Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
Modules
· Home
· Content
· FAQ
· Forensic Downloads
· Forensics Feedback
· Forums
· Members List
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: JEJ
New Today: 0
New Yesterday: 0
Overall: 29358

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 Senior Cyber Forensic Incident Response Consultant -Cambs UK
 A question for students and newbies
 E-DISCOVERY & DATA RECOVERY? WHICH ONE IS BETTER?
 Computer Forensic in e-commerce
 Computer Forensic as component in Information Security

Computer Forensics World Forums


Pages Served
We received
51260040
page views since August 2004

Security Sources

FTC
OnGuard Online
ISO 17799 ISO 27001
ISO 27000 Toolkit
ISO 27001 & 27000
Cryptography
Security Policies

Computer Forensics World: Forums

Computer Forensics World :: View topic - How to access files a USB stick that is playing up
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

How to access files a USB stick that is playing up

 
Post new topic   Reply to topic    Computer Forensics World Forum Index -> General Computer Forensic Issues
View previous topic :: View next topic  
Author Message
cyber101
Newbie
Newbie


Joined: Sep 22, 2016
Posts: 28
Location: cyberspace

PostPosted: Thu Oct 20, 2016 6:13 pm    Post subject: How to access files a USB stick that is playing up Reply with quote

Could someone please assist with this?

I need to gain access to my files on a USB stick that wont let me.
Here is the error message:
" The volume does not contain recognized file system.
Please make sure that all required file system drivers are loaded
and that the volume is not corrupted"
also asking me to reformat (which I wont do for obvious reasons).

I have important files on the USB stick. Any idea what I should do to gain access on Windows 8.1 machine?

History:
USB stick has been playing up for past 3-4 months disappearing from desktop and reappearing; other times I would need to click Windows 8.1 Repair usb function to access it. However this last occasion I was distracted and may have clicked something else during Windows 8.1 Repair USB process?

Machine:
Windows 8.1
Back to top
View user's profile
athulin
Newbie
Newbie


Joined: Oct 19, 2007
Posts: 238

PostPosted: Fri Oct 21, 2016 1:12 am    Post subject: Re: How to access files a USB stick that is playing up Reply with quote

cyber101 wrote:

Here is the error message:
" The volume does not contain recognized file system.
Please make sure that all required file system drivers are loaded
and that the volume is not corrupted"
also asking me to reformat (which I wont do for obvious reasons).


That means that the contents of that USB stick has become damaged, and is so damaged that Windows doesn't recognize it as legitimate volume.

If the files are very important, get in touch with a reputable data recovery company to help you.

If you can live without them, you may experiment on your own (after getting a full sector copy of the current contents). In this case, resign yourself to losing the files, due to mistakes you make.
Back to top
View user's profile
cyber101
Newbie
Newbie


Joined: Sep 22, 2016
Posts: 28
Location: cyberspace

PostPosted: Sun Oct 23, 2016 12:47 pm    Post subject: Re: How to access files a USB stick that is playing up Reply with quote

athulin wrote:

If you can live without them, you may experiment on your own (after getting a full sector copy of the current contents). In this case, resign yourself to losing the files, due to mistakes you make.

I will take the risk. Which program, preferably free open source, do
you recommend to make a full sector copy of current contents?

Where in this forum can I source info on how to learn how to access the
files on this USB stick? What skills should I acquire to access my files in the USB stick? Any websites sources to garner those skills?

Thank you.
Back to top
View user's profile
athulin
Newbie
Newbie


Joined: Oct 19, 2007
Posts: 238

PostPosted: Sun Oct 23, 2016 5:03 pm    Post subject: Re: How to access files a USB stick that is playing up Reply with quote

cyber101 wrote:
I will take the risk. Which program, preferably free open source, do you recommend to make a full sector copy of current contents?


That depends on your platform.

On Windows, I'm not sure the tools I would recommend are open source. I would suggest FTK Imager Light from AccessData (you can download and use it for free, but you may be asked for your mail address).

If you insist on open source, try Autopsy. I don't think I've ever used it for sector-copying a disk except experimentally, so for that reason I can't recommend it, though I have no reason to suspect that it would misbehave.

