What's going on with this flash drive?

  • SpinRite v6.1 Release #3
    Guest:
    The 3rd release of SpinRite v6.1 is published and may be obtained by all SpinRite v6.0 owners at the SpinRite v6.1 Pre-Release page. (SpinRite will shortly be officially updated to v6.1 so this page will be renamed.) The primary new feature, and the reason for this release, was the discovery of memory problems in some systems that were affecting SpinRite's operation. So SpinRite now incorporates a built-in test of the system's memory. For the full story, please see this page in the "Pre-Release Announcements & Feedback" forum.
    /Steve.
  • Be sure to checkout “Tips & Tricks”
    Dear Guest Visitor → Once you register and log-in please checkout the “Tips & Tricks” page for some very handy tips!

    /Steve.
  • BootAble – FreeDOS boot testing freeware

    To obtain direct, low-level access to a system's mass storage drives, SpinRite runs under a GRC-customized version of FreeDOS which has been modified to add compatibility with all file systems. In order to run SpinRite it must first be possible to boot FreeDOS.

    GRC's “BootAble” freeware allows anyone to easily create BIOS-bootable media in order to workout and confirm the details of getting a machine to boot FreeDOS through a BIOS. Once the means of doing that has been determined, the media created by SpinRite can be booted and run in the same way.

    The participants here, who have taken the time to share their knowledge and experience, their successes and some frustrations with booting their computers into FreeDOS, have created a valuable knowledgebase which will benefit everyone who follows.

    You may click on the image to the right to obtain your own copy of BootAble. Then use the knowledge and experience documented here to boot your computer(s) into FreeDOS. And please do not hesitate to ask questions – nowhere else can better answers be found.

    (You may permanently close this reminder with the 'X' in the upper right.)

JorgeA

Active member
Dec 4, 2023
36
2
Longtime SpinRite customer and "Security Now!" listener, but my first post here.

I heard about ValiDrive from Steve's podcast a few weeks ago, and this week was the first time I had a special reason to try it. We use Windows Media Center, and I was offloading a World Series game for storage on a different computer. Halfway through the copy operation, the 128GB flash drive I was using suddenly disappeared from Windows Explorer and the copy operation stopped.

After fruitlessly trying a few things on that computer, I disconnected the flash drive and took it to my office for deeper investigation. Attempts to reformat the drive began normally, but would come to a halt at some point. I started wondering if this might be one of those flash drives with improperly reported capacity, so I downloaded ValiDrive and ran it on the flash drive. Here are three screenshots showing what ValiDrive reported:

ValiDrive 3.png

ValiDrive 4.png

ValiDrive 4b.png


Next, I ran a level 2 SpinRite scan on the flash drive. The program was humming along, until it reached the 60.74% point when it slowed down to a crawl, only updating the display after literally several minutes each time. Eventually I gave up, figuring that at the current rate SpinRite would take months to complete. It never did report any bad sectors, all the squares on the Graphic Status Display were white. (I can upload photos of some of the SpinRite screens if needed.)

So finally I put Hard Disk Sentinel to work on the flash drive. Below is what that program reported. The first image was taken at about the moment that HDS visibly slowed down, while the second was taken after it finished:

HD Sentinel 1.png

HD Sentinel 2.png


At this point, I have no expectation that the "missing" capacity on that drive can be reclaimed. But I am curious what could be going on with it. Was the capacity reported wrongly all along, or did something happen to the drive? I'd had the drive for a couple of years but had never previously filled it past the halfway mark.

Any ideas or insights will be greatly appreciated!
 

Attachments

  • ValiDrive 2.png
    ValiDrive 2.png
    15.6 KB · Views: 65
  • ValiDrive 4.png
    ValiDrive 4.png
    73.3 KB · Views: 69
Thanks, here's the output from that program:

Volume: K:
Controller: Unknown
Possible Memory Chip(s): Not available
VID: 21C4
PID: 0CD1
Manufacturer: Lexar
Product: USB Flash Drive
Query Vendor ID: Lexar
Query Product ID: USB Flash Drive
Query Product Revision: 1100
Physical Disk Capacity: 124623257600 Bytes
Windows Disk Capacity: 124623155200 Bytes
Internal Tags: JC2F-QAFJ
File System: NTFS
Relative Offset: 96 KB
USB Version: 3.10
Declared Power: 504 mA
ContMeas ID: 020D-01-00
Microsoft Windows 7 SP1 x64 Build 7601
------------------------------------
Program Version: 9.4.0.645
 
My security applications jumped so fast on ChipGenius, I didn't get to the point where I could download the file. First I tried the website in your post, and I was blocked from visiting it. Then I found the program on Softpedia, but then my AV (Bitdefender) prevented the download.

