Tips to help you recover a U disk mistakenly deleted files

We use the U disk when some important documents are lost for no reason or by their own mistakenly deleted, or some accidents caused the loss. Whatever the reason we don't want to see. So there are a few ways to get these lost files back.

When storing a file, the operating system first finds enough space in the File allocation table (FAT) to record all space usage, and then writes the contents of the file to the corresponding hard disk sector, and the space is already occupied in the file allocation table.　　When you delete a file, you generally do not manipulate the sectors that the file occupies, but simply indicate in the file allocation table which space can be allocated to other files. At this time, the actual content of the deleted file still exists and can be restored. If you delete a file and then create a new file, the deleted file will be occupied by the sector is likely to be used by the new file, this time can not recover the deleted file data. So once the file has been mistakenly deleted, do not write to the partition where the file is located, otherwise it is possible to overwrite the original data, resulting in the file can not be restored. Small knowledge: Three stages of recovering files

1. Using Automated recovery Software

Recovery software (such as FinalData or easyrecovery) is simple to use, as instructed by the wizard.

2. Manually recover deleted data

The principle of manual recovery is to find the key content of the deleted file directly on the storage device. This approach is suitable for recovering files that have distinct characteristics and are simple in structure, such as text files. If the files are large and dispersed across different locations on the disk, you will need to rearrange the documents based on the internal structure of the document to recover the data thoroughly.

3. Find a professional data recovery company backup data because the data is very important, so first to backup, in the event of Misoperation, you can also restore the U disk to the original state. This step is very important, and U disk capacity is not large, backup will not occupy too much disk space. There are a number of tools for sector-level backup to disk data, such as Ghost, Winhex, and Diskexplorer, which are described in the following main Winhex. Winhex is a 16-in-file tool that can bypass the operating system's file system to directly read the disk and USB drive devices such as data recovery. Use the "open Disk" command under Winhex's "Tools" menu to open the physical USB drive.

In the Winhex see the U disk boot data is all "FF", the partition table and file system completely lost. Select Define Block from the Edit menu and start with "beginning of File" and "End of file".

Then from the "Edit" menu, choose "Copy block" → "into New file", the entire U disk data into a file (such as "u.img"), so that you complete the backup of U disk.

After the completion of the backup, the author tried to use data recovery tools FinalData, Easyrecovery and Recover4all to recover, because the U disk capacity is very small, quickly search out a lot of files, but is not found to find the important document, it seems only manual operation. Manual fix determine file location Ask a friend to know that the file is a mixed Word document in Chinese and English, most of it is in Mandarin, contains a small amount of English, so I decided to find the contents of the file to try to recover the file. Use Winhex to open the previously saved U disk image file (the benefit of data recovery on the mirror file is faster than direct access to the U disk, but also to avoid destroying the original data.) Select the Find text command on the Search menu to search for the English string "control needed" contained in the text directly from the mirrored file. The file cannot be positioned at this time because it has searched too many string "control needed".

If you can memorize part of Chinese content, searching for Chinese can avoid finding too many results. The Chinese in the Word document is encoded in Unicode, so open Notepad to enter the "decision" of the text contained in the article, and save as a Unicode-encoded file (test.txt).

With Winhex Open the file "Test.txt", the beginning of "FFFE" represents the order of character encoding, so the subsequent "b351567b" is the "decision" of the Unicode format of the 16 binary representation.

Select "Find Hex Values" from Winhex's "Search" menu and search for "b351567b" in the U-disk image file. Because Winhex can only display Chinese in the format of the code, the Chinese in Unicode format is garbled, so how do you know if you found the correct data?

Select a piece of data from the search to "b351567b" and still copy the "copy block" → "into new file" from the "Edit" menu (noname.txt).

Open Notepad, select the file you just saved "Noname.txt", and then set the encoding format to "Unicode" format and then open it to see its true content, confirmed by friends, this text is to find a part of the file.