Need help restoring files lost after formatting USB Drive

[GTFan24]

Hello! Im currently in need of help regarding this issue im currently having. I was forced by Windows 10 a couple of nights ago to format my USB Drive and it caused me to lose everything i have saved on it, ive tried restoration programs but nothing has worked. If anyone here knows how to resolve this sort of situation please respond as soon as possible. 👍

 

[Daz555]

What programs have you used? Also is it a flash drive, ssd or hdd?

 

[GTFan24]

What programs have you used? Also is it a flash drive, ssd or hdd?

Ive used programs like Easyus but none have worked, in terms of the usb it shows up on my laptop as a D: so i think its a flash drive

 

[Grayfox]

Recuva should be able to recover files.
Just dont go using the drive.

https://www.ccleaner.com/recuva/download

Use the Deep Scan option as well as any option about recovering deleted files.

 

[GTFan24]

Recuva should be able to recover files.
Just dont go using the drive.

https://www.ccleaner.com/recuva/download

Use the Deep Scan option as well as any option about recovering deleted files.

As in use this program without my usb attached to the laptop?

 

[Grayfox]

As in use this program without my usb attached to the laptop?

Install the program in C:\program files like normal

But if you've put anything on the flash drive, odds of recovering data go down a huge amount.

 

[GTFan24]

Install the program in C:\program files like normal

But if you've put anything on the flash drive, odds of recovering data go down a huge amount.

Oh no worries i installed it via C: like usual

 

[kikie]

I did the same thing but lost everything on my HDD a few years back. I was reinstalling my computer and removed the DATA partitions instead of the windows partition.

I used Recuva and got almost everything back.

 

[AOS-]

I've used Disk Digger for a work laptop at one point in time and it managed to pull some photos from one or two users ago (aka retrieved files even though computer was wiped once or twice).

Recuva should be able to recover files.
Just dont go using the drive.

Wait, why do you advise that?

 

[Samus]

Wait, why do you advise that?

When you delete a file what actually happens is the space occupied on the drive is freed up to be used by other files. If you start writing new files to the drive, depending on the size, you risk filling in that now unreserved space and make recovering the deleted file(s) impossible.

It's therefore always recommended to cease using any drive you want to perform recovery on for that reason. Every new write has the potential to permanently overwrite your deleted file(s).

 

[Grayfox]

I've used Disk Digger for a work laptop at one point in time and it managed to pull some photos from one or two users ago (aka retrieved files even though computer was wiped once or twice).

There are many types of wipes that one can do
Standard Delete: this just removes the entry from the file system, but the data still exists on the disk at the sector level
Single Pass: This just 0 fills the sectors
DOD 3 Pass: This does A character, its complement, another pattern
Schneier's Algorithm 7 Pass: This does All ones, all zeros, pseudo-random sequence five times
Gutmann's Algorithm 35 Pass: This does various sequences and patterns, This is OVERKILL.

So if you dont wipe the sector, you can recover the data, even after several formats.

This site explains most techniques used
https://www.lifewire.com/data-sanitization-methods-2626133#dod-522022-m

Wait, why do you advise that?

In a nutshell, all that really happens is the location for that file in the filesystem is removed.
The file is still on the disk the space is just marked as free.

Think of it like a book.
The contents page has a list of all things in the book and what page.
The OS tells the file system those sectors are now "FREE", but if you have a program that can read each page of the book, you will find the data there.

The only caveat is if you have some sort of "Secure Delete" program that writes over the sectors as well.

Image Example
Lets say you want to delete "Summer"

Summer has been deleted to the OS, but the summer still exists in the book and you can only see data that is listed in the contents it looks like the file is deleted, but it still exists, using a program that will read each sector can allow you to recover that file.

 

[AOS-]

When you delete a file what actually happens is the space occupied on the drive is freed up to be used by other files. If you start writing new files to the drive, depending on the size, you risk filling in that now unreserved space and make recovering the deleted file(s) impossible.

It's therefore always recommended to cease using any drive you want to perform recovery on for that reason. Every new write has the potential to permanently overwrite your deleted file(s).

I completely forgot about this. Thank you for the explanation.

There are many types of wipes that one can do
Standard Delete: this just removes the entry from the file system, but the data still exists on the disk at the sector level
Single Pass: This just 0 fills the sectors
DOD 3 Pass: This does A character, its complement, another pattern
Schneier's Algorithm 7 Pass: This does All ones, all zeros, pseudo-random sequence five times
Gutmann's Algorithm 35 Pass: This does various sequences and patterns, This is OVERKILL.

So if you dont wipe the sector, you can recover the data, even after several formats.

This site explains most techniques used
https://www.lifewire.com/data-sanitization-methods-2626133#dod-522022-m



In a nutshell, all that really happens is the location for that file in the filesystem is removed.
The file is still on the disk the space is just marked as free.

Think of it like a book.
The contents page has a list of all things in the book and what page.
The OS tells the file system those sectors are now "FREE", but if you have a program that can read each page of the book, you will find the data there.

The only caveat is if you have some sort of "Secure Delete" program that writes over the sectors as well.

Image Example
Lets say you want to delete "Summer"
View attachment 1001640

Summer has been deleted to the OS, but the summer still exists in the book and you can only see data that is listed in the contents it looks like the file is deleted, but it still exists, using a program that will read each sector can allow you to recover that file.
View attachment 1001643

That makes complete sense and thank you for taking the time to explain it with illustrated examples.

 

[VBR]

I don't suppose anyone knows how to retrieve deleted files off an official Sony PS2 Memorey Card?

 

[Grayfox]

I don't suppose anyone knows how to retrieve deleted files off an official Sony PS2 Memorey Card?

There was that hidden undelete function on a PS1, PS2 might be similar, but I think that was session based.

Recovering data of an EPROM is also more tricky.