Lost data on usb drive, because did not eject it prior un-plg. How to restore?

[Luto]

S.O.S. !
I am new user of Mac and was heavenly happy with it until I made the huge mistake to not eject the external usb drive before unplugging. I had there important documents, supposed to be safe in a back-up on that usb stick.

Next time I plugged-in the usb drive I found out all the data were lost!

Now I see on my usb drive only the main folders names, but folders are completely empty - all the sub folders and files have been lost.

I tried the same drive on a PC with Windows 7 and it showed the same, files are missing.

Can the usb drive be damaged or this is Mac's punishment for not following instructions to eject prior unplugging :-(

I tried some recovery softwares, but those found only small part of my files.

Could you recommend me a smart way or powerful software, able to recover ALL my so important info?

Thank you in advance!

[simsaladimbamba]

What recovery software did you already try, thus we don't recommend endlessly the ones you already used?

Data Rescue 3 (trial lets you scan the HDD and see, if data is recoverable, but to actually recover files, you need to buy the full version for 99 USD) or
FileSalvage (trial lets you scan the HDD and see, if data is recoverable, but to actually recover files, you need to buy the full version for 89.95 USD).
DiskDrill - lets you recover data from HFS/HFS+, FAT, NTFS & other file systems right on your Mac.

As for not properly ejecting it, the OS writes small data to any HDD at various times, if you just plugged any drive during such process, you can corrupt the data on it, or at least the file tree.

[Luto]

Many thanks for your feedback!
Data Rescue 3 does not show the file names, so I can not estimate is it worthy to pay 99$. Disc Drill (deep scan) could not find all the files as well.

Is there any software which can search for a particular file name and show if it can be recovered (before purchase) ?

I would be very grateful for your help!

[Mal]

Are the file names important to you? Look at the file sizes and types recoverable with Data Rescue. Often it will not be able to get the file names (because the directory is corrupt) but the data will be intact.

jW

[mfram]

The USB drive is not damaged. The data written to the drive is cached by the computer. It won't get written out until the drive is ejected. If you don't you eject the drive the data is never written. I doubt filesystem recovery tools will help.

[Mal]

Originally Posted by mfram

The USB drive is not damaged. The data written to the drive is cached by the computer. It won't get written out until the drive is ejected. If you don't you eject the drive the data is never written. I doubt filesystem recovery tools will help.

Huh? Where did you hear that? It's not true, btw. Data is written as the operations are performed. Nothing is done when the drive is ejected except to unmount the volume. If you pull the drive out while it's copying, then yes, the data will be damaged and not recoverable, but it has nothing to do with whether you ejected the drive or not.

jW

[blueroom]

USB Flash drives can be notoriously flakey, I'd recommend using cloud storage like DropBox in the future.
Add to that Time Machine backups to stay worry free about your data.

[Guiyon]

Originally Posted by Mal

Huh? Where did you hear that? It's not true, btw. Data is written as the operations are performed. Nothing is done when the drive is ejected except to unmount the volume. If you pull the drive out while it's copying, then yes, the data will be damaged and not recoverable, but it has nothing to do with whether you ejected the drive or not.

Not always. All modern systems will not always write the data immediately. Sometimes, they will just cache the changes in memory (to varying degrees) and write them out to the disk at a later time. If you pull the drive before this step can happen, then you get corruption. For example, if you change the behavior from 'Quick Removal' (fsync each write immediately) to 'Faster Performance' (cache writes) on Windows, you'll get the same effect.

[Mal]

Originally Posted by Guiyon

Not always. All modern systems will not always write the data immediately. Sometimes, they will just cache the changes in memory (to varying degrees) and write them out to the disk at a later time. If you pull the drive before this step can happen, then you get corruption. For example, if you change the behavior from 'Quick Removal' (fsync each write immediately) to 'Faster Performance' (cache writes) on Windows, you'll get the same effect.

The timeframe between the data being cached and the data being written is imperceptible to a human. Test it for yourself. Copy a file over to a flash drive, eject it and remove it immediately. Insert into a different computer (just to eliminate any cached copy being referenced), and you'll find the file is there. While technically you might be correct, it's an irrelevant distinction, and was not related to the issue described.

jW