10

This event actually took place a few years ago, but I still have the unchanged USB flash drive in my possession. I may be out of luck, but I thought I would ask all you smart people here for your suggestions.

Short Story:

A few years back, my wife wanted to store all of her photos from her iPhone onto a USB flash drive because she was running out of storage. We picked up a brand new USB flash drive from the store, so I assume it had a FAT32 file system. We plugged the flash drive into a Mac OS X and were able to backup all of her photos. We realized after the backup had complete that almost every photo had a duplicate file. photo.jpg had a duplicate file called photo\ 1.jpg. All of the duplicate files ended with the \ 1.jpg suffix.

Just having started UNIX, I knew that I could use the shell's simple regex to remove all of the duplicate files, but I ended up not putting my command in quotes... And I ended up executing the following: rm * 1.jpg. As you can see, I told the system to remove every single file and then remove 1.jpg. Instead of telling the system to remove every file that ended in 1.jpg. After this occurred, with my furious wife (at the time girlfriend) next to me, I unplugged the flash drive and stored it in a drawer.

Question:

Are there any secure UNIX tools to recover data, that was removed with rm, from a USB flash drive? Or am I out of luck? As I stated above, I have not touched the flash drive since the event occurred.

If this question is far too broad, feel free to move it to meta or wherever it best fits.

Improve this question
5
  • I also looked into unix.stackexchange.com/a/2680/125535, but was not sure if this could help because I do not remember any strings that could have been in the photos names.
    – Peschke
    Commented Jun 6, 2016 at 22:43
  • 1
    take a look: linuxquestions.org/questions/linux-general-1/…
    – Serge
    Commented Jun 6, 2016 at 22:44
  • 1
    the essential part in the link above is to create an image of your usb and play with that image mounted with loopback device (see man losetup)
    – Serge
    Commented Jun 6, 2016 at 22:45
  • @Serge - Thank you, Serge. That link actually looks very promising, I don't know how I missed it when searching. I will create the image and look into the tools.
    – Peschke
    Commented Jun 6, 2016 at 22:48
  • 1
    also, when image is set up you probably would need to run partprobe /dev/loopX as even with -P option the losetup does not create nodes for partitions reliably
    – Serge
    Commented Jun 6, 2016 at 22:51

2 Answers 2

Reset to default
13

Are there any secure UNIX tools to recover data, that was removed with rm, from a USB flash drive?

Yes and, by the way, recovery of photos is one of the most common scenarios.

The conditions you described are actually optimal because:

  • you directly deleted the files
  • the file system is not damaged
  • you did not use the drive anymore

These conditions lead to two available options.

If you care about the file names (or have fragmented files)

When you write a lot of pictures sequentially on a drive, the risk of fragmentation is actually very low, but still. To recover files and file names you need a tool which is file-system aware.

Enter TestDisk:

sudo testdisk /dev/sdb

It will show you a step-by-step procedure through a TUI (textual user interface). The essential steps are:

  • scanning the drive
  • selecting the partition
  • pressing P to show the files
  • copying the deleted (red) files with C

If you actually just want the photos back

For pictures, you might as well not care about the names. Moreover, the file system might be damaged (not your case) and TestDisk would not help.

PhotoRec (from the same developer) comes to the rescue:

sudo photorec /dev/sdb

Here you just need to specify the output directory. You can also disable detection for some file types which you don't care about.

Improve this answer
3
  • Surely, Testdisk ist the utility of choice. Nevertheless, i recommend creating an image of the disk by dumping it to a file with "dd", then mounting the dumped file via loopdevice, and running testdisk on the loopdevice. Good Luck !
    – gerhard d.
    Commented Jun 7, 2016 at 12:17
  • 1
    @gerhardd. as long as you do not use TestDisk "repair" feature you are not writing on the device. Also, why do you need a loop device? TestDisk works just fine on a disk image, there is no need to mount it. :)
    – Andrea Lazzarotto
    Commented Jun 7, 2016 at 12:20
  • 1
    This worked perfectly, thanks! I did not want to risk messing anything up with the flash drive, so I did end up using dd to create an image of it. Everything worked out nicely.
    – Peschke
    Commented Jun 7, 2016 at 14:19
1

Yes, there are tools to recover certain deleted files. The safest way to use them is to unmount the filesystem in question as early as possible (you have already done that), then backup that filesystem to an image file and do any rescuing attempts using that image file. This is safer because you have a backup against failing hardware or a buggy rescue program. Also, this speeds up the rescuing, especially if it scans the filesystem multiple times.

For the actual rescuing, you can try the open source tools testdisk, photorec, recoverjpeg and recovermov. The last three implement a similar approach, i.e. they scan for well known file signatures. Thus, they are able to recover files even when relevant filesystem structures are badly damaged or already overwritten. The limits are when a file was fragmented by the filesystem. Despite the name, photorec is able to recognize many non-photo file signatures.

Testdisk, on the other hand, tries to recovers old partition and filesystem tables and thus may even recover the original filenames and fragmented files.

Testdisk and photorec are by the same author, thus they are usually packaged together.

Example:

ddrescue --idirect /dev/sdX usb.img usb.map
mkdir out
testdisk usb.img
photorec usb.img
mkdir recjpg
cd recjpg
recoverjpeg ../usb.img
cd ..
mkdir recmov
recovermov ../usb.img
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .