thumb drive recovery - Page 2
Page 2 of 2 FirstFirst 12
Results 11 to 13 of 13

Thread: thumb drive recovery

  1. #11
    Member
    Join Date
    Feb 2003
    Posts
    96

    Re: thumb drive recovery

    Originally posted here by mnchur
    has anyone seen a tool to recover the info left on a thumb drive after it has been deleted? At first i assumed that i could simply mount it as a disk and recover using the normal tools but that does not seem to be the case. I assume that this is due to the memeroy being used in them. Does anybody know if it is simply volatile memory with a battery or if is an actual hard disc or what. I did some googling but turn up very little that is useful.
    I ran into this problem recently. If the drive is formatted fat, fat32 or ntfs you can recover the data using Easy Recovery from http://www.ontrack.com/
    Software was pricey but the data was worth it. Also, I've found many other uses since.
    PS...I know they make a Windows version, not sure if they make a Linux version.
    ][ neta1o ][

  2. #12
    Senior Member
    Join Date
    Sep 2003
    Posts
    101
    thanks i will look into that
    chown -r us ./bases

  3. #13
    Senior Member
    Join Date
    Jul 2003
    Posts
    634
    The type of memory on thumb drives is different to that of a harddisk, hard disks work using magnets and thats why sometimes there are still traces of data becuase the the polarity of all the magnetic bits hasnt been altered fully, i think thats rite (please correct me)

    thumb drives can use a variety of methods to store data, most built up around some sort of transistor and capacitor circuit, The most common form of storage on thumb drives is a serial eeprom communicating with a controller using the i2c protocol.

    flash memory uses a transistor and memory retention capactior, to store data. the word line is pulsed and a bit (1 or 0) is given to the bit line (process called Fowler-Nordheim tunneling). Im not sure but an erase is probably done my pulsing 0 to the capacitors. So depending on how the specific eeprom in your thumb drive deals with erasing stuff will depend how much stuff you get back.

    Obviously this is at the very lowest level, and if the drive does store its stuff in the eeprom using FAT32 (I dont think they do, I think the controller emmulates this..) then there are other ways to regain your data as already mentioned.

    i2c

    edit - actaully a full erased eeprom has the values 1 applied to the transistors, so everything appears as 1


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides