Need to recover three doc/docx files from usb

[Mcinwwl]

Looked thru topics in here but none seemed to contain easy-to-apply solution, so posting.

Just an hour ago one of my relatives deleted 3 rather important files from pendrive. The Device is one of the 2 GB craps they share here and there for advertising purposes, and it's like 8 years old stuff, ~600Mb of free space. Files to recover are measured in kilobytes. 'Deleter' was told to stop using pendrive just after the accident so these should be able to recover.

I looked thru different reviews of free/shardeware/trial/will-install-you-tons-of-crapware recovery programs, downloaded one that seemed to be safe and tried my best. It has shown list of deleted files properly, but recovery returned only garbage files (they were saved to HDD JFYI).

I have DMDE I have downloaded some time ago, but certainly I'm to lame to do the right thing within a reasonable time. Also, pendrive is used for sharing personal data and there is no way I will publicly share it's image.

If someone can recommend some free software that contains no crapware and will do its job, I'll be pleased. Musn't be freeware in fact, 10-minutes trial should be enough.

If this requires more work with low-level tools, I'm willing to cooperate.

[jaclaz]

Well, you have DMDE, more or less is the best thing you can have for free.

Though in this particular case - maybe - Photorec would be more suitable as a direct carving solution.

In any case you can try (of course AFTER having made a dd image - or better two - and working on one of the images), to use "negative logic".

I.e. you fill each and every non-deleted files with 00's and then carve the image, when you have eliminated the impossible, whatever remains, however improbable, must be the truth .

Please note how there is a BIG difference between a .doc and a .docx file:

.doc is a (proprietary) binary format

.docx is a ZIP archive containing a number of .xml files

usually recovering at least the text from a partial .docx file is easier than from a .doc, simply because there are many tools capable of recovering or extracting contents form a partial or corrupted .zip file.

jaclaz

 

[Mcinwwl]

And yet when I told to use different pendrive (to do not overwride deleted files) it appeared to have backup of the files :>

Not to waste your time I plugged in the guilty pendrive and run Photorec. For reasons yet unknown to no one, including me, I ran command line version. I managed to recover ~590 MB of files, which had pretty random file names, but quick search using Windows Explorer tools have shown that I have recovered at least 3 of 3 files i needed. Yay! Thanks for the tool, it will come in handy later for sure.

When it comes to DMDE, it's not its time... I'll get back to it when I'll run into trouble or decide to get geekier just this day and this way.

[jaclaz]

13 hours ago, Mcinwwl said:

Not to waste your time I plugged in the guilty pendrive and run Photorec. For reasons yet unknown to no one, including me, I ran command line version. I managed to recover ~590 MB of files, which had pretty random file names, but quick search using Windows Explorer tools have shown that I have recovered at least 3 of 3 files i needed. Yay! Thanks for the tool, it will come in handy later for sure.

I would say that a good reason for having used the command line version of Photorec is that ONLY the command line version exists.

Happy you made it.

jaclaz
 

[Mcinwwl]

QPhotoRec executable offers some sort of GUI, although I only opened it and don't know if and when it will kick my face with pure CMD

[jaclaz]

Sure ,  Qphotorec is not Photorec, it is its GUI version (slightly less powerful but good nonetheless for most simple recoveries) but it has a different name (the Q is for the QT GUI libaries used).

jaclaz

 

[Mcinwwl]

Necroposting at its bes, but I need to recover some files again.

photorec is not a way to go - it goes through whole drive, and I need to recover only few small files from specific folder, that were not archived via default windows methods. I recently wiped my 1 TB HDD from old unused files, and I do not want to make it recover way too much by accident. We're just chasing for a few video game saves right now

 

 

[jaclaz]

And then your best bet is (back to the past) DMDE.

Which can create a virtual filesystem and/or re-index specific filetypes, and unlike photorec, allows to copy/extract only a selection (but of course it will need to analyze the "whole drive").

https://dmde.com/manual/datarecovery.html

Get the latest version:

https://dmde.com/download.html

jaclaz

[Mcinwwl]

Thus I run full DMDE scan on the drive, and will update the post If I get any results.

@jaclaz I must admit that this software and its UI overgrow me a bit, and attached .chm isn't best written...

Well, I helped myself with This guide  and Recahed point 5 - folder I'm looking into is empty, and parent folder have no "red dot". However, still hoping for some luck, I tried to search by extension (as I didn't know the file name after all) and DMDE finds bunch of "deleted files" and "found files" which look like matching what I need.
Including the folder path... which I just checked and was empty...

Well, so after All, IT'S WORKING and I'm getting files requested back, but it takes its time to search everything with 3 different methods and no, I do not get why I cannot find it on folder pane. I'm having a sense of mental loosage here.

Edited April 25, 2020 by Mcinwwl
New content