Recovering a Partialy Damaged Flash Drive

As one of the leading NAND data recovery shops in the USA we see many different types of drive failure. In most cases the drive is completely inaccessible however occasionally we’ll run into a drives that are still partially functional. Recently we received an 8GB Transcend flash drive that would still mount in windows however most of the directories and files were corrupt and contained “USBC” followed by gibberish.

After looking at the drive in a Hex Editor we noticed that the first half of the drive was still accessible while the second half was filled with erroneous data. This typically indicates a failing NAND memory chip. Sectors in high capacity NAND chips (8GB+) are only good for a few hundred writes before they develop bit errors (ex: the number 1 randomly becomes 0). Flash drives use Error Correcting Code (ECC) to locate and correct a limited number of bit errors. Once this threshold is exceeded the drive typically fails itself to prevent further access.

Flash drives typically segment data into smaller blocks, for example internally the drive was split into four different blocks each 2GB in size. In this case the controller couldn’t reliably read the last two blocks so it prevented access to them. In cases like this the data is still present in the NAND memory chip however there may be some corruption in the files. We disassembled the drive and looked at the raw contents of the NAND memory chip.

After inspecting the raw data we noticed numerous ECC errors which confirm the NAND memory chip was failing. We then reverse engineered the controller and ECC code to reconstruct the raw data into a usable image which allowed us to recover the bulk of the inaccessible data.

If your drive starts to fail DO NOT format or run chkdsk to repair the drive, it will corrupt the data in the good area of the drive making recovery very difficult. If your data is important and you need it recovered call (855) 374-6263, email, or visit our USB Flash Drive Recovery page.