You are on page 1of 10

Flash Memory Data Recovery and Protection

Stuck with lost data on a USB memory key or Flash card and don't know what to do? Recovering data from flash memory devices is possible, and not too complex, so follow along and we'll help you get those pictures back! - Version 1.3.0
The flash memory-based USB key has become commonplace faster than just about any other computer peripheral in recent memory. It was only three years ago that a 32 or 64MB USB flash memory key was a rare and interesting item that would easily set you back a couple of hundred dollars. Now they are affordable enough that almost everyone who uses a computer has one. They've become boring and reliable, just like floppies and CDs before them. Flash memory devices have few major advantages over other forms of portable storage which easily account for their popularity. They have far greater capacity and access speed than the now antique (but not quite extinct) floppy disk, and are much more durable than either floppies or CDs. With the USB drivers now built into recent versions of Windows and other operating systems like Linux, they function just like a little portable hard disk, without the bulk and fragility associated with mechanical portable drives. In short, they're just about perfect. Just about...? That's right. Despite all their obvious advantages, USB drives and other flash memory devices like compact flash and SD cards are not without some problems and pitfalls of their own. In this Beginners Guide, PCSTATS is going to look at how flash memory works, what can go wrong with it, and how to recover and protect your data in case the worst does happen. What's special about Flash Memory? Flash memory's defining characteristic is its non-volatile nature. Traditional dynamic (volatile) computer memory needs a constant electrical charge in order to retain data, but the various types of flash memory do not. Like the EEPROM chips used to store computer motherboard BIOS information, flash memory needs electricity to write or read data from its banks, but retains the data when the current is gone. This makes it invaluable for use in portable devices with power constraints. This characteristic is achieved by using transistors as data storage devices. The transistors within flash memory can be induced to change their state (from a '1' value to a '0' value and vice-versa) with electrical current, but will retain that state in the absence of electrical current.

Almost all modern flash memory devices use NAND flash memory, named for the internal logic arrangement of its memory chips. NAND flash chips are extremely compact and capable of fast read/write operations. A typical NAND flash memory device will contain one or more memory chips, very similar in appearance to those seen on memory modules or videocards, and a controller which handles the mediation between the memory and the interface connecting it to other devices. Almost all flash memory uses either the FAT-16 or FAT-32 file system, depending on the size of the drives. 'Card' based flash devices tend to use FAT 16, while USB memory keys are generally FAT 32. Most digital cameras and other devices will not read FAT 32 formatted flash memory. It may surprise you to know that FAT-16 is the exact same file system that has been used on floppy disks since time immemorial. No wonder the average PC finds it easy to read and write from flash devices... Once the USB drivers have done their work, it's essentially just a big floppy disk. Like all FAT formatted devices (FAT is a file system often used on hard disk drives), flash devices must contain a Master Boot Record (MBR), Boot Sector (BS) and File Allocation Table (FAT). 32

The File Allocation Table contains a list of the files on the flash memory device, their sizes and their actual location in memory. Anything reading from or writing to the device must read and update the FAT each time. Anything damaging the FAT causes serious data integrity issues for the device, which is why two copies are always present in different areas of the device's memory. The Perils of Portable Memory Let's take a quick look at the various things that can go drastically wrong with your flash memory devices and the data on them, in order of most to least likely. Unsurprisingly, the most common cause of lost data when considering Flash memory-based devices (or any other computer storage medium for that matter) is you. Whether it's your three-year-old playing 1000 monkeys on the keyboard, or you not being at your best at 3AM, mistakes happen. Fortunately, accidentally deleted files are just as easy to recover from flash media as they are from any other type of data storage , so this is a comparatively easy problem to recover from.

A second source of 'missing' data on portable flash devices stems from older USBcompatible operating systems like Windows 2000. Some iterations of this OS require portable drives to be stopped and ejected via the 'safely remove hardware' wizard before any data is actually written to them. When data is copied onto the portable media in this situation, Windows will show that it has been copied, but will actually keep a log of the intended data transfer without carrying it out. When a user 'properly' removes a portable drive through the remove hardware dialog, the logged data transfer will be actually performed and the files transferred to the device.