On any Unix-based platform (I include BSD and Linux in those), the standard 'dd' command is already available. If there are sector read errors, forensic versions may be preferrable: ddrescue, dc3dd, dcfldd, etc. (you'll find these mentioned on Forensics Wiki -- see the category Disk Imaging.) For these, you need Unix as well as dd competence. If you don't have that, you may overwrite the source drive instead of copying it. For these situations an USB write blocker is recommended, but typically only IT and computer forensic professionals have one easily available.

In general, you can also use a free bootable CD (such as Kali Linux or DEFT or many others -- see Forenics Wiki, category Live CD) for the job, but I won't make any claims about open source-ness for them. (I've never investigated that question in depth -- that's why. Their home pages may have information.)

Quote:
Where in this forum can I source info on how to learn how to access the files on this USB stick? What skills should I acquire to access my files in the USB stick? Any websites sources to garner those skills?


That's more difficult to answer, as you are more or less asking for a royal road to computer forensics, and there isn't really one.

It depends on what has happened to the USB. If sector 0 has been overwritten by garbage, you may still be able to locate and recover the file system, only you have to know and use the appropriate tool correctly. Or if the files simply have been deleted, they may still be possible to recover. Sleuthkit might work, FTK Imager might work. IsoBuster (which can handle other file systems than ISO9660) may work. If they have been totally overwritten, you may need to be able to diagnose the fact, and not spend time trying to find files on an empty USB drive.

For other situations, look at something like Forensics Wiki, particular the section on data recovery or file carving or file carving tools. I would not expect one single tool to do the entire job, but would make several tests (not on the original sector copy, but copies of that copy, of course). It also depends on what the files are -- if they have a particular format, I would use programs designed for that particular file type.

I would try PhotoRec, because it has worked pretty well for me in the past, but I would not get stuck on it.

But it's a question of looking at the image, diagnosing what has actually happened to it, and from there decide what tools may be the best to use. That's largely a question of experience.

Skills ... well, you need knowledge about file systems, and experience in dealing with file systems on a low level. (Don't know any web sites -- Brian Carrier's book Forensic File System Analysis is likely to be helpful). You need experience with the tools you use -- and many of them do require user competence -- so expect to have to read any user manual or similar kind of document very closey, with attention to details, and possibly experiment.

To lessen the chance of destroying the original USB, do trial runs of some other USB with test contents just to ensure you get everything right, before you copy the original.

You may also find books such as 'Digital Forensics with Open Source Tools' by Altheide and Carvey useful -- I don't really think you find all information you need on the web. (The main body of your question are likely to be answered in Chapter 3 of that book: Disk and File System Analysis.)
Back to top
View user's profile
cyber101
Newbie
Newbie


Joined: Sep 22, 2016
Posts: 28
Location: cyberspace

PostPosted: Mon Oct 24, 2016 7:46 pm    Post subject: Re: How to access files a USB stick that is playing up Reply with quote

athulin wrote:
cyber101 wrote:

Here is the error message:
" The volume does not contain recognized file system.
Please make sure that all required file system drivers are loaded
and that the volume is not corrupted"
also asking me to reformat (which I wont do for obvious reasons).


That means that the contents of that USB stick has become damaged, and is so damaged that Windows doesn't recognize it as legitimate volume.

If the files are very important, get in touch with a reputable data recovery company to help you.

If you can live without them, you may experiment on your own (after getting a full sector copy of the current contents). In this case, resign yourself to losing the files, due to mistakes you make.


I used Find and Mount to scan it, do you think I have added further fuel to the fire by using Find and Mount? Zero results though.
Back to top
View user's profile
cyber101
Newbie
Newbie


Joined: Sep 22, 2016
Posts: 28
Location: cyberspace

PostPosted: Mon Oct 24, 2016 7:56 pm    Post subject: Re: How to access files a USB stick that is playing up Reply with quote

athulin wrote:
cyber101 wrote:
I will take the risk. Which program, preferably free open source, do you recommend to make a full sector copy of current contents?

I would suggest FTK Imager Light from AccessData (you can download and use it for free, but you may be asked for your mail address).

