I have to admit I didn't "Safetly Eject", but I have done this a million times... what gives, and how do I get my data back??

  • 1
    good luck...sounds like a failing drive to me. one little lack of safely eject could hose a file easily, but shouldn't hose the filesystem. – RobotHumans Nov 8 '10 at 18:17
  • who down voted me and why? – TheXed Nov 8 '10 at 18:32

Ubuntu doesn't "randomly format" drives, so you could make your question a bit less dramatic...

Unplugging a device with a file system on it without unmounting it is guaranteed to cause problems sooner or later, and if you are using a FAT filesystem on it, it won't easily "repair" itself like ext4 or NTFS would. But we don't know what the exact cause of your problem is in this case.

It might be useful to look in your log files (dmesg, syslog, etc.) to see if there are any error messages when you plug in the USB memory stick.

If you see read errors, then probably something is wrong with the hardware, and you want to use something like ddrescue or gddrescue to make an as-good-as-possible image of the flash drive.

If there are no read errors, it's probably "only" the filesystem that got corrupted. You can use a simple dd to make an image then. After making a backup image, you can try to fix the filesystem with fsck and see if that brings back all the files you need.

In case there are hardware problems, or a simple fsck doesn't solve the problem, you can try using tools like photorec on a disk image (which can recover not only graphics files but also a lot of other document formats).


Building on what aking said:

First things first, get a bit-for-bit copy of your USB key that you can work on. Working on the USB key directly will likely make things worse.

To make the copy insert the key and note what device it appears as in dmesg (it will be something like /dev/sd[bcdefg...]). You can then copy the whole image using dd:

dd if=/dev/sdX of=mybrokenusbkey.img

You can then poke the image file with various recovery tools to see if you can get the data off. I would install "testdisk" and use that to see if the data is recoverable.

testdisk mybrokenusbkey.img

The testdisk package comes with a specialised tool called photorec which is geared towards finding pictures. It has a fairly good success rate even if the filesystem structure is pretty hosed. It relies on the fact that most lightly used memory devices store file in sequential blocks.

However whatever you do don't try playing directly with the USB save for making the first copy of the data.

  • The testdisk package in Ubuntu seems a bit outdated. I suggest downloading version 6.12-WIP (simply extract and run). It's also needed, if you want to work on ext4 partitions. – htorque Nov 8 '10 at 19:02

Some good resources on recovering data:

There are also several live distributions that specialise in forensics and data recovery. SystemRescueCD is but one. In your case, you probably won't need it since it is just a usb key, but if it was a hard drive then you might want to keep a copy handy.

Best of luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.