What's going on with this flash drive?

  • Release Candidate 6
    Guest:
    We are at a “proposed final” true release candidate with nothing known remaining to be changed or fixed. For the full story, please see this page in the "Pre-Release Announcements & Feedback" forum.
    /Steve.
  • Be sure to checkout “Tips & Tricks”
    Dear Guest Visitor → Once you register and log-in:

    This forum does not automatically send notices of new content. So if, for example, you would like to be notified by mail when Steve posts an update to his blog (or of any other specific activity anywhere else), you need to tell the system what to “Watch” for you. Please checkout the “Tips & Tricks” page for details about that... and other tips!

    /Steve.
  • Announcing “BootAble” – GRC's New Boot-Testing Freeware
    Please see the BootAble page at GRC for the whole story.
  • BootAble – FreeDOS boot testing freeware

    To obtain direct, low-level access to a system's mass storage drives, SpinRite runs under a GRC-customized version of FreeDOS which has been modified to add compatibility with all file systems. In order to run SpinRite it must first be possible to boot FreeDOS.

    GRC's “BootAble” freeware allows anyone to easily create BIOS-bootable media in order to workout and confirm the details of getting a machine to boot FreeDOS through a BIOS. Once the means of doing that has been determined, the media created by SpinRite can be booted and run in the same way.

    The participants here, who have taken the time to share their knowledge and experience, their successes and some frustrations with booting their computers into FreeDOS, have created a valuable knowledgebase which will benefit everyone who follows.

    You may click on the image to the right to obtain your own copy of BootAble. Then use the knowledge and experience documented here to boot your computer(s) into FreeDOS. And please do not hesitate to ask questions – nowhere else can better answers be found.

    (You may permanently close this reminder with the 'X' in the upper right.)


JorgeA

Active member
Dec 4, 2023
26
2
Longtime SpinRite customer and "Security Now!" listener, but my first post here.

I heard about ValiDrive from Steve's podcast a few weeks ago, and this week was the first time I had a special reason to try it. We use Windows Media Center, and I was offloading a World Series game for storage on a different computer. Halfway through the copy operation, the 128GB flash drive I was using suddenly disappeared from Windows Explorer and the copy operation stopped.

After fruitlessly trying a few things on that computer, I disconnected the flash drive and took it to my office for deeper investigation. Attempts to reformat the drive began normally, but would come to a halt at some point. I started wondering if this might be one of those flash drives with improperly reported capacity, so I downloaded ValiDrive and ran it on the flash drive. Here are three screenshots showing what ValiDrive reported:

ValiDrive 3.png

ValiDrive 4.png

ValiDrive 4b.png


Next, I ran a level 2 SpinRite scan on the flash drive. The program was humming along, until it reached the 60.74% point when it slowed down to a crawl, only updating the display after literally several minutes each time. Eventually I gave up, figuring that at the current rate SpinRite would take months to complete. It never did report any bad sectors, all the squares on the Graphic Status Display were white. (I can upload photos of some of the SpinRite screens if needed.)

So finally I put Hard Disk Sentinel to work on the flash drive. Below is what that program reported. The first image was taken at about the moment that HDS visibly slowed down, while the second was taken after it finished:

HD Sentinel 1.png

HD Sentinel 2.png


At this point, I have no expectation that the "missing" capacity on that drive can be reclaimed. But I am curious what could be going on with it. Was the capacity reported wrongly all along, or did something happen to the drive? I'd had the drive for a couple of years but had never previously filled it past the halfway mark.

Any ideas or insights will be greatly appreciated!
 

Attachments

  • ValiDrive 2.png
    ValiDrive 2.png
    15.6 KB · Views: 41
  • ValiDrive 4.png
    ValiDrive 4.png
    73.3 KB · Views: 41
Thanks, here's the output from that program:

Volume: K:
Controller: Unknown
Possible Memory Chip(s): Not available
VID: 21C4
PID: 0CD1
Manufacturer: Lexar
Product: USB Flash Drive
Query Vendor ID: Lexar
Query Product ID: USB Flash Drive
Query Product Revision: 1100
Physical Disk Capacity: 124623257600 Bytes
Windows Disk Capacity: 124623155200 Bytes
Internal Tags: JC2F-QAFJ
File System: NTFS
Relative Offset: 96 KB
USB Version: 3.10
Declared Power: 504 mA
ContMeas ID: 020D-01-00
Microsoft Windows 7 SP1 x64 Build 7601
------------------------------------
Program Version: 9.4.0.645
 
My security applications jumped so fast on ChipGenius, I didn't get to the point where I could download the file. First I tried the website in your post, and I was blocked from visiting it. Then I found the program on Softpedia, but then my AV (Bitdefender) prevented the download.

