How to retrieve lost files of USB flash drive

When storing a file, the operating system first finds enough space in the File allocation table (FAT) that records all space usage, and then writes the contents of the file to the corresponding hard disk sector, and the space is already occupied in the file allocation table.　　When you delete a file, you generally do not manipulate the sectors that are occupied by the file, but simply indicate in the file allocation table which spaces can be allocated to other files for use. At this time, the actual contents of the deleted file still exist and can be restored. If you delete a file and then create a new file, the deleted file may be used by the new file, which will not restore the deleted file data. So once the file is deleted by mistake, do not write to the partition where the file is located, otherwise it is possible to overwrite the original data, resulting in the file cannot be recovered. Tip: Three stages of recovering files

1. Using Automated recovery Software

Recovery software (such as FinalData or easyrecovery, etc.) is easy to use, as instructed by the wizard.

2. Manually recover deleted data

The principle of manual recovery is to find the key content of deleted files directly on the storage device. This method is suitable for recovering files with obvious characteristics and simple structure, such as text files. If the files are large and dispersed in different locations on the disk, you also need to reorganize the documents according to the internal structure of the document in order to recover the data completely.

3. Find a professional data recovery company backup data because the data is very important, so the first to make a backup, in case of mis-operation, you can restore the USB stick to its original state. This step is important, and the USB drive does not have much capacity and the backup does not take up too much disk space. There are many tools for backing up disk data at the sector level, such as Ghost, Winhex, and Diskexplorer, which are mainly about Winhex. Winhex is a 16-file tool that can bypass the operating system's file system to directly read devices such as disks and USB drives for data recovery. Open the physical USB drive using the Open Disk command under Winhex's Tools menu.

In Winhex, the boot data of the USB flash drive is "FF", and the partition table and file system are completely lost. Select "Define Block" from the "Edit" menu and choose to start with "Beginning of File" and "End of File".

Then select "Copy Block" → "into New file" from the "Edit" menu and write the data of the entire USB stick into a file (e.g. "u.img"), and then complete the backup of the USB flash drive.

After completing the backup, the author tries to recover with the data recovery tool FinalData, Easyrecovery and Recover4all, because the USB stick capacity is very small, very quickly search a lot of files, but is not found to find the important file, it appears that only manual operation. Manual fix determine file location Ask a friend to know that the file is a mixed Word document in Chinese and English, most of it is in English and contains a small amount of English, so I decided to try to recover the file by finding the file content. Using Winhex to open the previously saved USB image file (the advantage of data recovery on the image file is that the access speed is faster than the direct access to the USB stick, but also can avoid destroying the original data. Select the "Find Text" command from the "Search" menu to search directly from the image file for the English string "control needed" contained in the text. There is currently no way to locate a file because it searches for too many string "control needed".

If you can memorize some Chinese content, searching for Chinese can avoid finding too many results. The Chinese in the Word document is encoded in Unicode, so open Notepad to enter the text contained in the article "decision", saved as a Unicode encoded file (test.txt).

Open the file "Test.txt" with Winhex, and the Beginning "FFFE" represents the order of the character encodings, so the subsequent "b351567b" is a 16-binary representation of the "decision" Unicode format.

From the Search menu in Winhex, select the "Find Hex Values" command to search for "b351567b" in the USB drive image file. Because Winhex can only display Chinese in the format of the code, Unicode format of Chinese are displayed as garbled, then how to know if the correct data is found?

Start selecting a piece of data from the search to "b351567b" and still copy to a new file (Noname.txt) from the "Edit" menu and select "Copy Block" → "Into new".

Open Notepad, select the file you just saved "Noname.txt", and then set the encoding format to "Unicode" format and then open it to see its true content, confirmed by a friend, this text is to find the file part of the content.