7

If someone opens a Word document from USB flash drive but does not save it to the computer, can I access the file's contents after the drive has been removed? If so, how?

I already tried data recovery and automatic office recovery and I didn't find it. My Office version is 2016.

8
  • 4
    AFAIK: I'm afraid NO
    – Toto
    Commented Dec 16, 2023 at 16:51
  • 3
    @Toto, ...it's more a "maybe" than a "no". A forensic memory dump may well find that document still in RAM if the system has plenty of unused memory and has been idle since. That's part of why Giacomo's question above is so pertinent: if the intent of the question is "how much care do I need to take to reliably protect myself from a document being read after I removed the device that contained it?", that's a question with a longer answer. Commented Dec 17, 2023 at 14:25
  • (Mind, having "tried data recovery and automatic Office recovery" itself creates memory churn and reduces the chances of finding the content in a snapshot will be successful). Commented Dec 17, 2023 at 14:27
  • 1
    ...I haven't reviewed it in detail, but at least the introductory parts of the Medium post Windows memory forensics using open source tools looks credible and on-point, as someone with nonzero experience in the matter. Commented Dec 17, 2023 at 14:29
  • From a more security relevant perspective: I suppose at least fragments of the file may be found in the swap file (perhaps only after an "unclean" power off?), or if the computer hibernated, in the hibernation RAM image. Commented Dec 17, 2023 at 17:42

2 Answers 2

16

Do this first, before restarting Word.
Depending on the settings, and what happened, search for *.doc, *.docx, *.dot, and *.wbk files in the following locations:

  • C:\Users\<UserName>\AppData\Roaming\Microsoft\Word
  • C:\Users\<UserName>\AppData\Local\Microsoft\Office\UnsavedFiles
  • C:\Users\<UserName>\AppData\Local\Temp
  • C:\Windows\Temp

Then try “File -> Manage Document -> Files Tab -> Document Management -> Recover unsaved documents.”

If Word was set to autosave periodically, a backup can be found in the defined directory. “File -> Options -> Save -> Save AutoRecover information every X minutes.” The directory is given in the same place.

2
  • 4
    Use this answer only after mine - entering Word can cause it to cleanup orphaned drafts, so try to find and save the drafts before entering Word.
    – harrymc
    Commented Dec 17, 2023 at 9:19
  • 1
    (partly @harrymc) I'd be tempted to copy all candidate files from both methods/all locations to removable storage, and open them on another machine (or perhaps in LibreOffice, still working on the copies)
    – Chris H
    Commented Dec 19, 2023 at 10:12
13

If you have edited the files, even in a small way, and exited Word brutally by killing the Word process, or just took the USB out thus letting Word abort, then you might still have a draft of the document in your TEMP folder (the folder is pointed-to by the environment variable TEMP).

However, if you have exited Word in the normal way, all draft copies of the document were removed, and it's just too late.

As a last effort, look into the Recycle Bin for a file that has a similar file-name to the edited files, usually with a destroyed first character. But that's all you can do.

3
  • all draft copies of the document were removed... so file recovery using Recuva etc is possible?
    – Salman A
    Commented Dec 18, 2023 at 14:20
  • 4
    Recuva and similar programs can find deleted files on the disk, or sometimes fragments of files, but may or may not find the original file-name. You may need to locate the file by its attributes such as location and size. You'll never know if you don't try, but avoid writing to the disk while trying to recover files.
    – harrymc
    Commented Dec 18, 2023 at 14:45
  • I don't see why it would appear in the recycle bin. You're describing what a file recovery tool will show from an actually deleted file. Word never recycles any of its temporary files, it deletes them directly.
    – OrangeDog
    Commented Dec 19, 2023 at 18:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .