How can I safely recover deleted data from a USB flash drive?
Are there any secure UNIX tools to recover data, that was removed with
rm
, from a USB flash drive?
Yes and, by the way, recovery of photos is one of the most common scenarios.
The conditions you described are actually optimal because:
- you directly deleted the files
- the file system is not damaged
- you did not use the drive anymore
These conditions lead to two available options.
If you care about the file names (or have fragmented files)
When you write a lot of pictures sequentially on a drive, the risk of fragmentation is actually very low, but still. To recover files and file names you need a tool which is file-system aware.
Enter TestDisk:
sudo testdisk /dev/sdb
It will show you a step-by-step procedure through a TUI (textual user interface). The essential steps are:
- scanning the drive
- selecting the partition
- pressing P to show the files
- copying the deleted (red) files with C
If you actually just want the photos back
For pictures, you might as well not care about the names. Moreover, the file system might be damaged (not your case) and TestDisk would not help.
PhotoRec (from the same developer) comes to the rescue:
sudo photorec /dev/sdb
Here you just need to specify the output directory. You can also disable detection for some file types which you don't care about.