Trouble arises when users simply yank the USB media out of the computer without using the safely remove hardware option. The intended file transfer is never actually carried out and the files will not be present on the device, even though they appeared to be transferred there while it was attached to the computer. Fortunately, Windows XP does not generally suffer from this issue, but it's a good idea to use the remove hardware dialog when you want to be absolutely sure. Flash Data Loss... or Theft Next to accidental deletion, the most common way to lose data from any kind of portable memory device is to lose the device itself. The best data recovery tools in the world won't help if the flash drive has dropped from one's pocket onto the sidewalk. Data recovery is out of the question here, but there are steps you can take to ensure that valuable data is useless to whoever eventually finds the your former possession.

Many USB drives will come pre-installed with data encryption programs, so that partitions can be set up on the device for secure and non-secure file storage. Major companies like Kingston, Crucial and SanDisk usually offer such extra's at no charge with their products, small manufacturers selling USB memory may not. Data Corruption Almost all flash memory devices use some form of 'hot pluggable' interface to connect them with the various electronic devices they support. Hot pluggable means that the memory can be attached and removed from a powered-on device without fear of damage or hardware failure. USB is the most obvious example of this technology, and one that we are all familiar with. The one problem with this type of interface is the sense of invulnerability it engenders in the user. We become so accustomed to inserting and removing our flash memory devices at will that we often forget to make sure that all data transfer tasks have stopped first. There is no surer way to mess up a portable storage device than to yank it out of its socket when it is halfway through an operation... Unlike most other forms of media, flash memory devices are commonly used in a variety of devices. Digital cameras, media players, DA players, DVD players and an assortment of other electronic devices all can use these flexible storage tools. With this flexibility can come problems though. While all flash memory compatible devices share a few common traits like a FAT file system to write to the card, they can differ vastly in terms of expectation and execution. If you routinely shuttle your storage devices between an array of different electronics, you may be setting yourself up for future problems The file system on your typical Windows XP computer is a robust thing, well equipped to handle the complexities of reading, writing and erasing data on a small piece of portable flash memory. The file system on your three year old digital camera? Not so much... Simple devices like this want to be able to write images to a storage device, read images off the same device and erase them when necessary. They may not deal well with unsupported files, data which has been added by other devices and other abstractions. Wear and Tear As mentioned above, flash memory has a finite lifespan measured in erase and write cycles. That is to say, a specific block of NAND memory can only be written to and erased x number of times before it fails to reliably store data. In modern flash devices, this number generally extends to millions of operations, and longevity is further ensured by an algorithm built into the supporting circuitry of the memory that forces data to be written evenly across the available memory blocks, preventing one area of memory from becoming more 'worn' and failing faster. Supplementing this is another system which ensures that 'worn' sectors are mapped out of the grid of available memory, similar to the method used to deal with bad sectors in hard disk drives. Flash memory can and does wear out though. While a typical USB drive or memory card should last years or decades of typical use, exposing flash media to more read-

write intensive operations like running an operating system or hosting applications will cause premature wear and tear and the eventual failure of the device. Many flash memory devices are even more susceptible to the physical wear and tear which comes with constant use. Devices like USB flash drives are handled and used continuously, and are often not made to take much abuse. Recovering Erased Data From a Flash Memory Device One of the major benefits of using the FAT file system for flash memory devices is that it makes them compatible with many of the data recovery programs designed to retrieve accidentally deleted files from computer hard disks. Almost all of these programs support FAT 32 and 16 since FAT 32 is still accepted as a standard for formatting Windows partitions. If you've accidentally deleted an important file from your flash memory device, fear not. The best place to turn is the same utility we recommend for hard disk undeletion tasks; REST2514. This simple utility can easily search for and retrieve recently deleted files from any FAT formatted device. Using REST to recover deleted files from flash memory devices For a really simple and effective way to recover deleted files, it doesn't get much better than Restoration. This incredibly simple tool will search any NTFS or FAT32 drive and recover a list of deleted files that can be restored. Let's look at how to use it: Start Restoration.

Choose the drive you wish to scan in the 'drives' drop down box, and click 'search by deleted files.'

