User Tools

Site Tools


When a file called USBC plus some garbage is on your filesystem, you've encountered something called a USBC bug. This usually means that a USB driver, instead of writing some files to the filesystem, wrote the USBC command itself to the filesystem. Some people may think it's a virus, which it most probably is not.

I have some experience with a USBC bug. I've encountered with some Windows USB mass storage driver for some Chinese SD card readers when you read/write a USB command (USBC), the command itself is written to the SD card, usually directly to the FAT table, which breaks the FAT filesystem, often completely.

For example, on the following image, look at the data at the offset 0x400000 (4194304, or offset 8192 in 512-byte blocks). This should be the start of the FAT partition, according to partition table. USBC has the same place where the FAT header should be. To fix it, the FAT header has to be moved up (on the image, or down when moving block numbers). For the number of blocks that have to be shifted, the USBC command itself needs to be decyphered.

I forked a repo that tried to fix it. My fork:


It worked, but it didn't work fully, I had to edit the file additionally to fix the FAT layout on the image. After manual editing (with hex editor and dd), I managed to recover lost GoPro videos.

My sample data for testing is also in Github:

These helped me a lot:

usbc_bug.txt · Last modified: 2024-04-22 15:02 by jaan

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki