Originally posted here by mnchur has anyone seen a tool to recover the info left on a thumb drive after it has been deleted? At first i assumed that i could simply mount it as a disk and recover using the normal tools but that does not seem to be the case. I assume that this is due to the memeroy being used in them. Does anybody know if it is simply volatile memory with a battery or if is an actual hard disc or what. I did some googling but turn up very little that is useful.
I ran into this problem recently. If the drive is formatted fat, fat32 or ntfs you can recover the data using Easy Recovery from http://www.ontrack.com/
Software was pricey but the data was worth it. Also, I've found many other uses since.
PS...I know they make a Windows version, not sure if they make a Linux version.
April 22nd, 2004, 03:47 AM
thanks i will look into that
April 22nd, 2004, 02:39 PM
The type of memory on thumb drives is different to that of a harddisk, hard disks work using magnets and thats why sometimes there are still traces of data becuase the the polarity of all the magnetic bits hasnt been altered fully, i think thats rite (please correct me)
thumb drives can use a variety of methods to store data, most built up around some sort of transistor and capacitor circuit, The most common form of storage on thumb drives is a serial eeprom communicating with a controller using the i2c protocol.
flash memory uses a transistor and memory retention capactior, to store data. the word line is pulsed and a bit (1 or 0) is given to the bit line (process called Fowler-Nordheim tunneling). Im not sure but an erase is probably done my pulsing 0 to the capacitors. So depending on how the specific eeprom in your thumb drive deals with erasing stuff will depend how much stuff you get back.
Obviously this is at the very lowest level, and if the drive does store its stuff in the eeprom using FAT32 (I dont think they do, I think the controller emmulates this..) then there are other ways to regain your data as already mentioned.
edit - actaully a full erased eeprom has the values 1 applied to the transistors, so everything appears as 1