Lost files on USB

[highflyer8]

Hi,

I recently placed about 3 GB worth of my university files on a USB drive. After a few days, I tried to access the files on the USB. So, I opened the 'My computer' folder, which is when I noticed that the removable drive showed '164 MB of 3.93 GB free' but there was a red bar (instead of blue) that signified the amount of space covered. I found that a little puzzling.

Anyway, I opened the USB drive to find that all my folders had become files. There was no symbol (i.e. it was empty) beside the names to indicate the program which would open the file. And each of them had 4.00 kB of space. I was in panic. And I was also surprised because although the USB had more than 3.00 GB covered, each of the folders(/files) was only 4.00 kB.

So, I clicked on Properties. Then I went to Tools to check the drive for errors. After the analysis, I found a hidden folder called FOUND.000. I found more than 5000 CHK files in it. I copied them to my Desktop, ran the Disk Defragmenter program on Windows and used Unchk to recover the data. The program recovered only the first 1192 files and a lot of them were in Winrar format (even though the original files were not). I could not recover the rest of the files.

I checked the USB drive for errors several time afterwards. After the first such analysis, FOUND.000 became a '002 File(.002)' file with 180 kB of space and all the CHK files were in FOUND.001. After the second analysis, FOUND.001 became a '001 File(.001)' file with 180 kB of space and all the CHK files were in FOUND.002. After the third analysis, FOUND.002 became a '002 File(.002)' file with 180 kB of space but none of the CHK files were in FOUND.003 (It had zero of 0 bytes of data, as I checked). The USB still showed only '164 MB of 3.93 GB free'.

I found the following after the third analysis:

"Some problems were found and fixed.

Any files that were affected by these problems were moved to a folder named "Found" on the device or disk. Your device or disk is now ready to use.

If you removed the device or disk before all files were fully written to it, parts of some files might still be missing. If so, go back to the source and recopy those files to your device or disk.

Volume Serial Number is 00D7-54A2
Windows is verifying files and folders...
Unrecoverable error in folder \FOUND.002.
File and folder verification is complete.
-240709632 bytes in 5689 recovered files.
Windows is verifying free space...
Free space verification is complete.
Windows had made corrections to the file system.

4,227,952,640 bytes total disk space.
552,960 bytes in 3 hidden folders.
184,320 bytes in 1 folders.
4,054,298,624 bytes in 5,699 files.
172,912,640 bytes available on disk.

4,096 bytes in each allocation unit.
1,032,215 total allocation units on disk.
42,215 allocation units available on disk."

This is the rundown on what I have done so far. If there is any way to recover the files intact, I must do it. (either from the CHK files, or the USB, or the hard disk becuase I cut and paste the documents onto my USB).

Could anyone please help me recover the files?

[Paul Komski]

The CHK and FOUND elements are the results of checkdisk having run to clear-up file system anomalies or corruption (such as can occur with premature removal of a USB drive). Unfortunately such a clean up is counter productive to recovering data and should never be run when data loss is a possibility.

You could try scanning the drive with GetDataBack for FAT which is about your best shot. The scanning is free and you can open any such recovered files one by one for free but must buy to copy them all in one go. Good luck and I think you will need it to have much success.

I have presumed this is a FAT partition. Most USB drives are FAT and these found elements are typical of corrupted FAT folders which are not as resilient as NTFS folders - especially when in the root of the drive. A sub-folder in another folder is more likely to be findable but under FAT there is no folder hierachy in the root of a partition. Possibly the second morrored FAT table might find the lost elements and if so GDB might work.

[mjc]

This is also very typical of removing a USB drive while it is still 'active'. It commonly occurs when the OS is not quite finished with the write operation. It may say it's done, but it has been relegated to being a background task. And this is also onq reason why you NEED to disconnect the drive using the icon at the bottom of the screen (down by the clock, usually). Until that comes back with the "It's safe to disconnect" message, the drive is still being written to and is in danger of severe file system corruption if removed.