Recovering Deleted Files from USB Media
It's happened to us all - you plug in a USB flash device or camera memory into a free slot in order to transfer the files from it to the hard drive when you perhaps get distracted by a phone call or email. When you come back you lose your place in what you were doing and instead of copy the wipe the memory ... ARGHHHHHHH!
Easily done, and there's no Recycle Bin for flash memory. Most people think that when you're dealing with solid state memory that when it's gone, it's gone.
No! There's a good chance that the info is still there - it's just that you can't see it!
Before you do anything else, disconnect the memory from the PC. Don't do anything crazy like save more files on there or run a scandisk or defragmenter on it - that will almost certainly make things worse. Same goes for virus scanners or anything like that. Just disconnect it and go have a up of tea!
Next, you need to find a tool that will help you with the unerase procedure. One of the best I've found is called Uneraser by DiskInternals (http://www.diskinternals.com/).
DiskInternals Uneraser can recover any deleted file, including documents, images, photos, audio files and compressed files. It can even recover deleted folders and damaged disks.
In addition to recovering hard drives, Uneraser supports any type of storage media (USB flash drives, micros drives, Compact Flash cards, SD cards and so on)! It also works with encrypted files and it can also assit you in undeleting file lost because of a virus attack.
- Standard Windows Explorer interface, with Drag and Drop support.
- Works under Microsoft® Windows 95, 98, ME, NT, 2000, XP, 2003 Server.
- Supported file systems: FAT12, FAT16, FAT32, NTFS (NT 4), NTFS5 (2000, XP).
- Supported hidden file systems: Hidden FAT12, Hidden FAT16, Hidden FAT32, Hidden NTFS
- Access to any hard disk partitions under any OS. (It is possible to recover files on NTFS under Win 9x).
- Recovers compressed files (NTFS, NTFS5).
- Recovers encrypted files (NTFS5).
- Ignores file access rights (NTFS)
- Recognizes localized names.
- Long filenames support (FAT12,FAT16,FAT32)
- Undelete folders with subfolders
- Incorporates several ways to recover a deleted file (FAT12,FAT16,FAT32)
- Correctly recovers files deleted in Windows NT, 2000, XP (FAT32)
- Original algorithm for recovering deleted folders in Windows NT, 2000, XP (FAT32)
- Recovered files can be saved on any drive visible to the host operating system, including network drives.
- Creates image files for entire hard drives, logical drives, or their part. Such image files can be processed like regular disks.
Let's see it in action!
Note: Prior to carrying out the test I used a free secure erase tool (Eraser - http://www.heidi.ie) to securely and completely wipe the drive prior to the test and between each test to make things less complicated. If you've lost files after securely wiping them then I'm afraid that chances are that they are gone forever!
I'm going to take four files and copy them onto a USB flash memory device (32 Mb Disgo). These files are:
- A text file (161 Kb)
- A Microsoft Word document (256 Kb)
- A Zip file created with WinZip - http://www.winzip.com (15 Kb)
- An executable file created with WinAce - http://www.winace.com (72 Kb)
Now, to delete them!
Now I fire up Uneraser. When the program has loaded I am presented with a list of drives, one of which is the USB drive. If I right-click on it I get a host of options.
If I choose "Open partition" I'm now presented with the deleted contents of the USB drive.
You can now clearly see the four files that were deleted. Recovery now is simple. All I need to do is right-click on the files and choose recover.
Now a new window appears, asking me for the location to save the recovered file (don't save to the drive you are recovering from - this will jeopardize recovery of other files).
Click "Save" and watch the file being recovered! I can now repeat this for the other deleted files.
Now if I take a look in the folder where I saved the files I'll see the files in there. You might find that there is more than one copy of the file recovered - this is normal and you might need to look at them to decide which is the right one.
Test successful I think!
DiskInternals Uneraser costs $34.95 and there is a free trial version for you to try out if you doubt it's power.