Recovering erased files from a flash memory

Have you ever erased some files from a flash memory? I did that with a bunch of photos by mistake, and then realized what I had done. But not everything is lost, as you probably can recover them (as long as you haven’t formatted the memory, or copied new files on top of them).

So if that has happened to you, or in case this ever happens again to me, here is what you can do to recover them.

DISCLAIMER: this worked for me after trying a lot of things. It may work for you, but it may not. If you do this, you do it at your own risk.

So how did I got the files back?

First, I used gddrescue (which should be packaged in most distros, at least it is in Debian and derivatives) to create an image of the flash memory. gddrescue will try to create it even if the memory is damaged, skipping the damaged files.

I created the image with:
ddrescue -v /dev/sdb Recovered ddrescue.log
Where -v is verbose mode, /dev/sdb is where the memory was mounted, Recovered is the image which will be created and ddrescue.log is, as it’s name says, ddrescue’s log file, which is really useful since it can resume an image thanks to it.

And now what? Let’s use foremost to scan the image and get the recoverable files from it. From foremost’s manpage:

foremost – Recover files using their headers, footers, and data structures

I run it with:
foremost -i Recovered -o recovered_files/
foremost will put the recovered files (if any) under some subfolders in recovered_files/

And that’s it! I don’t know whether this will work for you. It did for me, so I’m posting this here in case I need it again in the future. But feel free to leave a comment saying whether it worked for you or not.

Good luck!

1 thought on “Recovering erased files from a flash memory

Leave a Reply

Your email address will not be published. Required fields are marked *