I recently encountered a USB flash drive which corrupts any file written to it. The flash memory had a large size but it was useless. After googling around and using some Linux tools, I discovered it is a counterfeit. However, I managed to recover the working part. Although it was only a fraction of the size declared by the flash, it was better than nothing. I will show you how to do this in Linux in simple steps. For windows users, check out this link.
We will use open source F3 tools created by Michel Machado from Digirati. The main tools are already in Debian/Ubuntu repositories. If you are using a different distribution, you can build the tools from source as we will explain later. If you want to make a thorough test on your flash drive, this is the reliable test. Just install them:
sudo apt-get install f3
Now fill the flash drive after mounting it using:
f3write /media/[MOUNT FOLDER]
then make the check:
f3read /media/[MOUNT FOLDER]
It might take some time depending on the size of your flash. If the flash memory passed this test (Data Lost is 0) then you can rest assure that your flash drive is OK. On the other hand, if you get data losses, then your flash drive is corrupted. Here is the output I got from making the test on an old corrupted 1 Gigabyte USB flash:
SECTORS ok/corrupted/changed/overwritten Validating file 1.h2w ... 1021326/ 991976/ 0/ 2 Data OK: 498.69 MB (1021326 sectors) Data LOST: 484.36 MB (991978 sectors) Corrupted: 484.36 MB (991976 sectors) Slightly changed: 0.00 Byte (0 sectors) Overwritten: 1.00 KB (2 sectors) Average reading speed: 21.21 MB/s
From this result, you can see half of my flash is corrupted. But the good news is we can use the working part and exclude the corrupted part. Let’s see how.
The same developer made a couple other tools called f3probe and f3fix. You won’t find these tools in the Debian/Ubuntu repositories as they are considered experimental because they weren’t tested on a large scale. We will have to build these tools from source, so make sure you have the build tools and we will also install some extra dev packages.
Download the latest release of f3 (version 6.0 at the time of this writing) from https://github.com/AltraMayor/f3/releases. The next step is to get the dependencies, for Ubuntu users (Or Debian using testing repository):
sudo apt-get install libudev1 libudev-dev libparted0-dev
Note: For Debian Jessie users not using the testing repository. You will find the missing packages in the backports repository.
We have our dependencies now. Extract f3 and navigate to the folder and type:
NOTE: If you are using the latest development version or version > v6.0 then type
make extra instead.
Hopefully the build process won’t have any errors and you will see an output like:
cc -std=c99 -Wall -Wextra -pedantic -MMD -ggdb -c -o libutils.o libutils.c cc -std=c99 -Wall -Wextra -pedantic -MMD -ggdb -c -o libdevs.o libdevs.c cc -std=c99 -Wall -Wextra -pedantic -MMD -ggdb -c -o libprobe.o libprobe.c cc -std=c99 -Wall -Wextra -pedantic -MMD -ggdb -c -o f3probe.o f3probe.c cc -o f3probe libutils.o libdevs.o libprobe.o f3probe.o -lm -ludev cc -std=c99 -Wall -Wextra -pedantic -MMD -ggdb -c -o f3brew.o f3brew.c cc -o f3brew libutils.o libdevs.o f3brew.o -lm -ludev cc -std=c99 -Wall -Wextra -pedantic -MMD -ggdb -c -o f3fix.o f3fix.c cc -o f3fix libutils.o f3fix.o -lparted
And you will find the binaries in your folder:
> find . -executable . ./log-f3wr ./f3write.h2w ./f3probe ./f3brew ./f3fix
If you encountered any errors then most likely you have missing dependencies. Try to search for the dev packages in your distribution’s repositories.
Now everything should be set. We will start with f3probe, insert the flash without mounting it, then run:
to check if we have the right device, else we will be messing other devices. The output should be something like:
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sr0 11:0 1 1024M 0 rom sdc 8:32 1 986M 0 disk └─sdc1 8:33 1 985M 0 part sda 8:0 0 298.1G 0 disk ├─sda4 8:4 0 7.4G 0 part [SWAP] ...
Now according to this output, my flash partition is
/dev/sdc1. But to use f3probe, you have to pass the device it self
/dev/sdc. Again, double check you are passing the right device. Beware that f3probe will distroy any data on the flash. Now run:
In my case the output was:
f3 probe 6.0 Copyright (C) 2010 Digirati Internet LTDA. This is free software; see the source for copying conditions. WARNING: Probing normally takes from a few seconds to 15 minutes, but it can take longer. Please be patient. Probe finished, recovering blocks... Done Bad news: The device `/dev/sdc' is a counterfeit of type limbo You can "fix" this device using the following command: f3fix --last-sec=1015872 /dev/sdc Device geometry: *Usable* size: 496.03 MB (1015873 blocks) Announced size: 986.00 MB (2019328 blocks) Module: 1.00 GB (2^30 Bytes) Approximate cache size: 0.00 Byte (0 blocks), need-reset=yes Physical block size: 512.00 Byte (2^9 Bytes) Probe time: 16.10s
F3probe did a good job identifying the usable size in just 16 seconds. Confirming that the device is a counterfeit and also telling us how to fix it. Unplug your flash and insert it again without mounting it. Run the command from the previous output, in my case it was:
> sudo ./f3fix --last-sec=1015872 /dev/sdc F3 fix 6.0 Copyright (C) 2010 Digirati Internet LTDA. This is free software; see the source for copying conditions. Drive `/dev/sdc' was successfully fixed
Now your flash should be fixed. Format it as usual and it should be almost ready. Here is a screenshot of the flash drive partition table from Gparted after formatting the device. This shows how f3fix made a new partition containning only the working part and excluded the lossy part:
It is a good idea you to run f3write/f3read on the working part to make sure it is working probably. Sometimes the first test fails after fixing. From the f3 doc:
If you get some sectors corrupted, repeat the f3write/f3read test. Some drives recover from these failures on a second full write cycle. However, if the corrupted sectors persist, the drive is junk because not only is it a fake drive, but its real memory is already failing.
Here is my output after testing:
SECTORS ok/corrupted/changed/overwritten Validating file 1.h2w ... 1013280/ 0/ 0/ 0 Data OK: 494.77 MB (1013280 sectors) Data LOST: 0.00 Byte (0 sectors) Corrupted: 0.00 Byte (0 sectors) Slightly changed: 0.00 Byte (0 sectors) Overwritten: 0.00 Byte (0 sectors) Average reading speed: 15.32 MB/s
I have 500MB working from my old corrupted 1G flash drive. Better then nothing I guess. Hope you got something useful out of your flash too. A lesson for the future, don’t buy used and cheap flash memory cards unless you test them first.