Comments on: And that's why you always leave a note. To eject your drive. Or something.

Question: And that's why you always leave a note. To eject your drive. Or something.

andrewcilento — Thu, 15 Nov 2012 20:08:22 -0800

A friend of mine is having an issue with her USB flash drive. I'm gonna post what she sent here; can anyone help recover her files?

In her own words:
"Ok so what happened is. My teacher needed to give me a file. So I gave him my jump drive and he dropped it on from his laptop, seemed to be fine. Today I go to use my jumpdrive and the LEXAR name for when I plug it in has changed to a bunch of random symbols. And anything that was a loose file, not in a folder has vanished. I'm a bit confused since I only travel Mac to Mac with it. Any ideas? And can I recover data?"

Possibly-important info:
-Had her check in Disk Utility, the drive is formatted as FAT32.
-We had Disk Utility try to do a Repair, and it said it completed, but her files didn't show up in Finder after.

I'm relatively new to OS X, so I'm not sure what other steps to try.

By: phaedon

phaedon — Thu, 15 Nov 2012 21:36:15 -0800

Data Rescue and Data Recovery Guru.

By: mannequito

mannequito — Thu, 15 Nov 2012 23:07:03 -0800

Have you tried plugging it into another Windows computer and then properly ejecting? If possible, the teacher's laptop.

By: flabdablet

flabdablet — Fri, 16 Nov 2012 01:24:56 -0800

We had Disk Utility try to do a Repair, and it said it completed

In general, this is a Bad Idea. The purpose of an in-place filesystem repair tool (like that one, or CHKDSK on Windows) is to render the filesystem self-consistent and stable enough for further use; it does that by making changes to the filesystem being repaired.

If, as in this instance, your filesystem has been busted by somebody else and your main aim is to recover as much undamaged data from it as you possibly can, you do not want to be making further changes to it, and filesystem repair definitely counts as further changes.

The data recovery tools linked above, and similar tools such as ZAR for Windows, work by only reading the damaged filesystem and copying whatever they can recover to a healthy filesystem elsewhere. Some of these tools will be able to piece together files that others cannot, so it's worth trying several if the first one doesn't get you back what you want.

By the way, it's this exact kind of episode that's behind my standard advice to customers not to use external drives for anything other than backing up stuff stored elsewhere. Anything that gets plugged in and out will eventually get corrupted by careless unsafe removal; nature of the beast.

By: backwards guitar

backwards guitar — Fri, 16 Nov 2012 04:01:03 -0800

Not super user friendly, but I've had luck recovering files using PhotoRec, which isn't just for photos.

By: epo

epo — Fri, 16 Nov 2012 04:29:30 -0800

Sounds like a directory block got deleted prior to updating but the drive was removed before the update happened (or the file was not fully copied before the drive was removed).

Any older files will be there you just have to find them with a recovery tool, the one from the teacher may or may not be present, easiest thing is to get it again.

As noted above, Disk Utility may have caused further 'damage' (but it is really unlikely to have overwritten data from orphaned files, it acts mainly on directory entries), reconnecting it to the teacher's machine is probably the best bet at the moment. If that doesn't help then tools to locate orphaned files may help you get your stuff back but they may also locate a lot of other unwanted stuff as well.