Home / Case Studies / Encrypted Pendrive Stopped Registering
Flash, Sticks and Cards · case file

The Encrypted Pendrive That Stopped Registering

A recruitment consultant in Reading carries candidate files on an Integral AES hardware-encrypted pendrive, because that is what her clients' contracts require. It stopped registering on her laptop and then on everything else. A local shop looked at it, said correctly that they could not get past the encryption, and suggested she was probably out of luck. She had the password. That turned out to be the whole difference.

USB FlashEncryption / BitLockerNot Detected
// the job in four lines
MediaAn Integral hardware-encrypted USB pendrive used for work, which no longer registers on any computer and cannot be opened. The owner has the password.
What was reportedHardware-encrypted Integral pendrive carrying candidate files, will not register on any machine, nothing on it can be opened, a local shop was unable to assist, owner still has her password.
Fault classElectronic. The controller had failed, and on a hardware-encrypted stick that controller does two jobs: presenting the memory to the computer and encrypting everything that passes through it. Losing it removed both the connection and the decryption path. The memory itself was intact.
On the benchAttempted behind a hardware write blocker to confirm the controller was silent, the board examined under a stereo microscope, the NAND desoldered under hot air by chip-off and read on a specialist programmer, the physical layout and translation reconstructed from the dump, the encryption layer resolved using the owner's own credentials supplied with the job, the volume parsed in R-Studio, documents validated by opening them and written to fresh media.
// reading the fault

Reading the fault

Hardware encryption puts everything in one basket, deliberately. The point of a stick like this is that the key never leaves the device and the computer never sees plaintext. The cost of that design is that the controller is the only route in, so when it fails the encryption stops being a feature and starts being a wall.

Reading the memory gives you ciphertext, and ciphertext is not a recovery. Lifting the NAND and dumping it produces exactly what it should: unreadable noise. Turning that into files needs the key, and the key is derived from the owner's password. Without it there is nothing to be done, and no reputable bench should suggest otherwise.

Having the password was the deciding factor, not the equipment. That is worth being blunt about, because the honest version of this job description is: with credentials, difficult but achievable; without them, no. She was told that before she agreed to anything.

The shop was right within its own limits. Nothing available to a general workshop gets past a failed hardware-encrypted controller, and saying so is better than experimenting. What they did not know is that the memory can be read directly and the encryption unwound afterwards when the owner can supply what she is supposed to have.

// bench work

Bench work

One attempt behind a hardware write blocker confirmed the controller was not enumerating at all. The board was opened and examined under the microscope, where the controller showed no obvious external damage and the memory package was clean.

The NAND was desoldered under hot air and read on a specialist programmer. The dump was descrambled and its interleaving reconstructed until a consistent volume of ciphertext appeared. The encryption layer was then resolved with the credentials she had supplied under separate cover, and R-Studio read the filesystem out of the decrypted image. Documents were opened and checked before being written to fresh media, which was returned encrypted at her request.

// what went back

What went back

The candidate files came back in full, along with the contract templates and correspondence stored beside them. The recovered set went back on encrypted media, because the reason for the original stick had not gone away.

Sticks and cards are £250 + VAT. Chip-level work sits outside the published guarantee, so half the figure was taken before the memory came off the board, with the remainder once she had opened the files.

An encrypted stick that has stopped being seen

Find the password before you do anything else, because on a hardware-encrypted device it is not a formality; it is the difference between a recoverable job and a refusal. Do not try to reset the device or use any recovery or admin mode the manufacturer provides: on most of these products those functions wipe the key deliberately, which is exactly what they are designed to do and exactly what you cannot afford. Do not attempt the password repeatedly on a stick that will not register either, since some models count failures and destroy the key after a set number. If it no longer enumerates at all, no amount of typing helps, and the memory has to be read directly.

Reading this and recognising your own drive? Every job on this page started the same way. Examining the media costs nothing, the examination closes 2 working days after the parcel is booked in and not sooner, and what comes out of it is a single figure in writing that then stays where it was put. A finished single-drive recovery leaves here 2 to 4 working days after that. Payment follows one published sentence: no fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Deletions, damaged file systems, lost partitions, firmware and service-area repair therefore all carry the guarantee. Physical work does not: a drive opened under laminar flow, a repair to a board or to a memory chip, liquid or fire damage. Those take 50% of the quoted figure before anything starts, and the remainder falls due only if your files come back. The figures themselves are short: a memory card, a USB stick or a pen drive is £250 + VAT, any one hard drive or SSD including NVMe is £300 + VAT, and arrays, NAS boxes and servers are quoted from £500 + VAT. Recorder disks, BitLocker volumes and forensic work are quoted apart from those and settled in advance. Where the storage is bolted inside a laptop, a tower, a Mac or a server, free it and post the bare unit: taking machines apart is not work this lab does, and flash soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many thin ultrabooks are built, cannot be taken in at all. Nor can phones or tablets. If it unscrews or unplugs, it is our sort of job. Send it tracked and insured to Guildford Data Recovery, Building 2, Ground Floor, Guildford Business Park, Guildford GU2 8XH, or book a courier yourself; the Guildford reception also takes devices in person, Mon–Fri 9:00am–5:30pm. Nobody collects, and there is no counter in Bracknell to call at. Freephone 0800 689 0668. Packing notes and the shipping form live here.
Start a free diagnostic

These files are written up from genuine enquiries taken from households and businesses in Bracknell, across Berkshire and Surrey and into London, with names, firms and anything else identifying stripped out. Each one sets down how the fault was reasoned through, the method it actually needed and the equipment it was worked on. One of them is a job that was turned away, which belongs here as much as the rest of them.

// nearby on the shelf

Three more files along the same lines

See every case file →

Is this your drive as well?

Examining it is free and takes 2 working days from arrival, the figure goes to you in writing and does not move afterwards, and a logical fault carries no fix, no fee. Start online or ring the freephone.