File Recovery

A friend called me up recently to ask about recovering data off a USB drive. He’d spent a few days putting together an important spreadsheet in Excel, only to have the drive fail when he tried to move the data from his Mac to his PC.

USB drives are incredibly useful. These days it’s nothing to get a USB drive that’s 128GB in size for $30 or $40. Astonishing. Especially considering that’s what we used to pay for 128MB in size (1/1000th) just 14 years ago. The one downside of cheap portable storage: we occasionally forget how fragile storage can be.

So, what to do? The first rule, which makes all the rest of what I’m about to write unnecessary is never, ever have just one copy of any file you don’t want to lose. Of course sometimes, as in the case with my friend, the act of making a copy is when you discover the problem.

If you don’t have a copy and need to recover the file it may be possible. Why it may be possible, even when the drive is “unreadable” has a lot to do with how storage on drives works.

All drives, whether they are hard drives, CD disks, or USB drives, have to be formatted. Formatting a drive means writing a File System to the drive. I’m going to ignore partitioning and low-level formatting here as they’re likely not relevant to a file recovery situation.

A file system is a structure that’s written to the drive that maps virtual files to physical files. So, imagine a JPG image file for example, being written to a drive. First the operating system queries the file system to see if there is room. Then if there is it looks for an open file slot. Once found it writes a portion of the file to the drive based on the physical allocation sizes. If there’s not enough room in that block, it looks for another block to write to and adds that block to the file description. And so on until the file is all written. To read it it does the reverse.

Let’s look at an analogy. Imagine you have a very large file cabinet. The drawers are small, but there are many of them. You want to store a large folder of documents. You look on the front of file cabinet looking for a drawer that’s not marked full. You find one so you start emptying your folder into that drawer. It doesn’t all fit. You write the folder name on the drawer and go looking for another empty drawer. Once you find one you empty your folder into the new drawer and go back and write the new drawer’s number on the front of the first drawer.

When you want the file, you find the first drawer and it tells you the next drawer where the rest of the file is... and so on.

Files are stored in sections all over the drive and the file system keeps track of it all. Most often when a drive becomes unreadable it’s because the file system has been corrupted. The files are still there, but the index for finding them is lost. Or to use our earlier example, the drawers are still full, but the cards describing what’s in each drawer have been lost.

File recovery software goes through each drawer and uses what’s known about different files, such as JPG files, Excel files, Word documents, etc. to build a new file structure. The new file structure lets you copy the files off again.

In this case I was able to take his USB drive and recover the files. I use an application called EaseUS Data Recovery. It has a free version which will let you recover up to 2GB worth of data. Perfect if you just need to recover a couple of photos that one of the kids accidentally deleted. The Pro version runs about $70, but is regularly on sale. Cheap compared to spending another two days of your time recreating your lost work.

This doesn’t always work. If you’ve written new files to the drive between losing your old files and trying to recover them, you may find you’ve overwritten what you want to get back. Also, sometimes the drive itself is corrupted and can simply not be read. Hopefully in those cases you have a backup. Sometimes though if you’re lucky and you have the right tools you can bring files back.