Any other utilities that will do the same thing but not ring alarm bells?
 
This isn't very conclusive. Well it is end it isn't sort of ..

It is: The drive is bad probably, degraded NAND. We see it get slower and then eventually return read errors only.

It isn't: We see at some point speed drop and then read errors only. At some point HD Sentinel complains about file not being found. In Windows the drive is treated same way as a file, so essentially HDS tells us the drive can not be found. This is typical for flash drives with degraded NAND: Degraded NAND poses problem for the drives firmware, firmware get's pre-occupied with that until Windows decides it's taking too long for the drive to respond.

I have had plenty of USB flash drives or memory cards sent to me for data recovery. Chances are that lot of the sectors in the red area can actually be read but it takes some experimenting which ValiDrive or HDS don't do. Often a red sector can then be read without significant issue, which to me is a clear indication it's not the sector that is bad, it is the firmware "going stupid".

In my experience this isn't typical behavior of a "fake USB Flash Drive", it's typical behavior of a degraded drive, the NAND specifically and cascading issues that are a result of that.
Thanks for the analysis. Fortunately, the flash drive doesn't have anything irreplaceable on it, so maybe I'll just keep using it until it fails completely and then throw it out.
 
My own software triggers these heuristic scanners. I don't know how developers deal with this.
The answer to your question is: Not easily. It's a true pain in the butt. :confused: One thing I learned during the ValiDrive work was that delaying any network activity after launching is a very useful thing. Some of the A/V technology actually runs the code in a sandbox to watch its behavior. I use a UDP ping in the form of a DNS lookup for version checking since it's universally available and minimal overhead & impact. So, ValiDrive was emitting a DNS query when it started up to check for a newer release... but this was triggering a much higher degree of false positive A/V detection. So now at startup, ValiDrive checks the date of its own executable and only emits a version check if the code is at least four week old. I didn't expect that little change to have nearly the effect that it had, but it immediately made both Google and Microsoft completely happy where previously they were going nuts.
 
  • Like
Reactions: SeanBZA
FOLLOW-UP: Last night, I downloaded Spinrite 6.1 Pre-Release Candidate 5.1 to see if it would help with this flash drive. This time, the level 2 scan got as far as 60.9037%, which FWIW is 0.12% more than SpinRite 6.0 had managed to reach (60.78%).

However, at this point the scan stopped with a “This drive has taken itself offline" message (no more words in the message after "offline") and a request to power-cycle it. But when I rebooted into SpinRite, it couldn't find the problem Lexar flash drive -- it's no longer showing up on its list of mass storage devices discovered.

Curiously, Windows still does find the flash drive and assigns it a drive letter.

Would it be fair to say that the flash drive is just getting worse and worse?
 
Would it be fair to say that the flash drive is just getting worse and worse?
Most likely.

I have some old, s-l-o-w, cheap flash drives that did NOT take kindly to an SR L3 run (L1 and L2 runs were fine) and appeared to "curl up and die". :(

I tried re-InitDisking them (nothing to lose). And Lo! InitDisk apparently "resurrected" them. They became functional and bootable again. The latest WinSpin dev release then made them fully functional SpinRite boot drives with RC5 on them.

I will never try SR L3 on then again, nor will I ever use them for anything important data wise. But they now appear to be fully functional normal SpinRite boot drives. And one of them was an old Lexar. :) I will keep them around for possible further SR testing.
 
  • Like
Reactions: JorgeA
However, at this point the scan stopped with a “This drive has taken itself offline" message (no more words in the message after "offline") and a request to power-cycle it.
Hi @JorgeA :

There are two different ways
SpinRite might declare that a drive has gone offline:
  1. One is when the drive fails to return online following a reset. SpinRite now (since pre-release 5.01) will wait much longer — 60 seconds instead of 10 seconds — for drives to "come back". But that is not what happened on the drive you have...

  2. The other way for a drive to take itself offline is for it to declare a "Device Fault" condition, after which it will shut down all communications and go inert. The only way to bring the drive back is to completely power it down, tap the heels of your ruby slippers three times, then power the system back up.