Should I get the FTK Imager Light from AccessData International version if I'm outside North America? What's the difference? Do they have a forum for support?

I've noticed the download for it is supplied by Source Forge, I've read Source Forge is dodgy, and the mirror is supplied by Chinese firm; not reassuring. Should I go ahead? Thanks in advance.
Back to top
View user's profile
athulin
Newbie
Newbie


Joined: Oct 19, 2007
Posts: 238

PostPosted: Sat Oct 29, 2016 6:37 pm    Post subject: Re: How to access files a USB stick that is playing up Reply with quote

cyber101 wrote:
Should I get the FTK Imager Light from AccessData International version if I'm outside North America? What's the difference? Do they have a forum for support?


Which version: I have no idea. Forum: ... try their web site?

Quote:
I've noticed the download for it is supplied by Source Forge, I've read Source Forge is dodgy, and the mirror is supplied by Chinese firm; not reassuring. Should I go ahead? Thanks in advance.


Sourceforge provides multiple mirrors -- choose one you feel more comfortable with. As to dodginess of SF in general, that's something you decide yourself.
Back to top
View user's profile
cyber101
Newbie
Newbie


Joined: Sep 22, 2016
Posts: 28
Location: cyberspace

PostPosted: Sun Oct 30, 2016 10:21 am    Post subject: Re: How to access files a USB stick that is playing up Reply with quote

athulin wrote:
Which version: I have no idea. Forum: ... try their web site?

What do you use?

athulin wrote:
Sourceforge provides multiple mirrors -- choose one you feel more comfortable with. As to dodginess of SF in general, that's something you decide yourself.
You trust it?
Back to top
View user's profile
cyber101
Newbie
Newbie


Joined: Sep 22, 2016
Posts: 28
Location: cyberspace

PostPosted: Sun Oct 30, 2016 10:54 am    Post subject: Re: How to access files a USB stick that is playing up Reply with quote

athulin wrote:
cyber101 wrote:
Should I get the FTK Imager Light from AccessData International version if I'm outside North America? What's the difference? Do they have a forum for support?


Which version: I have no idea. Forum: ... try their web site?

Quote:
I've noticed the download for it is supplied by Source Forge, I've read Source Forge is dodgy, and the mirror is supplied by Chinese firm; not reassuring. Should I go ahead? Thanks in advance.


Sourceforge provides multiple mirrors -- choose one you feel more comfortable with. As to dodginess of SF in general, that's something you decide yourself.


In my case should I clone or image the usb stick that I'm trying to gain access to due to it reverting to RAW format before using recovery software? (I have a vague idea of the difference between clone)

Thanks in advance
Back to top
View user's profile
PreferredUser
Newbie
Newbie


Joined: Jan 01, 2007
Posts: 1130
Location: USA

PostPosted: Sun Oct 30, 2016 1:39 pm    Post subject: Re: How to access files a USB stick that is playing up Reply with quote

cyber101 wrote:
In my case should I clone or image the usb stick that I'm trying to gain access to due to it reverting to RAW format before using recovery software?
You should stick to one thread and follow the suggestions to recover your data.
Back to top
View user's profile
SgtJackie
Newbie
Newbie


Joined: Dec 01, 2015
Posts: 19
Location: Aberdeen, Scotland

PostPosted: Wed Nov 16, 2016 10:13 pm    Post subject: Reply with quote

OS Forensics has a free version and is very good.
Back to top
View user's profile
Display posts from previous:   
Post new topic   Reply to topic    Computer Forensics World Forum Index -> General Computer Forensic Issues All times are GMT + 10 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB 2.0.10 © 2001 phpBB Group
phpBB port v2.1 based on Tom Nitzschner's phpbb2.0.6 upgraded to phpBB 2.0.4 standalone was developed and tested by:
ArtificialIntel, ChatServ, mikem,
sixonetonoffun and Paul Laudanski (aka Zhen-Xjell).

Version 2.1 by Nuke Cops 2003 http://www.nukecops.com

Forums ©

 

TMs property of their respective owner. Comments property of posters. 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted phpnuke.org (c)2003, and is free under licence agreement. All Rights Are Reserved.