Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I foolishly removed my USB stick from a Windows XP machine seemingly without unmounting it (or whatever the Window equivalent is..). Anyway, on inserting the stick into my linux machine, the file I was working on shows up, but it is completely empty (0KB).

Since I'm pretty much a Windows novice these days, I'd like to know if there is any temporary location where I will still be able to find this file, or is it now lost permanently?

share|improve this question

migrated from Jan 29 '11 at 12:47

This question came from our site for professional and enthusiast programmers.

up vote 1 down vote accepted

If the file was truncated to 0 bytes, it is likely that running fsck or chkdsk over the stick will result in several "lost clusters" being found and named. It is possible that your lost file as it was can be partially recovered by concatenating these lost clusters in the correct order. Whatever changes you made were likely never written, and thus those changes are almost certainly lost.

share|improve this answer
So the cached data that XP creates to write to the stick has no recoverable copy? Also, the changes are minimal. It's the file itself that I would like to recover. Can you go into any more detail? – Jivings Jan 29 '11 at 14:46
The cached data is stored in RAM prior to the write, and is lost. Caching disk writes to disk would be rather silly, don't you think? – Jeremy Sturdivant Jan 29 '11 at 14:50
The process for recovering a file from lost chunks is different for every file format, and generally means pouring over tons of FILE0001.CHK files looking for the right piece of your data... It's more a matter of luck and a good eye for the file format than it is following any particular process. – Jeremy Sturdivant Jan 29 '11 at 14:51
Just run chkdsk or fsck over the disk involved. fsck with the -f flag for fsck.vfat, or I believe chkdsk with default options should attempt to recover lost clusters. The process of recovery will leave a set of files, usually on the root of the disk, with names in some sort of order, such as FILE0000.CHK, FILE0001.CHK, so on so forth for chkdsk. Opening these in a hex editor, notepad, or the like may give some insight as to the relevancy of the specific cluster. – Jeremy Sturdivant Jan 29 '11 at 14:55
It would be silly, had it not the potential to cause data loss. I will try fsck.vfat.Thanks. – Jivings Jan 29 '11 at 17:11

It is probably lost permanently.

The reason you must eject/unmount/safely remove the USB stick is because the disk writes are potentially cached. This means the data is not really written to the disk when you ask it to, but saved into memory and written at a later, more convenient time for the operating system.

By unmounting the drive, you are informing the operating system that it must now write and remaining cached disk writes. Since your file is o bytes in size, it would appear that this never happened, so whatever data you had is now lost.

share|improve this answer
And yet it wasn't a new file that I had started writing. I only added a couple of lines, re-saved it and removed the stick... – Jivings Jan 29 '11 at 13:39
@Jivings Often edits are saved by writing a new file in place of the old. If you disconnect at the wrong time you get 0 bytes. Some programs will save the old file as a backup. In many cases the old or new file can be recovered after a fsck operation. – BillThor Jan 29 '11 at 18:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.