Home / Case Studies / The Dates Went Wrong, Then the Stick Went
Flash, Sticks and Cards · case file

The Dates Went Wrong, Then the Stick Went

A piano teacher in Richmond noticed something odd a fortnight before the stick died: file dates that were not the dates she had saved things on, and a couple of names with characters in them she had certainly not typed. She carried on using it. Then no machine in the house would acknowledge it at all. On it were recital recordings of pupils who have since left.

USB FlashNot DetectedElectrical / PCB
// the job in four lines
MediaA USB flash drive that first showed corrupted file details and altered dates, then stopped being recognised by any computer at all. It holds recital recordings with no other copy.
What was reportedUSB stick, file details and dates showing wrongly at first, then no longer recognised on any PC, recital recordings of former pupils wanted back.
Fault classElectronic. The stick's controller failed progressively: first mistranslating where things were, which is what produced the wrong dates and mangled names, then failing outright, at which point the stick could no longer introduce itself. The memory itself was intact.
On the benchAttempted behind a hardware write blocker to confirm the controller was not answering, opened and examined under a stereo microscope, the NAND package desoldered under hot air by chip-off and read on a specialist programmer, the controller's translation reconstructed from the raw dump, the volume parsed in R-Studio, recordings carved by content signature and validated by playing them before being written to fresh media.
// reading the fault

Reading the fault

Wrong dates on the right files is a translation error. Flash memory is not addressed directly. A controller keeps a map between the addresses a computer asks for and the physical pages that actually hold the data, and it rewrites that map constantly. When the controller starts making mistakes, the first symptom is usually metadata arriving from the wrong place: dates, names and sizes that belong to something else.

The fortnight of odd behaviour was the warning. Controllers rarely fail cleanly. They degrade, and during the degradation the stick still works well enough to look usable. Continuing to write to it during that period is the worst thing that can be done, because every write is recorded in a map that is already unreliable.

When it stops being recognised, the map is the casualty, not the memory. The memory chip is a separate component and it does not fail because the controller did. It is still holding the pages. What has gone is the only thing that knew how those pages fitted together.

Reading past a dead controller means going to the chip. The memory is lifted off the board and read directly on a programmer, which produces a raw dump with no order to it. The order has to be worked out from the dump itself: the interleaving, the page layout, the correction and scrambling the controller applied. That reconstruction is the job, and it is why chip-level work sits outside the no fix, no fee guarantee.

// bench work

Bench work

One attempt behind a hardware write blocker confirmed the controller was not answering at all, which meant nothing could be read through it however patient the software. The stick was opened and the board examined under the microscope, where the memory package was intact and unmarked.

The NAND was desoldered under hot air and read on a specialist programmer, giving a raw dump in the physical order the chip stores things rather than the logical order the computer used to see. The interleaving and page structure were worked out from the dump, the scrambling reversed, and a coherent volume assembled. R-Studio read what remained of the directory, and the recordings whose references had gone were carved by content signature and played through before anything was written to fresh media.

// what went back

What went back

All of the recital recordings came back, along with a folder of scanned sheet music she had assumed was lost with them. The stick did not go home working, because it cannot: the memory now lives on a bench, not in a case.

A card or a USB stick is £250 + VAT. Chip-level work is named in the published exclusion, so this was not a job the guarantee covered: half the figure was taken before the memory came off the board and the balance once the recordings had been checked.

Odd dates, odd names, then nothing at all

Treat strange metadata as a countdown. Dates that are not yours, names with characters you did not type, sizes that make no sense: all of those mean the controller has begun mistranslating, and it will not get better. Copy everything off immediately, in one pass, and stop using the stick even if it appears to recover. Do not reformat it, because a format writes a new structure through a map that is already wrong. If it has already stopped being recognised, no software will help, because there is nothing left to talk to. The memory chip is almost certainly fine, and reaching it is bench work.

Reading this and recognising your own drive? Every job on this page started the same way. Examining the media costs nothing, the examination closes 2 working days after the parcel is booked in and not sooner, and what comes out of it is a single figure in writing that then stays where it was put. A finished single-drive recovery leaves here 2 to 4 working days after that. Payment follows one published sentence: no fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Deletions, damaged file systems, lost partitions, firmware and service-area repair therefore all carry the guarantee. Physical work does not: a drive opened under laminar flow, a repair to a board or to a memory chip, liquid or fire damage. Those take 50% of the quoted figure before anything starts, and the remainder falls due only if your files come back. The figures themselves are short: a memory card, a USB stick or a pen drive is £250 + VAT, any one hard drive or SSD including NVMe is £300 + VAT, and arrays, NAS boxes and servers are quoted from £500 + VAT. Recorder disks, BitLocker volumes and forensic work are quoted apart from those and settled in advance. Where the storage is bolted inside a laptop, a tower, a Mac or a server, free it and post the bare unit: taking machines apart is not work this lab does, and flash soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many thin ultrabooks are built, cannot be taken in at all. Nor can phones or tablets. If it unscrews or unplugs, it is our sort of job. Send it tracked and insured to Guildford Data Recovery, Building 2, Ground Floor, Guildford Business Park, Guildford GU2 8XH, or book a courier yourself; the Guildford reception also takes devices in person, Mon–Fri 9:00am–5:30pm. Nobody collects, and there is no counter in Bracknell to call at. Freephone 0800 689 0668. Packing notes and the shipping form live here.
Start a free diagnostic

These files are written up from genuine enquiries taken from households and businesses in Bracknell, across Berkshire and Surrey and into London, with names, firms and anything else identifying stripped out. Each one sets down how the fault was reasoned through, the method it actually needed and the equipment it was worked on. One of them is a job that was turned away, which belongs here as much as the rest of them.

// nearby on the shelf

Three more files along the same lines

See every case file →

Is this your drive as well?

Examining it is free and takes 2 working days from arrival, the figure goes to you in writing and does not move afterwards, and a logical fault carries no fix, no fee. Start online or ring the freephone.