# Need very important data recovery from flash drive (overwritten)



## bindudhindsa (Mar 3, 2007)

Do we have any way to retrieve the overwritten data from a flash drive. I have very small 128mb flash drive which had very important data in it .my cousin formatted the flash drive and overwrite songs around 80mb on it. is there any software available (free or paid ) which can help me retreiving my data back. 

Thanks in advance

I have tried file scavenger but no help so far


----------



## Old Rich (May 31, 2007)

Overwriting will make recovery more difficult . . I would try GetDataBack . You can use it free to see if it can recover the files and only pay if it can


----------



## bindudhindsa (Mar 3, 2007)

Thanks Old Rich, i will try this one and will let you know if it works ..


----------



## bindudhindsa (Mar 3, 2007)

Thanks for your reply old rich, i have tried this software but unfortunately unable to retrieve the data i was looking for. it gave me same results i got from file scavenger. Do you have any other software i can try ?


----------



## Old Rich (May 31, 2007)

Bad news . . if GetDataBack could not recover it is likely a lost cause. Let's see if anyone else has an idea


----------



## bindudhindsa (Mar 3, 2007)

I keep my finger crossed till somebody else could come up with any idea. Anyways thanks for your help so far Old rich , just one question about this software getdataback , it have 2 different modes get it for NTFS and get it for FAT. when we are referring to usb flash drive , how could we know if the data was written in FAT or NTFS ?


----------



## Old Rich (May 31, 2007)

Look in Disc Management . . It should report the details of the flash drive


----------



## bindudhindsa (Mar 3, 2007)

I am away from my computer right now, i will look for that in disc management. Thanks


----------



## Excabus (Nov 3, 2010)

Assuming what your looking to recover common format files, like PDFs of Photos etc etc, I may have a little help to offer.

Download the program FTK Imager. Either version 2.9 or 3.0.1 will work.

http://accessdata.com/support/adownloads#FTKImager

Install it, etc etc.

Then download these two files and install,

(caution, I haven't verified that this copy of cygwin1.dll is legitimate or not. I now I had to download it to make my program work, and i'm willing to bet this one will work too, but if it's a sleazy virus, user beware.)

Cygwin1.dll -
cygwin1.dll - crocopat - Cygwin DLL version 1.5.22 (download latest from http://www.cygwin.com) - CrocoPat: A Tool for Simple and Efficient Relational Programming - Google Project Hosting

Foremost -
http://www.dcheeseman.com/blog/sites/default/files/Foremost 1.5.3 Cygwin Build.zip

Extract the cygwin1.dll and the foremost files into a folder of your choosing.

FTK Imager is a program that makes image files from various sources. In my field of work we use it to make exact replica copies of hard drives, thumb drives, etc etc, so we may process them for whatever we are looking for instead of working off of original evidence.

Foremost is a data carving program which I BELIEVE was originally developed by the DoD and then released to the public, it's not supported or developed anymore, but it's a nice, free, cheapy little tool for recovering popular files that have been deleted. Like pictures and whatnot.

Extract this cygwin1.dll file and the foremost files to a folder of your choosing, or to the root of your local drive. It is preferred to set a path to them or stick them in one of your system folders, but that's more technical crap we don't want to worry about right now.

I'm not sure what your technical experience level is, but I will explain the process fairly vaguely, and if you need further assistance just ask.

Make sure your USB drive is plugged in.

Run FTK Imager.

Go to file, Create disk image.










Select Physical Drive, hit next,

Select your USB storage device from the drop down menu, hit finish.

Click the add button, select Raw (DD), it is important to use raw because foremost will not be able to read compressed images. Hit next.

For the Evidence Item Information, put in whatever you want, or nothing, it doesn't matter. Click Next.

The image destination folder can be anywhere, I would suggest the root of your local drive because later we will work a little in command prompt so it's much easier to path to the root of your local drive. For the image file name, name it whatever you want. For image fragment size, enter zero. You want the entire image to be one file so foremost works properly and easily.










Click finish, it should bring you back to the add screen. You will notice your job is now in the field under Image Destination(s) You can add multiple jobs for multiple devices if you'd like, but it sounds like you have just the one device so you shouldn't need to add anymore.

Click start. Don't worry about any other options on this screen. You can uncheck verify images if you want to save time.

Now it will start, it will take a few minutes for a smaller devices, hours for larger storage devices. So go get yourself a hot pocket 

It will finish and then you can close out of all the FTK Imager stuff.

Now we need to create a folder for our files to go to after they have been carved out of your image file we just created. Put the folder somewhere easy to remember or type, I usually use the root of my drive again. I usually name the folder "out" without quotes.

So if your image is in the root of your drive and your out folder is there to, great! If not, just work with the path of wherever you put your files.

Open up a command prompt. Click start, type in CMD in the search box and press enter, or click run, then type in cmd.exe and click run or start or whatever the button says. A black screen should pop up. You can type into this.

You want to use the CD command to get to the directory of the folder or drive where you put your foremost and cygwin1.dll files.

Now we can run the command to try and recover your files!

Type,


```
foremost -i "C:\DIRECTORY\OF\YOUR\IMAGE\FILE\THANITSNAMEANDITS.EXTENSION" -o "C:\DIRECTORY\OF\YOUR\OUTPUTFOLDER"
```
If all has gone accordingly, foremost will start to run and little asterisks will start to creep across your command screen.

After your command finishes, see what files were recovered in the output folder!

This is a fairly technical, but free way to recover deleted files. Horse around with it, try to get it to work. You won't break anything, but you might make a mess on your computer. Just keep track of the path and names of the files you are working with and you should be fine.

If you understand all this, great! If you don't, ask for clarification!

For anyone else reading interested to play around with this free little tool. I would reccomend you make a copy of your pagefile.sys file which is in the root of your local drive and then carve that as your input file! Interesting things may appear!

If you get adventurous you can image an entire drive and run foremost on it. It may take awhile to image and then carve, but you will be surprised by what you may find!


----------