    Note that exiting SpinRite or even rebooting the machine will NOT bring such a drive back online.
    POWER must be completely turned off.
You said: “But when I rebooted into SpinRite, it couldn't find the problem Lexar flash drive -- it's no longer showing up on its list of mass storage devices discovered.” and the fact that you said that Windows sees the flash drive afterward, make me think that you may have “rebooted into SpinRite” but may not have completely turned the power off???

There is no known way to prevent this from happening. The only thing you could do would be to note the location where the drive puts itself into Device Fault then — after a full power down and back up — restart SpinRite PAST the "sore spot" and see how it goes from there.

THANK YOU for your follow-up and report!!
 
  • Like
Reactions: JorgeA
the fact that you said that Windows sees the flash drive afterward, make me think that you may have “rebooted into SpinRite” but may not have completely turned the power off???
Hi Steve,

I'veen racking my brain about this and I just can't recall what exactly I did the first time when the flash drive didn't get recognized. I seem to remember that the next time, I happened to do instead a Ctl-Alt-Del restart of the PC, and then the flash drive was found.

Next chance I get, I'll boot into SpinRite and tell it to start scanning past the current sore spot as you suggested. I'll report on developments.

In any case, there's no question but that I'll be followng @DanR's advice above, not to put anything important on that drive!

UPDATE: Since posting the above, I tried twice more (following a shutdown of the PC) to resume the level 2 scan, in each case from a spot 0.0001% past where SR reported a problem. For example, the previous error occurred at 61.0653%, so this last time I had it resume at 61.0654%.

The scan again soon failed, at 61.055%. The full message I'm getting now is:
This drive has stopped responding to commands.
Working on BIOS
drive 81h​
After an error occurred, this drive was reset to restore its normal operation. But the drive has not responded to the reset request. This indicates that the drive has entered an aberrant state which is preventing SpinRite's further work with the drive. To continue, you'll need to note the location of the trouble, reset the system, then resume SpinRite's operation at the location shown below:

Ideas/suggestions are welcome.
 
Last edited:
Last night, I downloaded Spinrite 6.1 Pre-Release Candidate 5.1
Okay. THAT message (the one you just quoted) is the "timeout" message, not the "Drive Fault" message. So my question is... can you watch it happen to verify that a one-minute countdown appears in the upper-left of the screen, counting down to zero, before SpinRite gives up on the drive? Since you're using Pre-Release 5.01, this SHOULD be the behavior you see, but this new code is still relatively untested.

Thanks!
 
Okay. THAT message (the one you just quoted) is the "timeout" message, not the "Drive Fault" message. So my question is... can you watch it happen to verify that a one-minute countdown appears in the upper-left of the screen, counting down to zero, before SpinRite gives up on the drive? Since you're using Pre-Release 5.01, this SHOULD be the behavior you see, but this new code is still relatively untested.

Thanks!
Hi Steve,

I've tried this twice more, but each time SR has stopped within ten seconds (without displaying a countdown) with the other error message:

After an error occurred, this drive was reset to restore its normal operation. But the drive has not responded to the reset request. This indicates that the drive has entered an aberrant state which is preventing SpinRite's further work with the drive. To continue, you'll need to note the location of the trouble, reset the system, then resume SpinRite's operation at the location shown below:

Maybe I'll skip forward a whole percentage point or two of the drive and see if I can get that timeout mesage for you.

UPDATE: I began a level 2 scan at 70%, way past the problem areas identified above. Everything went as normal for some two hours, when my attention finally wandered -- and, in accordance with a law of nature, that's when the error was displaying on the screen when I came back to it after just a couple of minutes. I took note of the location and started a new scan (after power-cycling the PC) shortly before that spot. This time I made sure to keep looking at the screen.

I can confirm that there is NO warning visible in the top left corner of the screen (or anywhere else on it) as the moment approaches for the "aberrant state" error. You can see that the moving percentage in the lower left has stopped advancing, but there is no countdown shown. Then, after a few seconds, the red "aberrant state" screen appears.

Steve, I do see a countdown in the top left at the beginning, but it's only when SR is looking for drives to scan. It finds the internal SSD right away, then the countdown timer begins and then, as the counter nears zero, the SpinRite flash drive and the problem flash drive both finally show up in the listing.

Hope this helps.
 
Last edited:
@JorgeA :

Thanks for your testing. I'm working toward the next round of improvements. There's some chance that it will perform better. I'll post a global notice at the top of the forum pages once 5.02 is ready. Thanks again!
 
