Printable View
has anyone seen a tool to recover the info left on a thumb drive after it has been deleted? At first i assumed that i could simply mount it as a disk and recover using the normal tools but that does not seem to be the case. I assume that this is due to the memeroy being used in them. Does anybody know if it is simply volatile memory with a battery or if is an actual hard disc or what. I did some googling but turn up very little that is useful.
The answer to your first question is: maybe
I know that there is software available to recover files deleted on multimedia memories.. ie SD, MMC, CF, mem stick and xd (well that is what I remeber the documentation saying)
the thumb drives are not a mechanical drive.. they are a flash memory.. as such a program that reads rthe raw data out of the memory and assembles is all that is needed ..
Found it:
The program I was thinking about-but may not be exactly what you are after is "Digital Image Recovery" or DIR by Alexander Grau.
I seem to have lost the url's for this one.. but do a search on Drive rescue or driverescue..Quote:
NEW! Digital Image Recovery...
What is the program 'Digital Image Recovery'?
Digital Image Recovery is a data recovery tool for digital images. The program is designed for media used by digital cameras. Common media types are:
Flash Card™, SmartMedia™, SONY Memory Stick™, IBM™ Micro Drive, Multimedia Card, Secure Digital Card and Compact disc.
sry about not having the url
cheers
you mean this website here Und3rtak3r? :)
http://63.141.194.5/dir/
looks interesting though thanks!
this looks like it is more aimed at digital cameras but i will try it and see
yes mnchur you are correct.. i suspect that this prog are looking on the media for specific signatures of the nominated files..
The Usb memory drives that I have used have all registered as being formated under the FAT32 file system.. so when the file is deleted its entry is removed from the TOC (forgive e for using a CDFS term)the file wuld still remain in the memory untill over written.. much like what happens on theHDD.. just its referance is removed.. my thought that these progs wcould be a start.. But I am looking.. I too have deleted files on USB drives and thought it would be nice to get them back..
I will report back what i find...
cheers
Another approach might be to use a tool like
"Unstoppable Copier" by Roadkil
If you have the USB drive mirrored on your HDD you can use one of dozens of tools to retrieve your data.
Just a thought?
EDIT: Just had a look at my digital camaera software and binoculars software.............they have recovery tools, but I think that they are looking for specific files and for an SD card or whatever.
Do you know anyone with a nice expensive boxed USB drive that came with a CD? there might be some recovery software on that? seems like the kind of thing they might include to justify the price?
i have the cd that came with mine but no tools for recovery could be found on it..
What OS are you using?
What was used to delete the files?
Have you tried norton disk doctor on it?
Steve
im running suse 9.0 with kde 3.2 and kernel 2.6......i used a normal delete command to get rid of the files..i have not tried norton disk doctor but i will tonite when i get a chance
Hmm,
A usb drive should be running FAT32, have you connected it to a windows machine?..........be careful, don't do it at work or the library/internet cafe without getting the OK first...........some people are rather sensitive about external devices being attached to their kit!
A lot of recovery tools will only run under windows.
Cheers
I ran into this problem recently. If the drive is formatted fat, fat32 or ntfs you can recover the data using Easy Recovery from http://www.ontrack.com/Quote:
Originally posted here by mnchur
has anyone seen a tool to recover the info left on a thumb drive after it has been deleted? At first i assumed that i could simply mount it as a disk and recover using the normal tools but that does not seem to be the case. I assume that this is due to the memeroy being used in them. Does anybody know if it is simply volatile memory with a battery or if is an actual hard disc or what. I did some googling but turn up very little that is useful.
Software was pricey but the data was worth it. Also, I've found many other uses since.
PS...I know they make a Windows version, not sure if they make a Linux version.
thanks i will look into that
The type of memory on thumb drives is different to that of a harddisk, hard disks work using magnets and thats why sometimes there are still traces of data becuase the the polarity of all the magnetic bits hasnt been altered fully, i think thats rite (please correct me)
thumb drives can use a variety of methods to store data, most built up around some sort of transistor and capacitor circuit, The most common form of storage on thumb drives is a serial eeprom communicating with a controller using the i2c protocol.
flash memory uses a transistor and memory retention capactior, to store data. the word line is pulsed and a bit (1 or 0) is given to the bit line (process called Fowler-Nordheim tunneling). Im not sure but an erase is probably done my pulsing 0 to the capacitors. So depending on how the specific eeprom in your thumb drive deals with erasing stuff will depend how much stuff you get back.
Obviously this is at the very lowest level, and if the drive does store its stuff in the eeprom using FAT32 (I dont think they do, I think the controller emmulates this..) then there are other ways to regain your data as already mentioned.
i2c
edit - actaully a full erased eeprom has the values 1 applied to the transistors, so everything appears as 1