The accounting file, the payroll run, the one record of the company's accounts, all on a flash drive that had been knocked off a table or stopped mid-way during a transfer. This is small parcel work, which fits well for a county of large distances: a letter sent from anywhere in the county of Norfolk today will be on a bench by tomorrow morning. Broken necks, dead controllers, deleted files: all seem to find their way back. Most of them start with someone giving up using different outlets.
Every USB stick / flash drive job is diagnosed free. The quote is written out and fixed before we even get out our screwdriver.
In most cases you only pay if we recover your data. Electronic, mechanical, chip-level and physical work is charged at 50% upfront. Ransomware, forensic, BitLocker and CCTV/DVR jobs are charged 100% upfront on acceptance of our fixed quotation. Please refer to the data recovery cost page for full details on costs.
The primary task on every USB/flash device is determining what symptom matches the failure, and after over twenty years, these thirty possible failures encompass almost all issues that come into our shop.
A knee against it, a strap on your shoulder, a chair pushed in while you're not looking; leverage will win. We rebuild under the microscope when the board permits us to do so, and we simply read from the memory chip where it does not.
It is reading a string of numbers and talking gibberish. That usually means the controller or its firmware has failed instead of the actual data being lost. The files have never been displaced one inch.
When the controller awakens there is no self-made map of its internal memory. Using chip readers and using software to recreate the chip's internal maps allows the two to communicate again.
A broken file table sits atop whole files. Simply decline the offer, remove the stick and post it in as it is now.
It can be recovered at any time prior to the point when the freed space is used again. After this point passes, it cannot be recovered. The best place for the stick from here is a desk drawer, as opposed to an available port.
This stick has developed a short, and it will slowly burn itself while still plugged into the computer. Take it out. Each minute the stick is allowed to remain warm in a port is each minute taken from your remaining safety net.
Any stick left standing in a socket becomes a large lever, with an enormous amount of patience. At some point, the solder joints will crack, and most of the memory chips will remain unaware of it.
These sticks have no separate package to lift. Instead, mapped test points are probed, which will give you access to exactly the same files, but at a much slower pace.
Two times, in a single case we can still remember. Provided they are cleaned thoroughly and dried completely on the bench, washed sticks do better than their owner may have hoped for. One way to destroy this is to put a damp stick into your computer to test.
All the folders are replaced with lookalike shortcuts after a spell on a machine that has been used by multiple users. The actual folders which contain the true files are most likely hidden under the deceit, perfectly fine as if no damage had occurred.
Classic marketplace fake. Writes fold back over the real chip when it is full, so what was written before the loop carves out cleanly, and what was written after was never stored anywhere.
The SDCZ50 has two well known exit paths; the first is where the neck snaps at the root of the connector. The second is simply a sudden drop in capacity to 0MB. Both have standard routines here and neither should cause any surprise.
Kingston's Exodia DTX and the older DT100 G3 lock up in a controller state that does not respond to any form of communication. Rather than try to communicate with it, we simply address the memory directly.
Inside will be whatever silicon was cheapest that quarter, and the printed logo has no value in telling you what kind of silicon it is. The controller that turns up in this thing determines the route, which is why the diagnostic always runs first.
A stick that flexed and returned to its original position usually has tiny cracks in the tracks inside. It is repaired under magnification and then read from one end to the other.
This model (SDCZ430) is made to stay in a port for life. Hot laptop ports are a bad place to spend 3 years. When the controller fails, monolithic probing will take over.
The metal case on the SDCZ73 comes off taking some of the tracks with it as souvenirs. Board rework on the flash bench, then a full image.
Verbatim's office staple can get used as a work drive instead of being used strictly as a transfer drive. In doing so, it experiences many years of writing cycles it wasn't intended for. It starts to fail gradually until it does suddenly.
The long bodied DTX levers against the tight front socket until the joints fracture, and a reflow under magnification will normally restore order before you need to go further.
Grit caught in the slider of the retractable Courier and just age on the Neon cause both to fail far more frequently at the controller end rather than the memory end, which is good news.
Oxidisation from years of thumbs and pocket humidity damages the contacts and causes the stick to flicker randomly in and out of operation. With proper cleaning, this results in one single continuous image rather than a dozen attempts.
An electrical storm or an improperly functioning power supply sends a surge out through the tower's front socket and the stick inside it takes all of it. The controller is destroyed but the memory normally survives.
As flash in storage loses its stored charge over time, older archives read back faintly. Careful ECC imaging given time allows much of what a quick read would have discarded as unreadable to be kept.
Windows offers to "fix" the drive and generates a folder of numbered fragments with no names; we totally disregard the fragments and build the original layout from a raw image.
When these sticks have been given an excessive number of incorrect PINs, they wipe themselves (by design), and no lab can talk them out of this either. Once you have the PIN, the job is routine, which is worth knowing before you begin guessing.
If you bend a stick sufficiently far, the internal silicon may fracture even if the board appears straight and all of the solder joints look fine. There is no enumeration and never will be, due to the fact that the component performing the enumeration is broken into pieces, so chip-off followed by rebuilding the mapping via software is the way to go, and it works.
Sticks used to run a live OS, or as a USB boot disk which contains a bootable installer that gets rewritten every few months, are subjected to workloads greater than what most promotional flash drives were developed to handle. First the wear levelling mechanism fails, then whole blocks stop answering. In most cases everything previously written remains reachable.
