2 deleted 264 characters in body; edited title
source | link

Analyzing possible encrypted USB stick.

I have a problem with a USB stick and I would like to ask this question here. It is not necessarily a security question, but is rather a digital forensic question - this is why I believe this is the right place to ask this question.

I was given an USB stick which was used to secure some data from a work computer. However - the USB stick seems broken now, or encrypted, which would mean the information might be lost.

So, when connecting the USB stick to a computer the following files are being seen:

Initial connection of the USB stick

I had to blacken some titles cause of the privacy of the USB stick owner. As you can see (green errorarrows) there are normal folders as well as "encrypted" ones on the USB stick (also the the black files can be opened and viewed).

My initial thought was that something encrypted the USB stick - but I thought it was odd that only half of the files are encrypted.

I made a dd copy of the stick and runran fdisk -l on it, with the following results:

fdisk

As you can see the partition table either doesnt exist or is in an unknown format. Maybe it is just a big FAT32 disk and fdisk tries to match something to have its standard partitions.

However it says in fdisk that there is a novell partition on there - is it possible that netware is using a format that is unknown and maybe different encoding and thats why those cryptic parameters happen?

Also, how is it possible that the file names are so cryptic, but windows is still able to tell that it is e.g. an mp4 file?

My questions basically are:

  • isIs the USB stick rather encrypted or broken (wrong format etc)?
  • whatWhat can iI do to restore the "encrypted" folders?

Thanks for any input!

Analyzing possible encrypted USB stick.

I have a problem with a USB stick and I would like to ask this question here. It is not necessarily a security question, but is rather a digital forensic question - this is why I believe this is the right place to ask this question.

I was given an USB stick which was used to secure some data from a work computer. However - the USB stick seems broken now, or encrypted, which would mean the information might be lost.

So, when connecting the USB stick to a computer the following files are being seen:

Initial connection of the USB stick

I had to blacken some titles cause of the privacy of the USB stick owner. As you can see (green error) there are normal folders as well as "encrypted" ones on the USB stick (also the the black files can be opened and viewed).

My initial thought was that something encrypted the USB stick - but I thought it was odd that only half of the files are encrypted.

I made a dd copy of the stick and run fdisk -l on it, with the following results:

fdisk

As you can see the partition table either doesnt exist or is in an unknown format. Maybe it is just a big FAT32 disk and fdisk tries to match something to have its standard partitions.

However it says in fdisk that there is a novell partition on there - is it possible that netware is using a format that is unknown and maybe different encoding and thats why those cryptic parameters happen?

Also, how is it possible that the file names are so cryptic, but windows is still able to tell that it is e.g. an mp4 file?

My questions basically are:

  • is the USB stick rather encrypted or broken (wrong format etc)
  • what can i do to restore the "encrypted" folders?

Thanks for any input!

Analyzing possible encrypted USB stick

I was given an USB stick which was used to secure some data from a work computer. However - the USB stick seems broken now, or encrypted, which would mean the information might be lost.

So, when connecting the USB stick to a computer the following files are being seen:

Initial connection of the USB stick

I had to blacken some titles cause of the privacy of the USB stick owner. As you can see (green arrows) there are normal folders as well as "encrypted" ones on the USB stick (also the the black files can be opened and viewed).

My initial thought was that something encrypted the USB stick - but I thought it was odd that only half of the files are encrypted.

I made a dd copy of the stick and ran fdisk -l on it, with the following results:

fdisk

As you can see the partition table either doesnt exist or is in an unknown format. Maybe it is just a big FAT32 disk and fdisk tries to match something to have its standard partitions.

However it says in fdisk that there is a novell partition on there - is it possible that netware is using a format that is unknown and maybe different encoding and thats why those cryptic parameters happen?

Also, how is it possible that the file names are so cryptic, but windows is still able to tell that it is e.g. an mp4 file?

My questions basically are:

  • Is the USB stick rather encrypted or broken (wrong format etc)?
  • What can I do to restore the "encrypted" folders?
1
source | link

Analyzing possible encrypted USB stick.

I have a problem with a USB stick and I would like to ask this question here. It is not necessarily a security question, but is rather a digital forensic question - this is why I believe this is the right place to ask this question.

I was given an USB stick which was used to secure some data from a work computer. However - the USB stick seems broken now, or encrypted, which would mean the information might be lost.

So, when connecting the USB stick to a computer the following files are being seen:

Initial connection of the USB stick

I had to blacken some titles cause of the privacy of the USB stick owner. As you can see (green error) there are normal folders as well as "encrypted" ones on the USB stick (also the the black files can be opened and viewed).

My initial thought was that something encrypted the USB stick - but I thought it was odd that only half of the files are encrypted.

I made a dd copy of the stick and run fdisk -l on it, with the following results:

fdisk

As you can see the partition table either doesnt exist or is in an unknown format. Maybe it is just a big FAT32 disk and fdisk tries to match something to have its standard partitions.

However it says in fdisk that there is a novell partition on there - is it possible that netware is using a format that is unknown and maybe different encoding and thats why those cryptic parameters happen?

Also, how is it possible that the file names are so cryptic, but windows is still able to tell that it is e.g. an mp4 file?

My questions basically are:

  • is the USB stick rather encrypted or broken (wrong format etc)
  • what can i do to restore the "encrypted" folders?

Thanks for any input!