Any other utilities that will do the same thing but not ring alarm bells?
 
1701780117820.png


This isn't very conclusive. Well it is end it isn't sort of ..

It is: The drive is bad probably, degraded NAND. We see it get slower and then eventually return read errors only.

It isn't: We see at some point speed drop and then read errors only. At some point HD Sentinel complains about file not being found. In Windows the drive is treated same way as a file, so essentially HDS tells us the drive can not be found. This is typical for flash drives with degraded NAND: Degraded NAND poses problem for the drive's firmware, firmware get's pre-occupied with that until Windows decides it's taking too long for the drive to respond.

I have had plenty of USB flash drives or memory cards sent to me for data recovery. Chances are that lot of the sectors in the red area can actually be read but it takes some experimenting which ValiDrive or HDS don't do. Often a red sector can then be read without significant issue, which to me is a clear indication it's not the sector that is bad, it is the firmware "going stupid".

In my experience this isn't typical behavior of a "fake USB Flash Drive", it's typical behavior of a degraded drive, the NAND specifically and cascading issues that are a result of that.
 
Last edited:
  • Like
Reactions: JorgeA
https://www.usbdev.ru/files/chipgenius/

Scan them at virustotal.com if you decide to try them.

Yeah, close to unusable due to that. I am using this version: https://www.virustotal.com/gui/file/b58f240840e89587769db5b989e12a91dca5b216631a7f13c60143b6d1baa477

There does not appear to be a clean version but this version seems to only trigger generic/heuristic scanners and these are the ones that typically get triggered by any unsigned and unknown tool even if I know it to be totally harmless.
 
This isn't very conclusive. Well it is end it isn't sort of ..

It is: The drive is bad probably, degraded NAND. We see it get slower and then eventually return read errors only.

It isn't: We see at some point speed drop and then read errors only. At some point HD Sentinel complains about file not being found. In Windows the drive is treated same way as a file, so essentially HDS tells us the drive can not be found. This is typical for flash drives with degraded NAND: Degraded NAND poses problem for the drives firmware, firmware get's pre-occupied with that until Windows decides it's taking too long for the drive to respond.

I have had plenty of USB flash drives or memory cards sent to me for data recovery. Chances are that lot of the sectors in the red area can actually be read but it takes some experimenting which ValiDrive or HDS don't do. Often a red sector can then be read without significant issue, which to me is a clear indication it's not the sector that is bad, it is the firmware "going stupid".

In my experience this isn't typical behavior of a "fake USB Flash Drive", it's typical behavior of a degraded drive, the NAND specifically and cascading issues that are a result of that.
Thanks for the analysis. Fortunately, the flash drive doesn't have anything irreplaceable on it, so maybe I'll just keep using it until it fails completely and then throw it out.
 
My own software triggers these heuristic scanners. I don't know how developers deal with this.
I have a list of email addresses for white-listing / submitting false positives. Usually they allow you to attach a archived sample you need to password protect. I spam these addresses prior release. With MS I have a guy I send to, he gave me email address after much complaining about how annoying their approach is for developers. But white listing does not help with the stupid cloud reputation based nonsense. You simply need x amount of downloads before smart-screen and similar stops putting up warning about an exe not being commonly downloaded bla bla bla ..
 
My own software triggers these heuristic scanners. I don't know how developers deal with this.
The answer to your question is: Not easily. It's a true pain in the butt. :confused: One thing I learned during the ValiDrive work was that delaying any network activity after launching is a very useful thing. Some of the A/V technology actually runs the code in a sandbox to watch its behavior. I use a UDP ping in the form of a DNS lookup for version checking since it's universally available and minimal overhead & impact. So, ValiDrive was emitting a DNS query when it started up to check for a newer release... but this was triggering a much higher degree of false positive A/V detection. So now at startup, ValiDrive checks the date of its own executable and only emits a version check if the code is at least four week old. I didn't expect that little change to have nearly the effect that it had, but it immediately made both Google and Microsoft completely happy where previously they were going nuts.
 
