file recovery from USB drive that was NOT safley ejected

English Hardware
#1

Hi

Just wondering if anyone can shed some light on this for me.

I moved a few files to external drive and confirmed they moved without a problem. However the external USB drive was accidentally unplugged soon after. On replugging it would appear that these files have disappeared. I assume this would be because the drive was not safely ejected.

Is there any way to get these files back? Or no hope?

thanks

Trent

#2

The easiest thing might be:
Try checking it for errors in a windows PC (if that’s possible for you) - is it called scandisk?

I’ve never had this before… so I’m guessing

#3

On Sat, 14 Nov 2009 07:16:01 +0000, trentmac wrote:

> Hi
>
> Just wondering if anyone can shed some light on this for me.
>
> I moved a few files to external drive and confirmed they moved without a
> problem. However the external USB drive was accidentally unplugged soon
> after. On replugging it would appear that these files have disappeared.
> I assume this would be because the drive was not safely ejected.
>
> Is there any way to get these files back? Or no hope?

From what you describe, the files hadn’t been flushed from cache to disk
yet - very little chance they can be recovered (none if the data wasn’t
actually written to the device yet).

Jim

Jim Henderson
openSUSE Forums Moderator

#4

Yeah thats what I feared Jim. It did appear that the files were copied, as they took a while to copy across. And prior to the unplug an ls -lart showed them there.

#5

Probably from the memory cache, not really on disk. The only chance, I think, is if the files were written but the drive was disconnected before the FAT (or whatever the index system is) was updated. If it’s a FAT filesystem, dosfsck -va might recover some clusters and put them the drive’s root directory. Other FS have similar tools, check the man pages.

#6

On Sat, 14 Nov 2009 07:36:01 +0000, trentmac wrote:

> And prior to the unplug an ls -lart
> showed them there.

That would probably be pulled from cache - unmounting is the way the
flush the cache (ie, sync the filesystems to disk), though you can also
trigger this with the magic SysRq key option “s” if enabled in your
kernel.

Jim

–
Jim Henderson
openSUSE Forums Moderator