Need help restoring files lost after formatting USB Drive

  • Thread starter GTFan24
  • 13 comments
  • 728 views
4,609
Puerto Rico
Puerto Rico
MW3Fan34
Hello! Im currently in need of help regarding this issue im currently having. I was forced by Windows 10 a couple of nights ago to format my USB Drive and it caused me to lose everything i have saved on it, ive tried restoration programs but nothing has worked. If anyone here knows how to resolve this sort of situation please respond as soon as possible. :)👍
 
4,609
Puerto Rico
Puerto Rico
MW3Fan34
What programs have you used? Also is it a flash drive, ssd or hdd?

Ive used programs like Easyus but none have worked, in terms of the usb it shows up on my laptop as a D: so i think its a flash drive
 
10,340
Australia
Australia
I_IGrayfoxI_I
As in use this program without my usb attached to the laptop?

Install the program in C:\program files like normal

But if you've put anything on the flash drive, odds of recovering data go down a huge amount.
 
4,609
Puerto Rico
Puerto Rico
MW3Fan34
Install the program in C:\program files like normal

But if you've put anything on the flash drive, odds of recovering data go down a huge amount.

Oh no worries i installed it via C: like usual
 

kikie

I'm here
Premium
24,180
Belgium
in the land of stupidity
I did the same thing but lost everything on my HDD a few years back. I was reinstalling my computer and removed the DATA partitions instead of the windows partition.

I used Recuva and got almost everything back.
 

AOS-

Premium
28,684
Canada
'Sauga, ON
I've used Disk Digger for a work laptop at one point in time and it managed to pull some photos from one or two users ago (aka retrieved files even though computer was wiped once or twice).

Recuva should be able to recover files.
Just dont go using the drive.

Wait, why do you advise that?
 
20,520
United Kingdom
United Kingdom
Wait, why do you advise that?

When you delete a file what actually happens is the space occupied on the drive is freed up to be used by other files. If you start writing new files to the drive, depending on the size, you risk filling in that now unreserved space and make recovering the deleted file(s) impossible.

It's therefore always recommended to cease using any drive you want to perform recovery on for that reason. Every new write has the potential to permanently overwrite your deleted file(s).
 
10,340
Australia
Australia
I_IGrayfoxI_I
I've used Disk Digger for a work laptop at one point in time and it managed to pull some photos from one or two users ago (aka retrieved files even though computer was wiped once or twice).

There are many types of wipes that one can do
Standard Delete: this just removes the entry from the file system, but the data still exists on the disk at the sector level
Single Pass: This just 0 fills the sectors
DOD 3 Pass: This does A character, its complement, another pattern
Schneier's Algorithm 7 Pass: This does All ones, all zeros, pseudo-random sequence five times
Gutmann's Algorithm 35 Pass: This does various sequences and patterns, This is OVERKILL.

So if you dont wipe the sector, you can recover the data, even after several formats.

This site explains most techniques used
https://www.lifewire.com/data-sanitization-methods-2626133#dod-522022-m

Wait, why do you advise that?

In a nutshell, all that really happens is the location for that file in the filesystem is removed.
The file is still on the disk the space is just marked as free.

Think of it like a book.
The contents page has a list of all things in the book and what page.
The OS tells the file system those sectors are now "FREE", but if you have a program that can read each page of the book, you will find the data there.

The only caveat is if you have some sort of "Secure Delete" program that writes over the sectors as well.

Image Example
Lets say you want to delete "Summer"
upload_2021-4-2_13-43-1.png


Summer has been deleted to the OS, but the summer still exists in the book and you can only see data that is listed in the contents it looks like the file is deleted, but it still exists, using a program that will read each sector can allow you to recover that file.
upload_2021-4-2_13-52-37.png
 
Last edited:

AOS-

Premium
28,684
Canada
'Sauga, ON
When you delete a file what actually happens is the space occupied on the drive is freed up to be used by other files. If you start writing new files to the drive, depending on the size, you risk filling in that now unreserved space and make recovering the deleted file(s) impossible.

It's therefore always recommended to cease using any drive you want to perform recovery on for that reason. Every new write has the potential to permanently overwrite your deleted file(s).

I completely forgot about this. Thank you for the explanation.

There are many types of wipes that one can do
Standard Delete: this just removes the entry from the file system, but the data still exists on the disk at the sector level
Single Pass: This just 0 fills the sectors
DOD 3 Pass: This does A character, its complement, another pattern
Schneier's Algorithm 7 Pass: This does All ones, all zeros, pseudo-random sequence five times
Gutmann's Algorithm 35 Pass: This does various sequences and patterns, This is OVERKILL.

So if you dont wipe the sector, you can recover the data, even after several formats.

This site explains most techniques used
https://www.lifewire.com/data-sanitization-methods-2626133#dod-522022-m



In a nutshell, all that really happens is the location for that file in the filesystem is removed.
The file is still on the disk the space is just marked as free.

Think of it like a book.
The contents page has a list of all things in the book and what page.
The OS tells the file system those sectors are now "FREE", but if you have a program that can read each page of the book, you will find the data there.

The only caveat is if you have some sort of "Secure Delete" program that writes over the sectors as well.

Image Example
Lets say you want to delete "Summer"
View attachment 1001640

Summer has been deleted to the OS, but the summer still exists in the book and you can only see data that is listed in the contents it looks like the file is deleted, but it still exists, using a program that will read each sector can allow you to recover that file.
View attachment 1001643

That makes complete sense and thank you for taking the time to explain it with illustrated examples.
 

VBR

Woke Dissident in Exile...
Premium
7,546
England
London
I don't suppose anyone knows how to retrieve deleted files off an official Sony PS2 Memorey Card?
 
10,340
Australia
Australia
I_IGrayfoxI_I
VBR
I don't suppose anyone knows how to retrieve deleted files off an official Sony PS2 Memorey Card?
There was that hidden undelete function on a PS1, PS2 might be similar, but I think that was session based.

Recovering data of an EPROM is also more tricky.