USB File Corruption?

James_wright · May 17, 2010

Hi,

My ibook crashed and when i restarted it my USB contents had been replaced by one file that read USBC␀␀O.␀␀␀

Firstly, for future reference what is the above file?

Secondly, the information on the USB was incredibly valuable, so are there any programs i can use to try and recover the data, even just a slice of the data?

Best,

James

MacKeeper · May 17, 2010

This is basically a dump file and you will not be able to read the data from it.
However the lost files and data should still be present on the drive, and they can be restored using proper software. One pointer: DO NOT write any data whatsoever onto the drive you want to recover files from until the recovery process is done.

Our app MacKeeper actually has a tool just for that, you can get the fully functional trial version and run the Undelete tool in the app to scan your USB drive and recover lost files.
MacKeeper Official Website

One note though. Most recovery sofware, including MacKeeper's Undelete, scan only the free space for lost files. So before running a scan you will have to delete the USBC␀␀O.␀␀␀ you currently have on there. Then run the recovery process ith whichever app you prefer.

James_wright · May 17, 2010

your positive i can delete the funny file?

I have tried running stella phoenix and it found all the files but obviously comes with a gigantic price to download of $99.

Basically what i'm getting at is, are you sure that the file has nothing to do with the data present on the usb?

If i delete it i'm not deleteing something that is containing all these lost files?

I don't want to try and use mackeeper, have it not work, resort to phoenix and find that i needed that file in the first place.

James

James_wright · May 17, 2010

ok so i can't delete the file. it won't move to trash and the scan doesn't do anything.

suggestions?

Lifeisabeach · May 17, 2010

James_wright said:
Hi,

My ibook crashed and when i restarted it my USB contents had been replaced by one file that read USBC␀␀O.␀␀␀

Firstly, for future reference what is the above file?

Secondly, the information on the USB was incredibly valuable, so are there any programs i can use to try and recover the data, even just a slice of the data?

Was your external drive formatted in FAT32 by chance? If so, you may have experienced some corruption due to that drive not being "ejected" properly. Read this thread for more discussion on that:
http://www.mac-forums.com/forums/ot...96232-my-ext-hhd-problem-need-help-badly.html

James_wright · May 17, 2010

yea i think it was, i know FAT32 is a git, but unfortunately my uni computors are all pc and therefore it's easier for printing work (as i intended to do today)

Erm and if it makes any difference it wasn't so much ejected incorrectly more that the whole ibook crashed opening a folder and on reboot it showed the silly file and nothing else.

This will sound super cheap but, out of all the file saving programs out there like disc warrior etc what is the cheapest?

Only i have very little money right now, but need the work fairly soon.

Best,

James

Lifeisabeach · May 17, 2010

James_wright said:
yea i think it was, i know FAT32 is a git, but unfortunately my uni computors are all pc and therefore it's easier for printing work (as i intended to do today)

In the future, install a driver for OS X to allow writing to NTFS volumes, and format the drive that way. NTFS-3G is free, but access is slower than under Paragon NTFS, which is not free.

And keep backups!!!!!!

Erm and if it makes any difference it wasn't so much ejected incorrectly more that the whole ibook crashed opening a folder and on reboot it showed the silly file and nothing else.

It makes no difference. With the OS crashing, the drive was effectively not dismounted (ejected) properly.

This will sound super cheap but, out of all the file saving programs out there like disc warrior etc what is the cheapest?

Only i have very little money right now, but need the work fairly soon.

I had a similar problem once (as mentioned in the thread I linked to), and the problem eventually resolved itself after a mounting/dismounting the drive a few times. I honestly have no idea why this worked out for me. Hopefully you will be as lucky. Barring that, you will need a file recovery program. I don't know of any cheap ones.

DaFlake · May 17, 2010

Wait, I am confused....

The drive was formatted in FAT32 (a perfectly fine FS with little overhead) and the computer crashed which caused the drive to not be unmounted correctly thus causing the corruption right? Well, I hate to say this but if it was NTFS it would still be corrupt and the overhead in NTFS will eat more space on an external drive than necessary so changing the FS format is pointless. Even if it was HFS it would still be corrupt in that situation.

There is nothing wrong with FAT32 for external thumb and disk drives.

For recovery you will need to see what you can find with a program before you format. After you recover what you can I would totally wipe that drive (drop the partition) and reformat it. I wouldn't trust it with new information until this is done.

Lifeisabeach · May 17, 2010

DaFlake said:
Wait, I am confused....

