How to Recover Lost Files From a USBby Chad Anderson
When files have been permanently deleted from a USB pen drive, recovery is nearly impossible without a specialized application. These applications, called file carvers, are digital forensics tools used by experts and law enforcement to recover deleted data from the remnants on digital storage devices. Files are never truly deleted from a magnetic drive unless they have been written over.
Download and install PhotoRec from the CGSecurity website. Double-click the archive to extract the application to your machine. Launch a console window on your system. On Microsoft Windows, this can be done by typing "cmd" into the search box and pressing the "Enter" key. For Mac OS X or GNU/Linux, use one of the terminal shortcuts in the applications list.
Plug your USB drive into the machine and wait for your machine to recognize it. Use the "cd" command to change directories until you are in the directory containing the PhotoRec application. Type "photorec" to launch the application. Use the arrow keys to select the USB drive you want to recover files from.
Press "Enter" on the next screen as PhotoRec will automatically detect the USB drive's partition table type. Use the arrow keys to select the partition you want to recover files from on the USB drive, then highlight the "Search" button and press the "Enter" key. Press "Enter" on the next screen as PhotoRec will automatically detect the file system type.
Use the arrow keys to select the "Whole" option from the list, then press the "Enter" key. Use the arrow keys combined with "Enter" to select where you want to save the recovered files. Press "Y" when you have chosen a suitable destination. PhotoRec will inform you when the operation is complete.
Download and install Foremost using your distribution's package management system. Attach the USB drive to your computer. If your chosen desktop environment does not automatically recognize and mount the device, then you may need to use the "mount" command to prompt recognition.
Type the "su" command, then enter the root password to become the super user on your machine.
Type "foremost -i /dev/USB -o /home/user/recovery" where "/dev/USB" is the name of the USB drive found by running the "fdisk -l" command and "/home/user/recovery/" is the location of your recovery directory.
Download and install Scalpel for your operating system. Microsoft Windows requires some elaborate work so another solution may be preferable, but both Mac OS X and Linux have pre-configured packages.
Edit the "scalpel.conf" file using your preferred text editor. This file is usually located under "/etc/scalpel" on UNIX-like systems or in the main Scalpel directory under Microsoft Windows.
Remove the preceding "#" before any file type you want to recover. This allows you to specify images or Microsoft Office documents.
Use the "su" command to become the super user. Type "scalpel /dev/USB -o /home/user/recovery" where "/dev/USB" is the name of the USB drive and "/home/user/recovery" is the location to save the recovered files.
- When using a file-carving application to recover lost files from a hard drive, make sure to save the recovered files to a partition or hard drive other than the one being recovered from. The reason for this is that recovered files may write over the files being recovered, making it impossible for PhotoRec to complete the recovery process.