A list of deleted files is created. To restore one or more files, highlight them and click 'restore by copying' then choose a target directory. Note that the file name you are looking for may have its first letter overwritten by a '$' symbol, as this is the symbol appended to a file by the operating system when it is deleted. Also note that unlike PC inspector, restore does not sort the deleted files by folder, it simply dumps them all into a single list, which can make it harder to find what you are looking for. If the file you want is not in the list, try searching again with the 'include used clusters by other files' option checked. This will include files which have been partially overwritten in the list. Note that this may well mean that your file will be corrupted or unreadable. Recovering data from a Formatted Device If you have formatted your flash device since it last had the file(s) you are looking for, it's time to bring out the slightly bigger guns. If you've read PCSTATS critical Beginners Guide on hard disk data recovery, you'll know that CGSecurity's TestDisk program is one of the best freely available data recovery programs out there. It's not that easy to use, but it gets great results. Unfortunately, TestDisk does not work too well on flash memory devices, but the good news is that more recent versions of the program come with a second piece of recovery software called PhotoRec. PhotoRec is especially designed to recover pictures and other file formats from flash memory devices. Lucky us.

Using CGSecurity PhotoREC Download the latest version of TestDisk from the CGSecurity site. For the purposes of this article we used version 5.9, but the latest version available is 6.11. Extract the archive to a directory on your hard drive. Open the directory in explorer and go to the 'win' subdirectory.

Ensure that your flash memory device is inserted and detected, then double click on the PhotoREC icon to run the program.

Ahh! No GUI... don't be intimidated. PhotoREC is considerably easier to use than its sibling program TestDisk, as there are far fewer options. The main screen displays a list of the physical drives attached to the system, including your flash memory device. The easiest way to tell which is which is by looking at the size of each drive, which is listed in Megabytes. The program will list installed hard drives first though. Using CGSecurity PhotoREC Depending on the type of data you wish to recover, you may want to go to the 'file opt' menu before continuing. PhotoREC searches for many file formats by default, but BMP, MP3, EXE and TXT files are not among them. If you wish to recover these types of files, open the menu and scroll down to each entry, hitting the space bar to enable them.

Now it's time to choose a drive and start the recovery process. Return to the main menu and choose your flash media device from the drives listed. Highlight the 'search' option on the menu below and press ENTER.

Now choose the first partition listed (the one labeled 'whole disk') and hit enter again to search it for lost files. The program will begin to look through the data present on the drive for signatures that indicate the presence of certain file types. All files matching the types the program is searching for will be copied into a subdirectory created in whatever directory you placed the PhotoREC executable file. This subdirectory is titled 'recup_dir.1'. Each time you start a new recovery operation, the program creates a new subdirectory called 'recup_dir.#' with the number increased by one.

Once the recovery operation has finished, navigate to the 'recup_dir.#' subdirectory in Explorer and examine any recovered files. PhotoREC will list them simply as 'F1, F2, F3' etc., but the file types are clearly visible. Double click to open each file, then rename and move any ones that you want to keep. Attempting recovery of data from a corrupted drive Your success here will vary depending on what exactly is wrong with the flash memory device in question. If the file system has been scrambled due to a digital camera or other device performing an unexpected action or not reading the card correctly, PhotoRec may well be able to recover your data using the steps listed above. On the other hand, if your device is failing due to physical damage or wear and tear, data recovery depends entirely on what part of the flash memory is damaged. One positive is that, unlike hard drives, flash devices have no moving parts and thus do not generally fall victim to the 'snowball' damage effect, where data recovery efforts on a faulty drive inflict more damage on it even as they rescue some of the data. SGSecurity's PhotoREC is an excellent place to start any data recovery effort, but if that fails, there are a few other programs you can try. PC Inspector's Smart Recover program is a free flash data recovery utility with an attractive interface. We would have used it for this Beginners Guide, except it's a bit less flexible than PhotoRec in terms of what it will recover. Using encryption to protect your data As we've said, one of the most common causes of lost data with portable flash memory devices is losing the device itself. The smaller portable drives get, the easier they are to misplace. While losing data and hardware is a pain, the thought of that data falling into the hands of the wrong people can be an absolute heartache for business users. What's needed then, is a method to make sure that even if you lose your flash device (and someday you will), the data on it will be useless to its eventual owner. File encryption is the answer. There are several freeware and open source file encryption programs available, but our favourite is the open source AxCrypt program by Axantum.

This program adds itself to your right-click context menu, allowing you to encrypt files with a couple of clicks. A password is used for encrypting and decrypting files, and a self-extracting archive can be used, freeing the file's recipient from the need to install AxCrypt themselves. If you are worried about the damage your data could do in the wrong hands, AxCrypt is a quick and easy remedy. Simply copy files to your flash device as normal, then highlight them all, right click and encrypt them with your password of choice.