Data recovery for files deleted from USB drive

kushalkoolwal · 05-21-2009, 04:42 PM

Hi,

So I was in Windows XP and I deleted a video file (.wmv) from my USB drive (FAT partition) by mistake. Is it possible to recover that deleted file in Linux using some free recovery tools?

I have a Debian 5.0 as my Linux system.

pljvaldez · 05-21-2009, 07:10 PM

Depends on the format, but probably. Mount the drive READ-ONLY until you take an image. Otherwise you risk overwriting the file you want to recover. Then the steps I use are

Code:

1. aptitude install testdisk
2. Make an image of the drive using dd (i.e. dd if=/dev/sdb of=~/image.img)
3. Run photorec (part of testdisk) from the command line on the image to recover the video file

It won't be named the same, but you'll get it back as long as you didn't write anything over it.

Here's a list of the formats that can be recovered by photorec.

If the format is unsupported by photorec, you can use foremost, but you'll probably have to find the header info from a similar type of movie file and write your own rule.

kushalkoolwal · 05-21-2009, 08:14 PM

Quote:

Originally Posted by pljvaldez

Depends on the format, but probably. Mount the drive READ-ONLY until you take an image. Otherwise you risk overwriting the file you want to recover. Then the steps I use are

Code:

1. aptitude install testdisk
2. Make an image of the drive using dd (i.e. dd if=/dev/sdb of=~/image.img)
3. Run photorec (part of testdisk) from the command line on the image to recover the video file

It won't be named the same, but you'll get it back as long as you didn't write anything over it.

Here's a list of the formats that can be recovered by photorec.

If the format is unsupported by photorec, you can use foremost, but you'll probably have to find the header info from a similar type of movie file and write your own rule.

Ok thanks. I think I will try your suggestion. The format of the video file is wmv. Looks like this is not supported as per the link that you gave but in any case I will go ahead and give it a try.

kushalkoolwal · 05-21-2009, 08:26 PM

Quote:

Originally Posted by kushalkoolwal

Ok thanks. I think I will try your suggestion. The format of the video file is wmv. Looks like this is not supported as per the link that you gave but in any case I will go ahead and give it a try.

Guess what...the photorec discovered the lost file as <somenumber>.asf. First I thought it be some garbage but then when I looked at its size it showed 1/2 GB and then when I tried to play in Linux and Windows it works fine....Hurray....The file was recovered.

Wonder why Linux rename the extension from wmv to asf. Are they analogous to each other?

Thanks pljvaldez for the tip.

pljvaldez · 05-22-2009, 10:40 AM

http://en.wikipedia.org/wiki/Windows_Media_Video

pljvaldez · 05-22-2009, 10:42 AM

Quote:

Originally Posted by kushalkoolwal

Ok thanks. I think I will try your suggestion. The format of the video file is wmv. Looks like this is not supported as per the link that you gave but in any case I will go ahead and give it a try.

wmv is actually on the same line as *.asf in the file type list. Glad you got your file back!