Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I foolishly removed my USB stick from a Windows XP machine seemingly without unmounting it (or whatever the Window equivalent is..). Anyway, on inserting the stick into my linux machine, the file I was working on shows up, but it is completely empty (0KB).

Since I'm pretty much a Windows novice these days, I'd like to know if there is any temporary location where I will still be able to find this file, or is it now lost permanently?

share|improve this question

migrated from stackoverflow.com Jan 29 '11 at 12:47

This question came from our site for professional and enthusiast programmers.

add comment

2 Answers

up vote 1 down vote accepted

If the file was truncated to 0 bytes, it is likely that running fsck or chkdsk over the stick will result in several "lost clusters" being found and named. It is possible that your lost file as it was can be partially recovered by concatenating these lost clusters in the correct order. Whatever changes you made were likely never written, and thus those changes are almost certainly lost.

share|improve this answer
    
So the cached data that XP creates to write to the stick has no recoverable copy? Also, the changes are minimal. It's the file itself that I would like to recover. Can you go into any more detail? –  Jivings Jan 29 '11 at 14:46
1  
The cached data is stored in RAM prior to the write, and is lost. Caching disk writes to disk would be rather silly, don't you think? –  Jeremy Sturdivant Jan 29 '11 at 14:50
    
The process for recovering a file from lost chunks is different for every file format, and generally means pouring over tons of FILE0001.CHK files looking for the right piece of your data... It's more a matter of luck and a good eye for the file format than it is following any particular process. –  Jeremy Sturdivant Jan 29 '11 at 14:51
    
Just run chkdsk or fsck over the disk involved. fsck with the -f flag for fsck.vfat, or I believe chkdsk with default options should attempt to recover lost clusters. The process of recovery will leave a set of files, usually on the root of the disk, with names in some sort of order, such as FILE0000.CHK, FILE0001.CHK, so on so forth for chkdsk. Opening these in a hex editor, notepad, or the like may give some insight as to the relevancy of the specific cluster. –  Jeremy Sturdivant Jan 29 '11 at 14:55
    
It would be silly, had it not the potential to cause data loss. I will try fsck.vfat.Thanks. –  Jivings Jan 29 '11 at 17:11
show 1 more comment

It is probably lost permanently.

The reason you must eject/unmount/safely remove the USB stick is because the disk writes are potentially cached. This means the data is not really written to the disk when you ask it to, but saved into memory and written at a later, more convenient time for the operating system.

By unmounting the drive, you are informing the operating system that it must now write and remaining cached disk writes. Since your file is o bytes in size, it would appear that this never happened, so whatever data you had is now lost.

share|improve this answer
    
And yet it wasn't a new file that I had started writing. I only added a couple of lines, re-saved it and removed the stick... –  Jivings Jan 29 '11 at 13:39
    
@Jivings Often edits are saved by writing a new file in place of the old. If you disconnect at the wrong time you get 0 bytes. Some programs will save the old file as a backup. In many cases the old or new file can be recovered after a fsck operation. –  BillThor Jan 29 '11 at 18:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.