The drive was formatted in FAT32 (a perfectly fine FS with little overhead) and the computer crashed which caused the drive to not be unmounted correctly thus causing the corruption right? Well, I hate to say this but if it was NTFS it would still be corrupt and the overhead in NTFS will eat more space on an external drive than necessary so changing the FS format is pointless. Even if it was HFS it would still be corrupt in that situation.

There is nothing wrong with FAT32 for external thumb and disk drives.

NTFS is more robust than FAT32, and this is well documented all over the internet. You can have file corruption on thumb drives and disk drives using FAT32 in situations like this. NTFS is far less prone to these issues. See this thread.
http://www.mac-forums.com/forums/os-x-operating-system/92455-goint-pull-my-hair-out.html#post571842

Unfortunately, the link I had in that thread is now dead.

DaFlake · May 17, 2010

lifeisabeach said:
NTFS is more robust than FAT32

Yes, NTFS is more robust for file security and management on a Windows machine, I won't argue there. My point is that it wasn't the FAT32 file system that corrupted because it was FAT32, it was the fact that his Mac crashed and that caused the corruption. Because of this no file system (NTFS, FAT or HPFS) would have been safe. So saying that NTFS is less prone to this is actually not correct. FAT32 is perfectly fine for a drive where security is not needed and NTFS really isn't as secure as they would like you to think.

If you care to test this, create an NTFS file system in a thumb drive and start copying a large file to it. While it is doing this, pull it out and see what happens. All file systems have to unmount, even Windows. That being said, there is a reason that MS takes up so much memory. There is a process that actually monitors for devices being removed without be unmounted and cleanly releases it.

Lifeisabeach · May 17, 2010

DaFlake said:
If you care to test this, create an NTFS file system in a thumb drive and start copying a large file to it. While it is doing this, pull it out and see what happens. All file systems have to unmount, even Windows. That being said, there is a reason that MS takes up so much memory. There is a process that actually monitors for devices being removed without be unmounted and cleanly releases it.

I don't care to test this. I have done this many times before and have never had file corruption with NTFS or HFS+ formatting (well of course I would if I was actively copying something… with that file… duh!). I have with FAT32. There is much more to NTFS besides security. FAT32 is much more prone to file corruption. This is well documented in many many many resources on the internet. This is not to say that one should not eject a drive correctly if it has NTFS. But problems are far less likely to happen if you do, particularly with unexpected crashes like this.

Lifeisabeach · May 17, 2010

I just realized I keep using the wrong terminology. The files themselves aren't what are (or shouldn't be) corrupt... it's the "directory". The files themselves should be fine, they just aren't readable at the moment without the right recovery software to fix the directory.

DaFlake · May 17, 2010

Please provide peer (no BLOGS) reviewed sources of this known corruption issue.

Sorry, but I totally disagree with you on this. I have been using FAT for years on my external devices and never had a problem with corruption. I highly doubt that MS would have stuck with it for so long if it had all these "issues". Sure, NTFS is a better system but now what really confuses me is the fact that in one thread you blast people for using driver level OS mounting tools to copy files over and then come here and now tell someone to do it.

It is likely the File Allocation Table that is damaged as it is generally locked when mounted. This is equivalent to the MFT on NTFS and both can easily be damaged with improper removal of a device. As you said, the files may still be there unless the entire partition was damaged then there is a possibility that some files may be lost.

For what it is worth I have been using NTFS since BETA 3.51. I am quite aware of all the differences.... Also, I am not trying to be a jerk here, but I keep seeing a lot of misinformation being passed on this forum.

dtravis7 · May 17, 2010

I have seen 100's of friends Flash Drive get corrupted when yanking the drive without un-mounting it. Some have never had corruption happen but it can and does. All my Flash drives are FAT32 for compatibility with everything I have to work with but I always un-mount first.

I have never formatted a flash drive NTFS so can't comment on that but I a sure it can mess up if you pull the drive while a file is being written to the drive.

It's better not to take a chance no matter how the drive is formatted. On OSX it's so EASY to unmount. Better to be safe than sorry.

To the OP, try what Lifeisabeach suggested. It sure can't hurt!

Also lets keep it nice here folks. It's fine to disagree as long as it does not turn into a name calling war. Just a heads up in case.

cwa107 · May 17, 2010

While it's certainly true that NTFS is a more modern and efficient FS, both are equally susceptible to being corrupted as a result of a sudden dismount during a write operation. FAT is more generally accepted on small capacity flash drives for compatibility reasons, but I don't see the harm in formatting a small volume with NTFS, assuming you don't need to be able to write single files that are greater than 4GB in size.