  • Like
Reactions: SeanBZA
FOLLOW-UP: Last night, I downloaded Spinrite 6.1 Pre-Release Candidate 5.1 to see if it would help with this flash drive. This time, the level 2 scan got as far as 60.9037%, which FWIW is 0.12% more than SpinRite 6.0 had managed to reach (60.78%).

However, at this point the scan stopped with a “This drive has taken itself offline" message (no more words in the message after "offline") and a request to power-cycle it. But when I rebooted into SpinRite, it couldn't find the problem Lexar flash drive -- it's no longer showing up on its list of mass storage devices discovered.

Curiously, Windows still does find the flash drive and assigns it a drive letter.

Would it be fair to say that the flash drive is just getting worse and worse?
 
Would it be fair to say that the flash drive is just getting worse and worse?
Most likely.

I have some old, s-l-o-w, cheap flash drives that did NOT take kindly to an SR L3 run (L1 and L2 runs were fine) and appeared to "curl up and die". :(

I tried re-InitDisking them (nothing to lose). And Lo! InitDisk apparently "resurrected" them. They became functional and bootable again. The latest WinSpin dev release then made them fully functional SpinRite boot drives with RC5 on them.

I will never try SR L3 on then again, nor will I ever use them for anything important data wise. But they now appear to be fully functional normal SpinRite boot drives. And one of them was an old Lexar. :) I will keep them around for possible further SR testing.
 
  • Like
Reactions: JorgeA
However, at this point the scan stopped with a “This drive has taken itself offline" message (no more words in the message after "offline") and a request to power-cycle it.
Hi @JorgeA :

There are two different ways
SpinRite might declare that a drive has gone offline:
  1. One is when the drive fails to return online following a reset. SpinRite now (since pre-release 5.01) will wait much longer — 60 seconds instead of 10 seconds — for drives to "come back". But that is not what happened on the drive you have...

  2. The other way for a drive to take itself offline is for it to declare a "Device Fault" condition, after which it will shut down all communications and go inert. The only way to bring the drive back is to completely power it down, tap the heels of your ruby slippers three times, then power the system back up.

    Note that exiting SpinRite or even rebooting the machine will NOT bring such a drive back online.
    POWER must be completely turned off.
You said: “But when I rebooted into SpinRite, it couldn't find the problem Lexar flash drive -- it's no longer showing up on its list of mass storage devices discovered.” and the fact that you said that Windows sees the flash drive afterward, make me think that you may have “rebooted into SpinRite” but may not have completely turned the power off???

There is no known way to prevent this from happening. The only thing you could do would be to note the location where the drive puts itself into Device Fault then — after a full power down and back up — restart SpinRite PAST the "sore spot" and see how it goes from there.

THANK YOU for your follow-up and report!!
 
  • Like
Reactions: JorgeA
the fact that you said that Windows sees the flash drive afterward, make me think that you may have “rebooted into SpinRite” but may not have completely turned the power off???
Hi Steve,

I'veen racking my brain about this and I just can't recall what exactly I did the first time when the flash drive didn't get recognized. I seem to remember that the next time, I happened to do instead a Ctl-Alt-Del restart of the PC, and then the flash drive was found.

Next chance I get, I'll boot into SpinRite and tell it to start scanning past the current sore spot as you suggested. I'll report on developments.

In any case, there's no question but that I'll be followng @DanR's advice above, not to put anything important on that drive!

UPDATE: Since posting the above, I tried twice more (following a shutdown of the PC) to resume the level 2 scan, in each case from a spot 0.0001% past where SR reported a problem. For example, the previous error occurred at 61.0653%, so this last time I had it resume at 61.0654%.

The scan again soon failed, at 61.055%. The full message I'm getting now is:
This drive has stopped responding to commands.
Working on BIOS
drive 81h​
After an error occurred, this drive was reset to restore its normal operation. But the drive has not responded to the reset request. This indicates that the drive has entered an aberrant state which is preventing SpinRite's further work with the drive. To continue, you'll need to note the location of the trouble, reset the system, then resume SpinRite's operation at the location shown below:

Ideas/suggestions are welcome.
 
