Lost data on usb drive, because did not eject it prior un-plg. How to restore?

What recovery software did you already try, thus we don't recommend endlessly the ones you already used?

As for not properly ejecting it, the OS writes small data to any HDD at various times, if you just plugged any drive during such process, you can corrupt the data on it, or at least the file tree.

Are the file names important to you? Look at the file sizes and types recoverable with Data Rescue. Often it will not be able to get the file names (because the directory is corrupt) but the data will be intact.

jW

The USB drive is not damaged. The data written to the drive is cached by the computer. It won't get written out until the drive is ejected. If you don't you eject the drive the data is never written. I doubt filesystem recovery tools will help.

mfram said:

The USB drive is not damaged. The data written to the drive is cached by the computer. It won't get written out until the drive is ejected. If you don't you eject the drive the data is never written. I doubt filesystem recovery tools will help.

Click to expand...

Huh? Where did you hear that? It's not true, btw. Data is written as the operations are performed. Nothing is done when the drive is ejected except to unmount the volume. If you pull the drive out while it's copying, then yes, the data will be damaged and not recoverable, but it has nothing to do with whether you ejected the drive or not.

jW

USB Flash drives can be notoriously flakey, I'd recommend using cloud storage like DropBox in the future.
Add to that Time Machine backups to stay worry free about your data.

Mal said:

Huh? Where did you hear that? It's not true, btw. Data is written as the operations are performed. Nothing is done when the drive is ejected except to unmount the volume. If you pull the drive out while it's copying, then yes, the data will be damaged and not recoverable, but it has nothing to do with whether you ejected the drive or not.

Click to expand...

Not always. All modern systems will not always write the data immediately. Sometimes, they will just cache the changes in memory (to varying degrees) and write them out to the disk at a later time. If you pull the drive before this step can happen, then you get corruption. For example, if you change the behavior from 'Quick Removal' (fsync each write immediately) to 'Faster Performance' (cache writes) on Windows, you'll get the same effect.

Guiyon said:

Not always. All modern systems will not always write the data immediately. Sometimes, they will just cache the changes in memory (to varying degrees) and write them out to the disk at a later time. If you pull the drive before this step can happen, then you get corruption. For example, if you change the behavior from 'Quick Removal' (fsync each write immediately) to 'Faster Performance' (cache writes) on Windows, you'll get the same effect.

Click to expand...

The timeframe between the data being cached and the data being written is imperceptible to a human. Test it for yourself. Copy a file over to a flash drive, eject it and remove it immediately. Insert into a different computer (just to eliminate any cached copy being referenced), and you'll find the file is there. While technically you might be correct, it's an irrelevant distinction, and was not related to the issue described.

jW

blueroom said:

USB Flash drives can be notoriously flakey, I'd recommend using cloud storage like DropBox in the future.
Add to that Time Machine backups to stay worry free about your data.

Click to expand...

When you lost your data of USB Flash Driver, don’t worry, if you didn’t write any new contents to overwrite them, you can certainly get them back. The Data Recovery can help you with it. because the deleted data still remain in it, the Data Recovery can extract the lost data after scanning the card, you can retrieve them in a few minutes if you follow the instructions.

I'll try to help.

You seem to have access to a PC -- have you tried "Spinrite" on the PC side first? (I know nothing about it other than it's supposed to be the best of its kind on PC's)

Questions:
How MANY important documents were on the flashdrive?
One?
Two?
More?
How many?

You _might_ be able to use DataRescue (and perhaps one or two other of the "data recovery" apps) to get a _few files_ back, without having to pay the registration.

Keep in mind that all these apps work the same way. They will let you recover _one_ file in demo mode. If you download and try 3-4 different apps, you _might_ get 3-4 files back.

Also -- if you take the time to hunt down and delete each app's preference (and other related) files, the app may "forget" that it has already run once, and let you repeat the process -- thus getting back a second file. Tedious, but it could work if you only need a few files back.

Now, to address the "unmountable" part.

If nothing else works, I will explain a technique I once used in a similar situation.
WARNING: Do this at your own risk!
WARNING: This worked for me on a hard drive -- not sure if it will work on a flashdrive.

What I did:
I -REINITIALIZED- the unmountable drive. You are reading that correctly.
(IMPORANT: I DID NOT "zero out" the data -- DO NOT DO THIS)

Why I did this:
The drive wouldn't mount because the directory was corrupted in some way. Not the data on the drive, just the directory.

Re-initializing the drive replaces the old directory with a fresh one. The drive will now mount, but of course it "shows empty" because you just put a new, "clean" directory onto it. HOWEVER...

.... The actual _data_ on the drive was not damaged or replaced. Just the directory.

Then -- I was able to mount the drive on the desktop. Because it was now mounted, the data recovery app could "get to it", too. DataRescue could "look around" the directory, and "go right to the drive itself". DR found the old data, scavenged and recostructed it, and saved it to another drive.

The "re-initialize, then recover" process worked for me when it looked like nothing else would.

Again, my experience only -- do this at your own risk.

There's no guarantee you can get the data back.

Essentially, until you select "eject" there is no guarantee that OS X has actually performed any outstanding writes to disk.

If the writes have not been commited to disk at all, they won't be there to attempt to recover.

Until the point where writes have been committed, OS X (and windows for that matter) will buffer writes in cache memory to allow the application performing the operation to have better responsiveness.


So... always ensure you eject properly if it is data you actually care about that you don't have a copy of elsewhere!



edit:
thread necromancy detected...