A controller which has an error while writing data can cause itself to enter into a protected mode; and once it enters, it may remain that way forever. All utilities report the disk as being write-protected. This is due to the fact that the write protect flag is stored in the controller's own tables instead of in Windows. Therefore, the flag cannot be reset by registry advice from a forum, since the flag is set in the controller.
The owner locates and runs the manufacturer's low level format utility online to cure a fault. This tool will then erase all of the table data for the controller and create new table information from the beginning; therefore, the map of where everything was is destroyed. The only way to retrieve the items would be to read the raw memory directly and recreate the original arrangement, which is exactly what this bench does.
The stick produced an error; the format option appeared to provide a solution to fix this problem; and therefore it was selected. Performing a quick format is survivable and performing a full format is less so. However, regardless of whether it was a quick or full format, you should stop there, as any files written after this point are placed atop what we would otherwise recover.
Whatever name your office uses for these (memory sticks, pen drives, or thumb drives), all of them have a single vulnerable spot at the joint between the internal printed circuit board and the metal connector. A knee against a laptop on a train can do it. Under magnification, the torn pads are rebuilt and the cracked tracks bridged, and once the board is beyond this condition the memory chip is removed from its board and put onto a programmer, so nothing on the stick's own board needs to work again. Most commonly these "patients" include products such as SanDisk Cruzer Blade and Ultra Fit, Kingston DataTraveler DT100 G3 and the small metal DTSE9, Samsung BAR Plus, Verbatim Store 'n' Go, Integral and PNY. Inside them there is a short list of controller chips (Phison, Silicon Motion, Alcor, Chipsbank), and identifying which one is present decides how the raw dump gets decoded afterwards.
Wrong folder deleted, or all your documents replaced by a shortcut icon after a visit to the print shop? The second one of these is an annoyance, rather than a disaster. That type of infection will conceal a lot more than it destroys, and deletion marks space as free to use without wiping it. Therefore the instructions in this case are brief and mildly dull: drawer, unplugged, hands off. Here a complete copy of everything from beginning to end is created and then your documents are carved out of the copy rather than the original. Sticks that just quit working with very little fanfare go down the same path, straight through the chips. More modern 'monolithic' designs, in which the controller and memory are integrated into one single part, require test points instead of a soldering iron. These are much slower, and the assessment will identify them as such prior to asking you to make any decisions.
Work on sticks is chip work throughout each step of the process, hence why they are kept on the flash bench from booking in to going home:
Reads from the memory chips directly and recreates in software the arithmetic that was previously handled by the dead controller. If a stick or card does not respond at all, then this is where our conversation begins again.
Hot-air and infrared profiles that allow a memory package to be removed from a ruined board without disturbing the charge stored in it. This skill is all about patience and self-control when dealing with heat.
Some cards do not have a separate chip to lift. We locate test points using our pinout records and wire them out by hand, under magnification, which is very laborious, but it is the only way those cards get read.
The XOR/ECC/wear levelling puzzle is worked through until a raw dump of the memory reads back as named folders. A lot of unglamorous maths, but it has a good ending.
Lifted pads, torn tracks or sheared plugs are repaired under magnification. A fair share of sticks that would otherwise be considered 'dead' require only this type of repair.
Every stick and every card is read behind a blocked interface so the original memory goes back to its owner in the same exact condition it was received in.
There is an enormous amount of Norfolk's payroll records, parish minutes, dissertations and quotes sitting on the Cruzer Blade, Ultra Flair, Exodia and Attaché, and most of it has not been copied anywhere else. Each one fails true to its type. SanDisk's thin metal bodies get very warm and shed their cases. The SDCZ50 breaks at the neck or drops to zero. Kingston's long budget sticks tend to crack their joints against tight ports. The Store 'n' Go gets used as a working drive until the wear levelling runs out of ideas. The Integral Courier and Neon that sit in every office drawer will keep going until their controllers can't. Conference freebies are a lottery we wish we could spare you, and the best thing we can say about all of them is don't put the only copy of anything on one. Everything on this page is read at chip level, and the diagnostic that decides which method to use costs nothing and takes two working days after arrival.
Most items arrive at this bench by insured and tracked post. We recommend getting a quote first, either by telephone or using our free online diagnostic, and once you have received your quote, simply post the item. Post is the steadiest way to move a poorly drive, and a parcel sent from Norfolk typically arrives on the bench within a working day.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? Before sending, remove the hard disk drive (HDD) or solid state drive (SSD), as we do not accept whole units. From a DVR or recorder, send just the disk. From a server or RAID, take out the disks and clearly label each disk by bay number. A network attached storage (NAS) device may be sent as its disks if they can be removed; otherwise please send the NAS itself. There is only one type of drive we are unable to accept: storage soldered onto a motherboard (e.g. Apple Silicon Macs, extremely thin laptops). In such cases, if the storage cannot be taken out it cannot be accepted. If you are unsure whether you have a removable drive or not, call us before sending anything.
↓ Print the shipping & booking-in form (PDF)
Please mark the parcel for the attention of Cambridge Data Recovery. It takes about an hour and twenty minutes to travel from Norwich along the A11, then two minutes off the A14 at Junction 32. Otherwise you can post it using a tracked service and we will receive it the following working day. We will contact you as soon as we have your drive and it is booked onto our bench.
If you're unsure of what to include in the box, please call us on 0800 689 0668 before sealing it. Or, for a first view on what we can do, you can use our free online diagnostic.
Free diagnosis, one fixed figure written down, and in most cases you only pay if we recover your data. Start online or ring us.