Analyzing possible encrypted USB stick

Question

I was given an USB stick which was used to secure some data from a work computer. However - the USB stick seems broken now, or encrypted, which would mean the information might be lost.

So, when connecting the USB stick to a computer the following files are being seen:

I had to blacken some titles cause of the privacy of the USB stick owner. As you can see (green arrows) there are normal folders as well as "encrypted" ones on the USB stick (also the the black files can be opened and viewed).

My initial thought was that something encrypted the USB stick - but I thought it was odd that only half of the files are encrypted.

I made a dd copy of the stick and ran fdisk -l on it, with the following results:

As you can see the partition table either doesnt exist or is in an unknown format. Maybe it is just a big FAT32 disk and fdisk tries to match something to have its standard partitions.

However it says in fdisk that there is a novell partition on there - is it possible that netware is using a format that is unknown and maybe different encoding and thats why those cryptic parameters happen?

Also, how is it possible that the file names are so cryptic, but windows is still able to tell that it is e.g. an mp4 file?

My questions basically are:

• Is the USB stick rather encrypted or broken (wrong format etc)?
• What can I do to restore the "encrypted" folders?

Answer 1

Occasionally, Windows will format the entire device as a FAT or NTFS volume. You can try mounting it (/dev/sdb) instead of looking for a partition on it. That might explain the incorrect partition layout.

As for the filenames, I had a flash drive get corrupted (possibly due to removing it during a write) and it ended up with similar filenames and it had filesizes that aren't possible. If it is a FAT32 device then it could be a damaged FAT.

For the mp4 file, Windows detects files by filename, so it probably just happened to have a .mp4 filename in the random gibberish that the name turned into.