Anatomy of a Hard Drive
Why did my Hard Drive Fail?
A-Z of Data Recovery
Send Us a Drive
Data Recovery Guides
USB Memory Stick Data Recovery
We perform data recovery for almost all brands of USB memory stick. This includes:
-
- San Disk
- Transcend
- Verbatim
- Intenso
- Lexar
- Corsair
- Duracell
- Integral
- Generic
- Adata
- HP
- Trekstor
- TDK
- Sony
- and Promotional USB drives
We perform data recovery in the following cases:
- Your USB memory stick is not being recognised by your computer.
- Your computer is requesting if you would like to format your USB drive.
- Accidental Formatting or Deletion.
- Physical Damage.
- Suspected Power Surge.
Common Causes of USB Memory Stick Failure
- Failure of ECC Controller
- Physical Damage
- Power Surge / EOS damage
- Electro Static Discharge damage
- Accidental Deletion
A Quick Overview of how USB Memory Sticks Work and Data Recovery Techniques Used to Retrieve Data
Figure 1 - A typical USB memory stick
The standard USB stick is usually composed of a PCB, a NAND Flash memory chip and a controller chip used for processing data.
The type of memory used in USB memory sticks is called NAND flash memory. It was invented by Toshiba and has been around since the early 1980s. It is a convenient way to store data, but like most storage technologies, it is still liable to data loss. In lower capacity USB memory sticks, SLC NAND (single level cell NAND) is used. This is where each cell contains only one bit of data. In high capacity USB memory devices, MLC NAND is used (multi-level cell). This is where each cell can store two bits of data per cell (sometimes more).
Why do USB Memory Sticks Stop Working?
Reason # 1 Failure of ECC Controller
Figure 2 - A NAND memory cell
There are several reasons why the NAND memory in USB memory sticks fails. One common cause is ECC controller failure. To understand why this fails, it is first important to understand how NAND memory works. The illustration above depicts a NAND cell. Read and write operations are performed by electrons travelling through a tunnel oxide and eventually reach the "floating gate" where a write operation is performed. When a block is deleted, these electrons are removed. Each round trip constitutes a read / write cycle. Overtime, reading and writing to a USB memory stick decreases the endurance of the tunnel oxide, leading to bad blocks. The number of bad blocks in relation to the number of writes is called the Bit Error Rate.
In order to prevent the development of bad blocks, most NAND memory uses an ECC (Error Code Correction) controller. This uses an algorithm (or formula) to detect small bit errors on your USB drive and correct them on them on-the-fly. Most flash drive manufacturers use the Bose-Chaudhuri-Hocquenghem or Hamming algorithm in their devices for error correction.
Every time you write or delete something from your USB memory drive, the ECC algorithm is deployed and checks for errors and automatically fixes them, (if it finds any). In fact, for most USB flash memory, this process is so important additional storage space on the drive is reserved to store ECC data.
How does ECC deal with Memory Errors?
ECC will deal with bit errors in two ways. Using the skip block method, the algorithm creates a bad block table (similar to a G-List on a mechanical hard drive) and when a write attempt is made on the bad block, the data is written to the next good block, skipping the bad one. The second technique in which ECC controller deals with bad blocks is, not by skipping bad blocks, but by remapping them to the Reserved Block Area. This is a separate area on your memory stick, that is distinct from the User Addressable Block Area, that holds "spare" blocks.
Controller Failure of USB Memory Sticks
However, sometimes the ECC algorithm and bad block management software fails and bad blocks remain permanent. Failure of the ECC controller can mean your USB memory stick is no longer recognised or appears to be unformatted. For example, the user might get the "USB Device Not Recognized" error message when the device is connected to their computer.
Alternatively, the user might get an error message like this displayed. (This error can sometimes be indicative of a degraded file-system also)
With the flash drive market demanding smaller NAND architectures and higher drive capacities, tunnel oxides have become smaller and weaker. In the coming years, USB memory stick and SSD manufacturers will be forced to devise smarter error correction algorithms and bad block management software as the limits of physics are pushed even further.
Our Data Recovery Process for ECC controller usually involves the following process:
1) Diagnosis - It is imperative that accurate diagnosis is performed on your faulty USB memory drive. If the diagnosis is wrong, whatever data recovery strategy is employed will most likely be wrong also. Drive Rescue technicians have years of experience in recovering data from faulty USB drives and use specialised equipment to aid diagnosis and recovery.
