Data Recovery from Flash Memory Devices


Flash memory devices such as USB keychain drives and cards used in digital cameras and digital music players present a unique challenge to data recovery programs. Although, from a user standpoint, these devices emulate conventional disk drives, have file allocation tables similar to those found on floppy disks, and can usually be formatted through the Windows Explorer, many data recovery programs that work well with conventional drives cannot be used to recover data from flash memory devicesespecially when the device has been formatted.

Under several conditions, data loss can occur with a flash memory device. Some of them, such as formatting of the media or deletion of one or more photos or files, can occur when the device is connected to the computer through a card reader or when the flash memory device is inserted into a digital camera. When photos are deleted, the file locations and name listings in the file allocation tables are changed in the same way as when files are deleted from magnetic media: The first character of the filename is changed to a lowercase sigma, indicating the file has been erased. Just as with magnetic media, undelete programs that support removable-media drives and the Norton Disk Editor can be used to retrieve deleted files on flash memory devices in the same way that they retrieve deleted files from magnetic media. Note that Disk Editor must be run in Read-Only mode and works best on systems running Windows 9x/Me. Data files can also be damaged if the flash memory card is removed from a device before the data-writing process is complete.

However, retrieving data from a formatted flash memory device, whether it has been formatted by a digital camera or through Windows, is much more difficult. Traditional unformat programs such as the command-line Norton Unformat program provided with Norton Utilities and Norton SystemWorks can't be used because flash memory devices are accessible only from within the Windows GUI, and command-line programs are designed to work with BIOS-compatible devices such as hard and floppy drives.

Programs that rely on the file system, such as Ontrack EasyRecovery Personal Edition Lite (incorporated into VCOM System's Suite) and Ontrack EasyRecovery Personal Edition, do not work either because the previous file system is destroyed when the flash memory devices are formatted.

Note

When a digital camera formats a flash memory card, it usually creates a folder in which photos are stored. Some cameras might also create another folder for storing drivers or other information.


If you need to recover data from a formatted flash memory device, the following programs work extremely well:

  • Ontrack EasyRecovery Professional Edition ; free evaluation and more information are available from http://www.ontrack.com

  • PhotoRescue ; free evaluation and more information are available from http://www.datarescue.com/photorescue/

Norton Disk Editor (incorporated into Norton SystemWorks and Norton SystemWorks Pro) can also be used to recover data if you can determine the starting and ending clusters used by the data stored on the device.

To recover data from a formatted flash memory card with EasyRecovery Professional Edition, the RawRecovery option (which recovers data on a sector-by-sector basis) must be used. This option bypasses the file system and can be used on all supported media types. A built-in file viewer enables you to determine whether the recovered data is readable.

PhotoRescue, which works only with standard photo image types such as JPG, BMP, and TIF, can access the media in either logical drive mode (which worked quite well in our tests) or physical drive mode. Physical mode uses a sector-by-sector recovery method somewhat similar to that used by EasyRecovery Professional Edition. PhotoRescue also displays recovered photos in a built-in viewer.

With both products, you might recover data from not just the most recent use before format, but also leftover data from previous uses. As long as the data area used by a particular file hasn't been overwritten, the data can be recoveredeven if the device has been formatted more than once.

Table 11.3 provides an overview of our results when trying to recover data from two common types of flash memory devices: a Compact Flash card used in digital cameras and a USB keychain storage device.

Table 11.3. Retrieving Lost Data from Flash Memory DevicesResults by DataRecovery Program

Device

Cause of Data Loss

Norton Utilities

Ontrack/Vcom System Suite

DataRescue Photo Rescue

Ontrack EasyRecovery Professional

Compact Flash 64MB

Deleted selected files in camera

Recovered data back to device when used with Windows 9x/Me only. [1] , [2]

Recovered data to user-specified folder. [1] , [3]

Recovered data from most recent format and from previous card uses to specified folder. [3] , [4]

RawRecovery recovered deleted files from current and previous uses; refer to Table 11.1 for limitations. [3] , [4]

Compact Flash 64MB

Deleted selected files with Windows Explorer

Recovered data back to device when used with Windows 9x/Me only. [1] , [2]

Recovered data to specified folder when used with any supported version of Windows. [3]

Recovered data from most recent format and from previous card uses to specified folder (files and folders renamed ).

DeletedRecovery recovered deleted data from current use (first character of file/folder name lost).

Compact Flash 64MB

Format in camera

Drive could not be unformatted; Disk Edit could retrieve data from current and previous uses to user-specified folder. [3] , [5] , [6]

Could not locate data. No data was recovered.

Recovered data from most recent format and from previous card uses to user-specified folder. [3] , [4]

RawRecovery recovered all readable data, including data from previous card uses to user-specified folder. [3] , [4]

Compact Flash 64MB

Format in card reader

Drive could not be unformatted; Disk Edit could retrieve data from current and previous uses. [5] , [6]

Could not locate data. No data was recovered.

Recovered data from most recent format and from previous card uses to user-specified folder. [4]

RawRecovery recovered all readable data, including data from previous card uses to user-specified folder. [4]

USB keychain drive (128MB)

Deleted folder with My Computer

Disk Edit can retrieve data from current use. [3] , [6]

Partial success: Recovered some files. [3]

Recovered photo files only. [3] , [4]

RawRecovery retrieved most files. [3] , [4]

USB keychain drive (128MB)

Formatted by Windows Explorer

Disk Edit can retrieve data from current use. [3] , [6]

Partial success: Recovered some files (folder names and structure lost). [3]

Recovered photo files only. [3] , [4]

RawRecovery retrieved most files. [3] , [4]


[1] User supplied first letter of filename during undelete process.

[2] Norton UnErase doesn't support removable-media drives in Windows NT/2000/XP.

[3] Program operates in read-only mode on the drive containing the lost data.

[4] Original file and folder names were not retained; files are numbered sequentially and might need to be renamed after recovery.

[5] Windows must be used to access flash memory devices, and Norton Unformat can't be used in a multitasking environment such as Windows.

[6] Disk Edit requires the user to manually locate the starting and ending sectors of each file and write the sectors to another drive with a user-defined filename.




Upgrading and Repairing Microsoft Windows
Upgrading and Repairing Microsoft Windows (2nd Edition)
ISBN: 0789736950
EAN: 2147483647
Year: 2005
Pages: 128

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net