Lifeisabeach · May 17, 2010

I certainly don't dispute the notion that any file system will experience a corrupted file if it is being written when the drive is prematurely disconnected. However, I would think that would only affect the file in question, not the entire drive's contents, which appears to be what the OP is experiencing. It appears to me that the directory table is what got corrupted, not the files themselves (my bad for using wrong terminology earlier), as a result of the crash (leading to improper dismount). The results that the OP got from trying Stella Phoenix would seem to support that, since it can see the files, but the OS cannot. We do see this a bit here with people using FAT32. I've not seen anyone have this problem who was also using NTFS. Here's a bit about FAT vs. NTFS from the makers of a data recovery software. In particular, regarding what NTFS brings to the table vs FAT:

NTFS provides performance, reliability, and functionality not found in FAT:

Multiple Data Streams

Reparse Points

Change Journal

Encryption

Compression

Sparse File Support

Disk Quotas

Distributed Link-Tracking

Recoverability

Note the part about "Recoverability" in particular. NTFS is simply more robust than FAT32 and far less prone to corruptions (or better said, can self-correct itself from corruptions). Of course a file being written as a drive is disconnected would be corrupt in any case, but that does not appear to be "the" problem here.

As for thumb drives, since those aren't normally used as the primary storage location for files, but rather for temporarily holding it to move to another computer, I wouldn't say it's a big deal what one uses.

dtravis7 · May 17, 2010

cwa107 said:
While it's certainly true that NTFS is a more modern and efficient FS, both are equally susceptible to being corrupted as a result of a sudden dismount during a write operation. FAT is more generally accepted on small capacity flash drives for compatibility reasons, but I don't see the harm in formatting a small volume with NTFS, assuming you don't need to be able to write single files that are greater than 4GB in size.

Agreed completely. I have seen drives with OSX format messed up yanking them. It's rare but I have seen it for sure.

Also agreed on FAT. FAT32 is handy though for cross platform usage.

And lifeisabeach, I am not in any way saying you are wrong BTW. I just find it better to be safe and not test the system!

bobtomay · May 17, 2010

Saying i've been using FAT for years and never had any corruption problems sort of reminds me of the ones that have been using computers for 15 years and are here in the forum experiencing their first hard drive crash without a backup.

It's a well known fact that a jounaling file system has many advantages, one of which is recovery due to improper shut downs during read and write processes. This is only one reason why OSX, Windows and Linux all use a journaling file system.

Here is Apple's kb article on journaling. The section on 'Why is journaling needed' is the most apropo in this case. This is backed up by every article you can find on the web googling file systems, including those that make recommendations on what file system to use on removable drives.

While I use FAT on my removable media, I certainly cannot fault someone for recommending a journaling file system instead.

And i believe we've gotten way off the topic of helping the OP here.

cwa107 · May 17, 2010

lifeisabeach said:
I certainly don't dispute the notion that any file system will experience a corrupted file if it is being written when the drive is prematurely disconnected. However, I would think that would only affect the file in question, not the entire drive's contents, which appears to be what the OP is experiencing. It appears to me that the directory table is what got corrupted, not the files themselves (my bad for using wrong terminology earlier), as a result of the crash (leading to improper dismount). The results that the OP got from trying Stella Phoenix would seem to support that, since it can see the files, but the OS cannot. We do see this a bit here with people using FAT32. I've not seen anyone have this problem who was also using NTFS. Here's a bit about FAT vs. NTFS from the makers of a data recovery software. In particular, regarding what NTFS brings to the table vs FAT:

Note the part about "Recoverability" in particular. NTFS is simply more robust than FAT32 and far less prone to corruptions (or better said, can self-correct itself from corruptions). Of course a file being written as a drive is disconnected would be corrupt in any case, but that does not appear to be "the" problem here.

As for thumb drives, since those aren't normally used as the primary storage location for files, but rather for temporarily holding it to move to another computer, I wouldn't say it's a big deal what one uses.

Point taken, and great links too. I think we can put this one to bed.

Lifeisabeach · May 18, 2010

Before putting the thread to bed, I'd like to toss out some ideas to the OP for recovering the files. My first thought… I'm wondering if the computer lab at your school has some file recovery software available to their use? If so, maybe they can help you get these files back. Barring that, if you can get a friend with a Windows PC to help you out, here's a list of some free data recovery tools for Windows that "might" work for you. I can't vouch for any of these, so be aware that they may not be as reliable as more comprehensive, well-known paid solutions.