2) If our diagnosis has confirmed controller failure, the next step is the removal of the NAND memory chip from the PCB. The two main variants of USB memory chip architecture are the TSOP and BGA interface. Memory chips which contain your data must be carefully micro de-soldered to ensure safe removal from the PCB board. The memory chip may be damaged if the temperature is too high during the de-soldering process or proper anti-ESD precautions are not observed. Drive Rescue employs experienced technicians and uses best-in-class de-soldering equipment to safely remove memory chips from their PCB. Failure to take proper precautions during this intricate process can mean irreversible damage to the chip.
Figure 3 - A NAND flash chip connection architecture
3) Once the memory chip has been removed from the PCB, it is connected to our chip programming device designed specially for advanced data recovery. This device must have the exact controller data, as used on the original (faulty) USB drive, uploaded to it. We have an extensive database of original USB data controllers, as used by major brand USB memory sticks. This saves you (and us) time.
4) Reconstruction of the File System - Once the raw data on the memory chip becomes accessible again. It is often necessary to rebuild some or all of the file system. This is especially true if the MFT records have been damaged or corrupted.
5) Extraction of Data - The final stage in USB memory stick recovery is the extraction of data from the rebuilt volume followed by the verification of the recovered data and delivery to the customer.
Figure 4 - A standard
Figure 5 - A
Figure 6 - PCB with controller chip
Reason # 2 Physical Damage
Figure 7 - A broken USB connector on a memory stick
Physical damage usually occurs when the USB connector of the memory stick gets broken off from the body of the PCB. This can be due to an accident. Or, it can be the result of wear-and-tear, where the solder joints between the USB connector and PCB have become brittle and eventually snap. In other instances of physical damage, the USB connector will appear to be slightly flexed but still not be recognised by the host computer. Drive Rescue offers a full USB repair service and data retrieval service for this kind of damage.
Reason # 3 File System Corruption
Figure 8 - Bad Block Detection Software
Like in a traditional hard drive, the file system of a USB memory stick can go corrupt. This can be due to many factors including virus damage or removing the device from your computer while a read/write process is in operation. Once diagnosis of a corrupt file system has been made, Drive Rescue follows a tried and tested procedure for complete recovery. For most USB memory sticks the default formatting is FAT32. The USB data recovery process normally follows a number of steps including:
i) Rebuilding of the FAT32 driver. This contains the MFT records. In the same way that a book has a table of contents, a storage device has a Master File Table record which stores all the metadata and acts as a recovery roadmap.
ii) The recovery of any lost clusters and associated files. When the file system goes corrupt. It is normal that some files get "scattered". These file structures often have to be rebuilt.
iii) Once the file system has been rebuilt, our recovery technicians can start the extraction process of your data. After the data has been extracted, its integrity is verified. Finally, the data is delivered to the client.
Reason # 4 - Electro Static Discharge (ESD)
Figure 9 - USB connectors - the left one as seen on USB memory devices
Each USB connector consists of 4 lines. Two lines, D+ and D-, are used for Bi-Directional Data Transfer. Two lines are reserved for bus voltage and ground. Both of these lines are vulnerable to Electro Static Discharge strikes. These surges of higher-than-normal voltage can cause thermal overstress which, in turn, can lead to junction spiking failure (the melting of electronic connections on a circuit). While the TVS diode will protect your drive in a lot of cases, sometimes the surge will be so strong it will reach other components of the USB drive such as the controller or memory chip itself. For USB 3.0 memory devices, the risk of ESD is even higher than USB 2.0 devices. This is because of a combination of faster bandwidth speed and smaller I/O NAND cell sizes.
Reason # 5 - Electrical Overstress (EOS)
Each USB memory drive has manufacturer specifications for voltage, current and power limits. When a device operates beyond these SOA (safe operating area) parameters, electrical overstress can cause internal damage to your USB memory device. Chip designers incorporate protective devices on their devices like transient voltage suppressors, but these are just a preventative. Prolonged exposure to EOS from, lets say, a malfunctioning USB port on a computer can cause your USB memory device to fail.
Reason # 6 - Removing a USB from your Computer during Data Transfer
If your USB memory drive is removed from your computer during a read/write operation, you risk damaging the file system of your drive.
In the same way that a book has a table of contents, a storage device will have a directory of all file locations called the MFT. If the MFT write process is interrupted by removing a memory device too early from its host system, corruption can occur. A corrupt MFT usually results in the drive not being recognised or appearing to be not formatted.
