Using OSF with SDHC card - Transcend card suddenly not formatted

[JohnFredC]

Hello all.

My Transcend 16Gb SDHC card failed suddenly in camera. Windows reports a 1GB raw volume and wants to format it.

Using OSForensics on my Win 8.1/64 system to image the card "finishes" at 1GB, so I have been unable to image the entire card in order to attempt to recover my photos. That first GB apparently contains nothing useful.

Does OSF support SDHC cards? Can anyone point me to a resource that might apply to my situation? Web searches have not yielded much useful info, though one did send me here.

OSF looks like just the thing I need, but without an entire 16Gb image to work with... well.

Thanks in advance for any guidance offered!

[orioon]

I've heard this several time now, but I am unaware of any ways by software to retrieve the data.
The same happened to many SSD's of a certain series from Intel.
You could do some research in this area and see if some folks managed to fix it.
Hopefully the same approach (if one exists) applies to your SD card.

As the firmware is reporting the wrong size you will have to force reading behind the boundaries.
Not even dd from Linux can do that afaik.
Soldering the memory chip on a working (identical) SD card might work, but that is likely very hard to do on your own.

[JohnFredC]

Thank you very much for your response!

I've not found a tool that will read "beyond the boundaries", even when given the "correct" geometry to use. Everything I have tried exits at the 1 Gb boundary. This suggests hardware failure, perhaps the controller chip in the card.

For those who may be seeking guidance and have arrived at this thread, there is a company in Germany who will disassemble the card to access the memory chips directly. If you have encountered a circumstance similar to mine, try:

http://recoverfab.com/index.php

Unfortunately, Recoverfab's fee is a bit high for the content that I have lost.

Again, thank you for taking the time to read my post and reply!

[David (PassMark)]

Yes, flash cards are supported.
When you tried to image the drive, are you sure you are trying to image the physical drive? As maybe you just imaged what appears as a partition.

Can you use OSF to dump out the Master boot record (MBR). This is the 1st sector on the physical drive and it also contains the partition table. You can select 'decode' to display the partitions detected in the MBR.

It should look something like this example dump from a 64GB flash drive.

[JohnFredC]

Hi David...

Thank you for showing interest in my case. Appended below is a link to a screen capture of the OSF window showing Sector 1 selected, with the Decode dialogs overlaid to the right.

The geometry for this card is supposed to be: /1947-255-63 512/ but another tool I have reports /260-128-63 512/ for it, hence the 1GB behavior when imaging.

[David (PassMark)]

So that isn't good news.

Depending on how the flash drive was initially formatted, the first sector of a flash drive should either contain a MBR or a FAT Boot sector.

A MBR contains a bunch of code if it is bootable (or zeros if not bootable), then a partition table (offset 01FE) and a MBR signature (offset 01FE). This is what you can see in my example. The MBR signature is offset 01FE and has the value 55AA.

A FAT Boot sector contain a name string (e.g. "MSDOS5.0") right at the start of the sector. Then information about the number of sectors on the drive, number of heads, bytes in each sector, etc...

So your screen shot doesn't contain either a MBR nor a FAT boot sector.

Your first sector had these values,
00 64 80 01 80 01 80 01 - 80 01 80 01 80 03 00 00 00 00

Which just so happen to exactly match the values in this Polish post here,
http://www.elektroda.pl/rtvforum/topic2394966.html
Who also just so happened to have a Transcend 16Gb card that also only reported it's size as 1GB.

Their conclusion seems to be that the Transcend 16Gb was a fake and the capacity was never 16GB in the first place!

Writing beyond the real size of the fake drive to lead to corruption of data on the drive.

Did you ever store 16GB of of data on this drive (and read it back off without error)?
From where did you buy the drive?

[JohnFredC]

The card has given me a couple of years of good performance in two different cameras. I have filled it several times with thousands of pics and estimate it has a couple of thousand of 6MB images on it now.

Be that as it may...

Another site suggested I should look for a (green, on the back) serial number because of a Transcend recall issued around the time I purchased it from Amazon.

No serial number.

There are many lessons for me to learn from this incident...

Thanks for your responses!

[David (PassMark)]

Yes, it seems the bad batch that got recalled had the same behavior as you describe.

See,
http://cheesycam.com/transcend-class-10-sdhc-media-recall/#comment-37342
"I started the 10 hour shoot with the 16gb transcend..........Suddenly my assistant comes to me and tells me that the computer is saying that the memory card is not formatted.......The 16gb card was reading as a 1gb card....Till this day I have not been able to get the files off the card. "

According to the Transcend press release, items impacted by this recall were sold between July 28 and August 15, 2011. And the problem was triggered by writing large > 4GB files to the device.

They also gave these contact details. Which you might want to try.
techsupport@transcendusa.com or by phone at (714) 921-2000.

In hindsight this might have also been the problem reported on the Polish site I linked to above. They said Transcend replaced their unit, but Transcend are unlikely to have replaced a fake.

While it is nice to get to the bottom of these problem, it sucks to loose all your photos.