  • Like
Reactions: JorgeA
Hi Steve,

I downloaded both 5.03 and SRPR-EX1, not sure of which one would be more suitable to use for this flash drive. I put the latter on the SpinRite drive and ran it on the bad Lexar flash drive, letting it run from the beginning (rather than starting off somewhere in the middle).

This time, SR got to 61.0652% before stopping with the "This drive has just taken itself offline" message.

I also noticed that the countdown timer is still showing up in the upper left corner as SR is looking for drives to scan. The main difference relative to previous runs is that this time the countdown began at around 110 seconds instead of 58-60 seconds. Could have been closer to 2 minutes, but I wasn't expecting to see the timer.

Should I go ahead and try 5.03 next, or is that one superseded by EX1 ?

Thank you for your good work.
 
Try 5.04.exe
Thanks, apparently that was released soon after I posted the previous message.

Downloaded it this morning and set it up on the Spinrite flash drive. Version 5.04 choked on about the same spot in the Lexar drive, at 61.0652%, with the message "This drive has just taken itself offline" followed by a paragraph that begins,

The drive is now returning "Device Fault" status.​
 
I just tried 5.05, and it stopped in the same spot, 61.0652%.

When scanning for drives to examine, SR finds the internal SSD right away, but then takes 120 seconds to list the SpinRite flash drive and the bad Lexar flash drive. The countdown timer progresses in the top left corner while looking for the flash drives, but doesn't show up when SR reaches the problem area on the drive. I did notice that the total estimated scan time started growing quickly, from 7 hours or so to over 120 hours before the "offline/Device Fault" error message popped up. But there was no countdown shown before the Level 2 scan came to a halt.
 
I am wondering what the desired outcome is here? It's clear the drive is terminal and nothing will fix it, SR seems to handle it gracefully, not crashing or anything.
The first 61% or so of the drive seems to be OK and usable, but there also appear to be several dozen GBs of good space past the problem area(s). Is there a way to block out the problem spots, such that the rest of the flash drive (before and after the bad areas) can still be used?
 
Last edited:
The first 61% or so of the drive seems to be OK and usable, but there also appear to be several dozen GBs of good space past the problem area(s). Is there a way to block out the problem spots, such that the rest of the flash drive (before and after the bad areas) can still be used?
Well . . . I suppose you could - in theory - create a partition encompassing most of the "good" area at the front of the drive (leaving some pad between that partition and the first bad area of the drive).

But . . . why bother?

This drive has already apparently experienced NAND failure in multiple areas. There is no way to know when or where the next NAND failure will occur.
However, it will occur!

I would never trust this drive for any data storage or other meaningful use.

It could however be a useful test specimen for future SpinRite 7.x development. A future SpinRite 7x may not be able to make this drive healthy/trustworthy again but it may be able to provide useful information about what is going on inside this drive.
 
I did notice that the total estimated scan time started growing quickly, from 7 hours or so to over 120 hours before the "offline/Device Fault" error message popped up. But there was no countdown shown before the Level 2 scan came to a halt.
Hi @JorgeA:

There are two way for SpinRite to “give up” on a drive. One way is for SpinRite to try (a lot) to get a drive back online when it really doesn't want to keep going. That's the 120-second countdown you see. Since this ends SpinRite's ability to work with the drive, it will actually do two 120-second countdowns using a different "get back online" strategy the second time.

The second way for SpinRite to “give up” on a drive is for the drive to adamantly declare that it cannot proceed and to enter "Device Fault" state. Until these last few releases of SpinRite, transient "impossible" drive status was confusing SpinRite so that it might believe that a drive had declared an emergency ("Device Fault") when it really hadn't. But I believe that was finally resolved once I understood that this could happen.

So the reason you're not seeing any 120-second countdown (or two of them) is that your drive really IS entering "Device Fault" state and requiring a full power-cycle in order to force it to forget how unhappy it is.

One way you can verify this is by exiting and restarting SpinRite without powering down the machine. If SpinRite is willing to run on that drive again, after having previously declared that it's in Device Fault, then I/we still have a problem with SpinRite falsely declaring a drive emergency. But if (as I expect and hope) when rerunning, SpinRite marks the drive RED from the start and when you try to select it you learn that, yes, it's still in Device Fault, then SpinRite is doing the right thing and that drive really is "toast."
 
  • Like
Reactions: JorgeA