Last edited:
Last night, I downloaded Spinrite 6.1 Pre-Release Candidate 5.1
Okay. THAT message (the one you just quoted) is the "timeout" message, not the "Drive Fault" message. So my question is... can you watch it happen to verify that a one-minute countdown appears in the upper-left of the screen, counting down to zero, before SpinRite gives up on the drive? Since you're using Pre-Release 5.01, this SHOULD be the behavior you see, but this new code is still relatively untested.

Thanks!
 
Okay. THAT message (the one you just quoted) is the "timeout" message, not the "Drive Fault" message. So my question is... can you watch it happen to verify that a one-minute countdown appears in the upper-left of the screen, counting down to zero, before SpinRite gives up on the drive? Since you're using Pre-Release 5.01, this SHOULD be the behavior you see, but this new code is still relatively untested.

Thanks!
Hi Steve,

I've tried this twice more, but each time SR has stopped within ten seconds (without displaying a countdown) with the other error message:

After an error occurred, this drive was reset to restore its normal operation. But the drive has not responded to the reset request. This indicates that the drive has entered an aberrant state which is preventing SpinRite's further work with the drive. To continue, you'll need to note the location of the trouble, reset the system, then resume SpinRite's operation at the location shown below:

Maybe I'll skip forward a whole percentage point or two of the drive and see if I can get that timeout mesage for you.

UPDATE: I began a level 2 scan at 70%, way past the problem areas identified above. Everything went as normal for some two hours, when my attention finally wandered -- and, in accordance with a law of nature, that's when the error was displaying on the screen when I came back to it after just a couple of minutes. I took note of the location and started a new scan (after power-cycling the PC) shortly before that spot. This time I made sure to keep looking at the screen.

I can confirm that there is NO warning visible in the top left corner of the screen (or anywhere else on it) as the moment approaches for the "aberrant state" error. You can see that the moving percentage in the lower left has stopped advancing, but there is no countdown shown. Then, after a few seconds, the red "aberrant state" screen appears.

Steve, I do see a countdown in the top left at the beginning, but it's only when SR is looking for drives to scan. It finds the internal SSD right away, then the countdown timer begins and then, as the counter nears zero, the SpinRite flash drive and the problem flash drive both finally show up in the listing.

Hope this helps.
 
Last edited:
@JorgeA :

Thanks for your testing. I'm working toward the next round of improvements. There's some chance that it will perform better. I'll post a global notice at the top of the forum pages once 5.02 is ready. Thanks again!
 
  • Like
Reactions: JorgeA
Hi Steve,

I downloaded both 5.03 and SRPR-EX1, not sure of which one would be more suitable to use for this flash drive. I put the latter on the SpinRite drive and ran it on the bad Lexar flash drive, letting it run from the beginning (rather than starting off somewhere in the middle).

This time, SR got to 61.0652% before stopping with the "This drive has just taken itself offline" message.

I also noticed that the countdown timer is still showing up in the upper left corner as SR is looking for drives to scan. The main difference relative to previous runs is that this time the countdown began at around 110 seconds instead of 58-60 seconds. Could have been closer to 2 minutes, but I wasn't expecting to see the timer.

Should I go ahead and try 5.03 next, or is that one superseded by EX1 ?

Thank you for your good work.
 
Try 5.04.exe
Thanks, apparently that was released soon after I posted the previous message.

Downloaded it this morning and set it up on the Spinrite flash drive. Version 5.04 choked on about the same spot in the Lexar drive, at 61.0652%, with the message "This drive has just taken itself offline" followed by a paragraph that begins,

The drive is now returning "Device Fault" status.​
 
I just tried 5.05, and it stopped in the same spot, 61.0652%.

When scanning for drives to examine, SR finds the internal SSD right away, but then takes 120 seconds to list the SpinRite flash drive and the bad Lexar flash drive. The countdown timer progresses in the top left corner while looking for the flash drives, but doesn't show up when SR reaches the problem area on the drive. I did notice that the total estimated scan time started growing quickly, from 7 hours or so to over 120 hours before the "offline/Device Fault" error message popped up. But there was no countdown shown before the Level 2 scan came to a halt.