Need to recover data from flash drive, seen as "sdb", testdisk doesn't see it. Help?
 

Device is 16GB PNY Flash Drive.

udev info can be seen here. dmesg shows the following when the drive is plugged in:
I've tried using testdisk to scan the drive but the program doesn't see the device. It sees the other devices I have connected, /dev/sda*, /dev/sr0, and /dev/sr1, but no /dev/sdb.

I'm at a loss. Can any one help me here? I'd appreciate it greatly.

What do you mean with "Testdisk doesn't see the device"? Whch error messages do you get?

I don't get an error message. I run testdisk (as root), in the list of devices there is /dev/sda, /dev/sr0/, and /dev/sr1 in the "Select a media" menu. The device is seen as sdb by my system (see last line of dmesg).

What do you get when you run it this way? If it still can't see the device I would recommend to make an image from the USB device using dd and using Testdisk on that image.

+1 for image the device and testdisk the image.

If the device still has partitions you might image it by partition. Testdisk should cope better with partitions since it wont have to filter MBR plus partition data to get to what you're trying to recover. Plus you don't have to be root to scan the image of the device.

The device should show up in /proc/partitions. If it doesn't you have other things in play. I've had trouble with using multiple usb storage devices on the same usb bus, so you might have to fiddle a bit if it's not the only device of it's type in use.

$ cat /proc/partitions

Running "testdisk /dev/sdb" returned "Unable to open file or device /dev/sdb"

Imaging a drive is usually my first step in recovering drives: work from the image so you don't fuck up the original. But unfortunately that wasn't possible this time. I've tried taking an image with dd, but it kicked back "dd: opening '/dev/sdb': No medium found".

The device doesn't show in /proc/partitions. All that comes up is:

Now what's the next step if all these things fail?

Professional data recovery companies. Or just throw it into the trashcan and let it be. If not even dd can read it you will have to find a hardware solution, which is usually out of range for anyone but the professionals.

This is a typical flash drive failure, it fails instantly without possibility of recovery ... except of course for professional services who will have to disassemble it and try to get the data back.

Now the question is how important was this data, or how much are you willing to pay to get it back.

For sure don't throw it away just yet. Before throwing it away, there is one more possibility that would be interesting to try, but only right before throwing it away as it is experimental.

Well I'm a standard IT contractor, and have been wanting to go into professional level data recovery, but this is kinda my first exposure to what would be considered professional level data recovery.

So what is the next step a professional service would take? Or, what would be the next experimental step?

A professional would now check the controller on the Flash device and its firmware (if such exists) for errors and possibly replace it. If the controller is OK it is very likely that the Flash memory itself is defective, in which case a recovery would not be possible.

There are a few possibilities.

The best choice is to get a professional service to do it. To see what is done during this procedure see:
http://card-recovery.biz/us/service.php
(Take note of the infrared heating in one of the videos)

The other choices are experimental and up to you. You could use an Arduino to do it yourself, assuming you know how and write the software.
http://forum.arduino.cc/index.php/topic,22428.0.html
Note that they recommend a professional service as well.

-------
The last, and I mean LAST option is the experimental one and may destroy the data if not done properly. It does involve heating the flash chip in order to try and repair it, assuming it is what is faulty. Also see:
http://www.bbc.co.uk/news/technology-20579077
WARNING: Do NOT try this unless you have no other options, as it may not work and may destroy the data if the heat is high. Note that the infrared heater that professionals use is specifically calibrated for the task, and other devices are not. For sure don't leave any plastic or meltable materials on the chip.

I have used this last option, but only to refurbish a broken flash drive, NOT to recover data, so there are no guarantees.

Ok, and the method for checking the controller I'm assuming varies between devices?


After reading through the arduino forum post you linked to, it seems I may be able to attempt swapping the controller or the memory chip. If they are from the same series of drives, but many years apart in manufacture date, would I still be able to swap the parts?

You could probably swap the controller for the exact same size and brand of device. If they updated versions over the years then there might be incompatibility. It's worth a shot if the data is important and if the controller is what is bad, and if you're good at soldering.

I say check the prices for professional recovery first.

Depending on the distro, it's possible that the usb-storage module didn't load and doesn't auto load. Ubuntu was like that in the 10. and 11. days if you didn't run the default wm and didn't fork to a wm specific flavour of ubuntu. But if you have other usb sticks that work perfectly fine, then that's probably not the case. If it's working you should see at least the /dev/sd? entry for it in /proc/partitions. Along with dmesg entries about the usb change upon insertion.

The prices of pro services are a bit out of budget for the person I'm doing this for. I can run the risk by them regarding me opening this up, get them to sign a "if your data gets lost it's not my fault" form, and see if they want me to go ahead with it.

Definitely isn't the problem, I've had several usb storage devices used during the time I've been troubleshooting this.