ago, OneMoreFarang said:

Sorry, I didn't read you post about TestDisk. I just jumped to the end and recommended PhotoRec from the same developer. It was not my idea to just repeat your good advice. Both are good programs.

 

No problem. They are indeed both very good at what they do.

[Our Man in the Tropics]

I still reading "around" the problem.

 

Here are some interesting links thus far :

I read quickly only 1_ though.

........................................................................

1_

https://en.wikipedia.org/wiki/Data_recovery

 

I note the following excerpt ;

4 phases of data recovery

Usually, there are four phases when it comes to successful data recovery, though that can vary depending on the type of data corruption and recovery required.^[15]

 

Phase 1

Repair the hard disk drive

Repair the hard disk drive so it is running in some form, or at least in a state suitable for reading the data from it. For example, if heads are bad they need to be changed; if the PCB is faulty then it needs to be fixed or replaced; if the spindle motor is bad the platters and heads should be moved to a new drive.

Phase 2

Image the drive to a new drive or a disk image file

When a hard disk drive fails, the importance of getting the data off the drive is the top priority. The longer a faulty drive is used, the more likely further data loss is to occur. Creating an image of the drive will ensure that there is a secondary copy of the data on another device, on which it is safe to perform testing and recovery procedures without harming the source.

Phase 3

Logical recovery of files, partition, MBR and filesystem structures

After the drive has been cloned to a new drive, it is suitable to attempt the retrieval of lost data. If the drive has failed logically, there are a number of reasons for that. Using the clone it may be possible to repair the partition table or master boot record (MBR) in order to read the file system's data structure and retrieve stored data.

Phase 4

Repair damaged files that were retrieved

Data damage can be caused when, for example, a file is written to a sector on the drive that has been damaged. This is the most common cause in a failing drive, meaning that data needs to be reconstructed to become readable. Corrupted documents can be recovered by several software methods or by manually reconstructing the document using a hex editor.

................................................................................

2_

https://en.wikipedia.org/wiki/Master_boot_record

.............................................................................

3_

https://en.wikipedia.org/wiki/Hex_editor

.................................................................................

4.

https://en.wikipedia.org/wiki/Comparison_of_hex_editors

..............................................................................

5_

https://en.wikipedia.org/wiki/SystemRescueCD

 

I note ;

 

SystemRescue CD includes ;

 

TestDisk

............................................................................

6_

http://www.system-rescue-cd.org/

...........................................................................

7_

https://sourceforge.net/projects/systemrescuecd/

..........................................................................

 

Regards,

 

Our Man in the Tropics

Edited November 8, 2017 by Our Man in the Tropics