Reason # 7 - Letting your USB Memory reach near Full Capacity
When you USB drive is nearing full capacity i.e. when over 90 per cent of the addressable area is used, the probability of data loss increases substantially. This is because, when nearing full capacity, the file footers and headers are more easily overwritten by other files. Moreover, all USB memory drives use a process known as wear-levelling. This is a process that evenly distributes your data throughout a NAND storage device so that the same memory cells are not continually used. When there is limited space left on your drive, the wear-levelling process cannot work properly anymore increasing the risk failure.
Reason # 8 - Manufacturing and Design Faults
Some USB memory sticks will have already failed before they have even reached the distribution channel. In these DOA (dead-on-arrival) failure cases, there is no data loss as the user will be unable to input data onto them. In other instances, a manufacturer defect might be latent i.e. it will only manifest itself after a period of time. Typical manufacturing defects include impurities in the chemicals used in the metal-oxide within a NAND chip and faulty bad block management software included on the drive's controller.
Reason # 9 - Counterfeit USB Memory Sticks
Counterfeit USB memory sticks are a perennial problem we come across. These are memory sticks which bear the same style packaging, product design and logos as genuine USB memory products but are manufactured in a totally different factory. In general, counterfeit USB memory drives use inferior materials, internally are constructed poorly and are inherently more likely to fail. Avoid buying USB memory drives from online auction sites and from street markets. If you suspect you might be using a fake USB drive, you can run the H2 burn-in test written by Harald Bogenholz for Computertechnik magazine.
You can download the H2 utility from: http://www.chinaelectronicsinsider.com/technical/how-test-fake-flash-memory
You can find out more about counterfeit USB memory sticks here:
http://fakememorysentinel.wordpress.com/
Frequently Asked Questions about USB stick Data Recovery
I have a USB pen drive has become unreadable. The device is also fully encrypted. Can you help?
There are many reasons why your USB drive might have stopped working. Your USB memory drive might have a corrupt file system, a failed controller or have incurred ESD or EOS damage unbeknownst to you. These issues can be resolved by our experienced data recovery technicians. As far as your encryption is concerned, we are able to decrypt most USB drives encrypted with applications such as TrueCrypt, SafeGuard, Endpoint, Bitlocker, Iron Key and USB Phantom.
Is there any software that I can use to prevent myself or other users accidentally writing to my USB drive?
You can download a free piece of software called USB Write Protect written by Naresh Manandhar from: http://www.softpedia.com/get/Security/Security-Related/USB-Write-Protect.shtml . This puts a "lock" on your drive to prevent it being accidentally overwritten.
Every time I connect my USB drive to my computer, I get the message that "The Disk is Write Protected. Remove the write-protection or use another disk". I never remember applying write-protection to my USB drive. What could have happened?
First of all, check your USB drive to see if there is any switch that might have activated write-protection. If you cannot find a switch, your best option is probably to use a neat disk utility built into Windows called Diskpart. Open the Command Prompt utility on your Windows computer. Type in "Diskpart", followed by "list disk", then "select disk". This should bring up a small menu displaying each disk connected to your computer with a number beside it. Select the number corresponding to your USB drive. Once confirmation of your selection has been made, type "attributes disk clear readonly". Your USB should now become accessible.
I am using my Mac to delete files off my Sandisk USB drive but no matter how many files I delete, the amount of free space does not seem to increase?
With some USB drives, you must make sure that you empty the Trash folder on your Mac whilst your USB drive is still connected. Otherwise you're files might not be deleted.
Using a Windows 7 PC, my USB drive will intermittently disconnect for no apparent reason. On my Macbook, it works fine?
Go to the Control Panel on your PC, then go to Power Options. Then select "Change Plan Settings" followed by Change Advanced Power Settings. Under USB settings, disable "USB selective suspend mode". This mode prevents your PC intermittently cutting power to the USB ports on your computer.
When I connect my
This problem is usually not related to a faulty USB memory stick but is likely to be an operating system problem. It usually occurs when the usbstor.inf file, which is a native Windows USB driver, goes corrupt. To resolve this issue, go to C:\Windows\inf and select usbstor.inf file. Use the Cut command and paste it to your desktop. Retry plugging in your USB drive. It should now be accessible. Finally, select the usbstor.inf file and using the Paste command again, place it back into the C:\windows\inf folder. If this does not resolve the issue, try connecting your USB drive to another computer system.
