A teacher’s Kingston DataTraveler suddenly refused to save, delete or even format — “the disk is write-protected” — with a term’s worth of lesson plans and student records on it. The stick had no write-protect switch; its controller had failed. When the controller that runs a USB stick dies, the safest route to the data isn’t software — it’s reading the memory chip directly. We did exactly that and rebuilt the files.
A primary school teacher came to us after their Kingston DataTraveler stopped working normally. The files were still visible in Windows Explorer, but any attempt to save, edit or delete produced “the disk is write-protected”; the drive wouldn’t format, it wouldn’t accept new data, and on some computers it wasn’t recognised at all. On it were lesson plans, teaching resources and student performance records — the whole term’s work. The natural next steps people try — formatting it, running a ‘USB repair’ tool, forcing a reset — are exactly the ones that can wipe the data, so it was set aside and sent to us instead.
A few USB sticks have a physical write-protect switch, but most, including this one, don’t — so a sudden write-protected error is coming from inside the drive. Every USB stick is run by a tiny controller chip that sits between the USB port and the NAND flash memory where your files live. The controller manages everything: presenting the drive to your computer, translating addresses, correcting errors and handling worn or bad memory. When that controller detects a fault it can no longer manage — or when it partially fails or its firmware corrupts — it commonly falls back to a locked, read-only state and reports the drive as write-protected. It’s the controller protecting itself and the data, not a setting you can toggle off. And because the fault is in the controller, software running on your PC often can’t reach past it.
The important distinction in a case like this is between the controller and the memory. Diagnostics showed the controller had failed and a few NAND sectors had degraded, but the vast majority of the flash memory — where the actual files are stored — was intact. The problem wasn’t that the data was gone; it was that the only normal doorway to it, the controller, had shut. Trying to force that doorway with formatting or reset tools risks telling the controller to erase or rewrite the NAND, which is how “my files are still listed” becomes “my files are gone”. The safe approach is to bypass the failed controller entirely and read the memory itself.
To get past a dead controller we recover the data at chip level. The NAND flash chip was removed from the circuit board (a ‘chip-off’ recovery) and read directly in a specialist memory programmer, producing a raw dump of everything stored in the flash. But a raw NAND dump isn’t your files — it’s the memory exactly as the controller had arranged it, and controllers deliberately scramble and spread data for speed and wear levelling. So the dump had to be translated back into a usable image: applying the correct ECC (error-correcting codes) to fix bit errors from the degraded sectors, reversing the controller’s XOR scrambling, un-interleaving the data across the chip’s internal banks, and reconstructing the translation layer so the logical drive — and its file system — reappeared in the right order.
With the logical image reassembled, the file system was rebuilt and the teacher’s data extracted with its original names and folders. A small number of files that ran through the degraded NAND sectors were reconstructed as fully as the surviving data allowed, and every recovered document, resource and record was checked for integrity before sign-off. The complete set was written to a fresh USB drive and returned, so no term’s work was lost. The advice we sent with it is the same for every flash drive: USB sticks are convenient but fragile, their controllers can fail without warning, and a “write-protected” error is a sign to stop — not to format — so keep anything important backed up somewhere else as well.
Chip-off NAND removal and raw reading in a memory programmer · ECC bit-error correction · XOR de-scrambling, bank de-interleaving and translation-layer reconstruction · file-system rebuild and verification. Monolithic drives are read via test points where the chip can’t be removed. All work in-house at our Belfast lab.
Don’t format it or run a ‘repair’ tool — those are what erase the data. Send it in for a free, no-obligation diagnostic. We’ll tell you what can be recovered and put a fixed price in writing before any work starts, and on most jobs it’s no fix, no fee. Post it in from anywhere in the UK, or drop it to us in Belfast.
The write-protection is coming from inside the drive. The controller chip that runs the stick has detected a fault — or partially failed — and locked itself into a read-only state to protect the data. It isn’t a setting you can turn off, and because the fault is in the controller, PC software usually can’t fix it. The data is normally still on the memory chip and recoverable.
No — those are the actions most likely to lose your files. Formatting or resetting instructs the drive to erase or rewrite the memory, turning recoverable data into gone data. If a stick goes write-protected and the files matter, stop using it and have the memory read directly, which doesn’t rely on the failed controller.
Usually yes. A stick that won’t mount often has a failed controller while the NAND memory is intact. By reading the memory chip directly — or through test points on a one-piece ‘monolithic’ drive — and rebuilding the data from the raw dump, the files can be recovered even when the drive won’t appear on any computer.