Corrupt Thumb Drive Data

[DaveLembke]

Was wondering if anyone had any suggestions of how to recover data from a partially corrupted thumb drive. The user claims that one day files were missing. I ran ATTRIB -H -R -S /S /D H:*.* on this drive to see if I could recover data and found a bunch of it, but it doesnt know the correct file extension for the data. I knew the documents were word documents and so I renamed all files using RENAME *.* *.doc and was able to open it in MS Word but its all scrambled. I then renamed them as *.txt and was able to see more information about the files, but its as if maybe they weren't exactly .DOC files or something because its just as scrambled looking in text form as in word form. Looking at them as text files shows they claim to be Word Documents as in screenshot snippet that I attached. Not sure why all the Chinese characters when it should all be in english.

Wondering if anyone know of any free tools to help get their data back from the scramble that they have. Its unfortunate that the user only saved their data to this 1GB thumb drive that was heavily used. I was surprised that they didnt save it locally and then save to USB stick as a backup and that the USB stick was the single work location for their data going back of 11 years of use.

[BC_Programmer]

First thing I'd suggest is creating an image of the drive as it currently stands. Ought to have done that before making any changes.

Then run a disk check (chkdsk).

I would guess that it suffered a similar fate to a 256MB flash drive I used years ago. Basically the clusters managed to get cross-linked as well as lost, and files were sharing clusters so say in the middle of a program source code file there would be 4KB of some random executable, or vice versa. using chkdsk basically made every file only it's first 4KB cluster, and the rest of the data was all converted to the "lost chains" CHK file, with no indication of what file they belong to, what order, etc.  Even being able to read the text, rebuilding any particular file was difficult to the point where I didn't bother. Dealing with Docx files (which are zip archives) and trying to piece the files back together would be even more difficult.

[Lisa_maree]

As BC_Programmerhas said first make an image of what you can read. A program I sometimes use is HDD rawcopy from here https://hddguru.com/software/HDD-Raw-Copy-Tool/
This will copy the pen drive to another drive or to a file on your computer. The file on the computer isn't in a format which  recovery software can use  just so you can make other copies to try things with.
Have you asked the customer what word processor or version like are they docx files. I suspect they are not not doc files but word perfect or works files. The header part of the document looks like WP or Works.
There are free file viewers and programs like Reclaim me  will sort the files into there types like DOC DOCX even if the extension is changed pretty cool ah.
You can download a trial copy from here  https://www.reclaime.com/
Free file viewers https://windowsfileviewer.com/file_types

Please don't continue doing the recovery on the original drive only on raw copies.

[DaveLembke]

Thank You both for help with this. I will try this at work tomorrow to see if any of it can be saved. I told the user that if they have any other computers they plugged this into that maybe there is an archive local copy somewhere as Office sometimes does that.

[patio]

And / or if it has been used on multiple PC's have them try it on each one...i've had stiks like that showed corrupt on 1 PC and normal on another...no idea why.