Linux

Data recovery from a USB key

Some time ago, somebody from my work had problems  reading files from a USB memory stick. In Windows, she just got the message that the disk was not formatted and so none of the files could be accessed anymore.

I checked the disk in Linux. The kernel still found a partition on the disk, but it was not mounted automatically. I tried to mount it by hand, but that failed. Then I decided to run TestDisk, to verify the partition table was really correct. I used dd to copy the whole disk to an image file on my hard drive, because I prefer not to do these kind of experiments on the original disk: you never know it makes things worse than they are already. If that happens,you can always go back to the original situation then if you used an image. So I ran TestDisk on the image file, but it did not found anything more.

Finally I decided to try PhotoRec. I had never used this tool before, but I knew it was supposed to be able to recover pictures from corrupted memory cards from digital cameras. A memory stick is not really a memory card for a digital cameara, but in the end it’s all storage, so I guessed there was a fair chance that it could do something useful here too. So I ran this tool on the image file, and it recovered lots of files! Not only image files, but Word documents, PDF files, and others! Because the File Allocation Table was damaged on the disk, of course the original metadata (read: file names) could not be recovered, but at least it recovered a big part of the data itself.

So I can really recommend this tool. It’s not only useful for digital cameras, as the name might suggest, but can work on all kind of disks. Definitely a utility to try if you need to recover some files!