HELP pls - rescue data from usb

[andy chung]

Have copied lot of photos from windows to 32gb usb. planning to put them onto my linux.
but now majority of files are not showing in usb. worse is that the original files have been removed from windows.

df tells that 6gb has been used up and 26gb left in usb. however only some of the files (500 mb) show and could be copied to linux.

hope that the files are still somewhere in usb. am thinking to try,

Code: Select all

dd_rescue /dev/sdb1 /dev/sda5/backup.img        --- hope to create an image file in root folder
fsck -y /dev/sda5/backup.img        ---- hope to repair the image file
mount /dev/sda5/backup.img /mnt/recoverydata              --- hope that all my files in usb would appear in /mnt/recoverydata

Unluckily I am noob to linux and unsure if the above steps are correct.
Advice appreciated. Tks.

[Mark Phelps]

When you say USB, I presume you mean "stick" not "hard drive", right?

If that's true, then I have bad news -- the data is probably gone. I've gone through USB stick after another on my Android phones -- which seem to "eat" them. Since they were formatted by default to FAT32, I tried various (and expensive!) data recovery apps to get the photos and videos back -- without any success at all.

If you feel like experimenting and have access to a Windows PC, you could try installing the trial version of data recovery apps from Runtime Software (they are among the best out there) and seeing if they find anything. They will let you search and discover files for free, just not save them to another drive or media. You have to purchase a license (on line) for that.

[daveinuk]

How was the us stick (if it was a stick?) formatted?? Have you tried ctrl+h to see any hidden files/trash on the stick on linux? If it's showing near 6gb used something is on there . . . .
there are a number of recovery app's you can install in the package manager, I'd try everthing you can find first.
What can you see if the drive's plugged back into your windows machine?

[Mute Ant]

dd_rescue /dev/sdb1 /dev/sda5/backup.img

This is a nasty case of file-looks-like-a-device...bad bad naughty. If you want to dump a partition as a file it's just...
dd if=/dev/sdb1 of=backup.img
It's not wrong as such, just nasty. Try it on a system that really has a /dev/sda5 block device and it won't work [bad] or it will work [worse].

The ddrescue command is for source devices that have almost-readable blocks, like a scratched dvd. It won't hurt, but it won't help much either.

I would explicitly use dosfsck, you please yourself.

The desktop won't help you look inside the img, so yes you need something like...
mkdir IMG
mount backup.img IMG
...or on older systems...
mount -o loop -t vfat backup.img IMG
...and then it behaves just like a folder until you unmount it or reboot.

[pgmer6809]

Google is your friend.
try this link:
http://www.recover-files.de/undelete-jpg-photos.html

There is a guy who has made some very nice file recovery software.
I think this is it. It was originally designed to un-delete photos, but it works with all kinds of files.

If you have not written anything to your USB stick since it 'lost' the files, you might have a chance.
Ditto if you have not written to your windows partition since then.

You can also google 'recover jpeg' and get to this link:
https://www.raymond.cc/blog/repair-and- ... -images/2/
Where it describes a free tool called file repair.

good luck.
pgmer6809

[Mark Phelps]

Unfortunately, that "... corrupted image..." link is very disappointing as it states:

We found it a bit disappointing to see the only free tool here couldn’t recover anything whatsoever,

That mirrors my experience in using a variety of tools, NONE of which actually were able to rescue data from a USB stick.

[Mute Ant]

Mending an ordinary JPG is amazingly difficult because it is compressed twice, rather like a zipped mp3. I would concentrate on duplicating the original USB device without trying to make sense of the contents, first. You could try 'forensic data recovery' in a google search, reading data without damaging evidence is very similar to what you are trying to do.