Computing desk
< September 11	<< Aug \| September \| Oct >>	September 13 >

Welcome to the Wikipedia Computing Reference Desk Archives
The page you are currently viewing is an archive page. While you can leave answers for any questions shown below, please ask new questions on one of the current reference desk pages.

September 12[edit]

I accidentally deleted 10 files on my USB memory/storage chip by overriding their names. Are they lost for good, or are they retrieveable?[edit]

I accidentally deleted some files on a Lexar USB memory/storage chip by changing the filenames of some other files to the name of already existing ones and then I overid them. It was a stupid and clumsy mistake.

Since they were overriden with the same name by other files they did not go to into the trash (recycle bin). in fact, I think they probably wouldn't have either way, since they were only stored on the USB chip and not on the PC itself.

Is there any way I can retrieve the files? There were only 10 files, I believe, so if they still exist and can be found, it shouldn't be a problem to restore them one at the time, I think. I'm no ace on computers, but if it can be done with relative ease, then maybe I can do it, with some guidance.

Thank You Krikkert7 (talk) 19:03, 12 September 2019 (UTC)[reply]

It will very much depend upon your operating system and the filesystem in use. For hard disks the advice is to connect them unmounted and use a block-by-block copy utility to make an image of the disk before trying any recovery. I suspect that this advice is valid for memory sticks, but do not have a firm statement confirming that - in other words, proceed at your own risk. The standard tool on Linux and UNIX systems is dd(1). At a presentation on security that I attended recently we were told: "Create the image with dd. Windows is not forensically safe.", you are effectively doing forensics here. Once you've made a copy, remove the stick and don't connect it again. Work on a copy of the online copy, if you screw up you just make another copy! Try sleuthkit as a starting point. The bad news is that recovering deleted files is rarely "done with relative ease". Martin of Sheffield (talk) 19:30, 12 September 2019 (UTC)[reply]

@Martin of Sheffield: Would ddrescue be better than dd (on a *nix system)? Poveglia (talk) 20:23, 12 September 2019 (UTC)[reply]

Good point, the new kid on the block! I've personally not used it, but the write-ups seem positive, particularly for hard disks which may be failing. In this case though the copy should be clean since we are not dealing with failing disks and head crashes. Martin of Sheffield (talk) 21:09, 12 September 2019 (UTC)[reply]

I can vouch for the fact that ddrescue works but I haven't had a reason to try dd yet (and I thank all deities for that). Poveglia (talk) 21:40, 12 September 2019 (UTC)[reply]

@Krikkert7: In the past there was a suite of Norton utilities that would show you deleted files and let you recover all or parts of them. You could check to see if that product or something similar still exists. I agree with the above advice to work on a copy if possible. RudolfRed (talk) 20:00, 12 September 2019 (UTC)[reply]

Like Martin said, first its important to make a proper copy. We have a long list of data recovery software. I'd imagine Recuva has a large marketshare amongst windows users because it was created by the same company who make CCleaner. Only run the data recovery software on the copy, not on the original! Poveglia (talk) 20:20, 12 September 2019 (UTC)[reply]

Yeah it's probably not a big deal to use a file recovery tool to get the files back, especially if you can tolerate some file corruption (e.g. the file was a document you were working on, and a paragraph got clobbered but the rest is intact). Maybe someone can suggest specific ones. I used to know of a few but their names aren't coming to mind right now. 173.228.123.207 (talk) 20:21, 12 September 2019 (UTC)[reply]

If this is Windows, I would also suggest Recuva. Provided that you don't modify anything on the USB drive, I wouldn't even bother copying this first. Just run Recuva and let it do its thing, but recover the files to an area on your normal disk, not the USB drive.

If you knew how to make an appropriate bitwise copy which was itself recoverable, you wouldn't be asking me for advice. Andy Dingley (talk) 20:39, 12 September 2019 (UTC)[reply]

@Andy Dingley: Are there no easy to use Windows programs that can do that? I wouldn't be surprised if something like the HDD Raw Copy Tool would work. Another less-desirable option would be AOMEI Backupper Standard or even EaseUS Todo Backup. Poveglia (talk) 21:30, 12 September 2019 (UTC)[reply]

Recuva's about as easy as it gets. Andy Dingley (talk) 00:08, 13 September 2019 (UTC)[reply]

I know, I mentioned it above and I've used it in the past. I meant easy-to-use Windows programs that can make a "raw" copy of 1 usb stick and write it to another. Poveglia (talk) 00:35, 13 September 2019 (UTC)[reply]

If the user already happens to have Linux installed somewhere I'd absolutely recommend ddrescue first and Recuva second, there's no drawbacks to using ddrescue, while every minute the drive is mounted in Windows gives the OS extra chance to meddle and overwrite unallocated space. If the user doesn't have Linux then yeah just do Recuva. 93.136.122.4 (talk) 19:23, 13 September 2019 (UTC)[reply]

Thank you, guys. That was a lot more response than I expected. I'll try Recuva. It sounds like it might be the easiest thing to use. I have used/edited a few files since the accident, however. Not that many, but the point is that the USB has not been left untouched since the accident, if that matters... Krikkert7 (talk) 10:05, 13 September 2019 (UTC)[reply]

Yes, a rule of thumb in forensic data recovery is that the more a device is used after the data loss, the more difficult it may be to recover anything. In the future (other than keeping meticulous backup copies of your personal files, storing some off-site, and testing your restore and recovery procedures) the best thing to do might be to yank the USB drive ASAP, rather than a "safe removal" which would flush the write cache and nail the coffin shut.

I found a couple of good articles:

Best Free Data Recovery Software (Recuva is #1)
Restore Accidentally Deleted Files with Recuva
How to Recover a Deleted file: the Ultimate Guide (good stuff for noobs in here).

Our instructor sent us to HowToGeek when I was studying for the CompTIA A+ certification. It's a great source. Elizium23 (talk) 11:50, 13 September 2019 (UTC)[reply]