Data recovery software for formatted USB stick

Try Photorec http//www.cgsecurity.org/wiki/PhotoRec
It always helped me in such cases.

Have you looked through at sector level to make sure there is data still there. Look at sectors over the range of the memory chip

There are format options to do a full rather than quick format. A full format typically blanks every sector to zero, which is also the same as your chance of recovery.

A quick format should be recovered by most recover programs, but there will always be an issue of any fragmented files which is often ignored by many recovery programs. However, data carving should indicate the presence of files

There are format options to do a full rather than quick format. A full format typically blanks every sector to zero, which is also the same as your chance of recovery.

I might be mistaken here but doesn't a full format simply scan for bad sectors? As far as I'm aware full format doesn't write zeroes anywhere and won't affect chances of data recovery any more than a quick format.

To the OP do you have Xways/EnCase or other forensic software which you can attempt a data carve with? And also with these tools you will be able to view the disk sectors as someone else suggested to confirm there is actually data on the device.

To the OP do you have Xways/EnCase or other forensic software which you can attempt a data carve with? And also with these tools you will be able to view the disk sectors as someone else suggested to confirm there is actually data on the device.

You have just answered my question. The only forensic software I have that can do that is XACT. So I took a look at the hex data - absolutely nothing there. Disappointed but at least I know.

Thanks all!

There are format options to do a full rather than quick format. A full format typically blanks every sector to zero, which is also the same as your chance of recovery.

I might be mistaken here but doesn't a full format simply scan for bad sectors? As far as I'm aware full format doesn't write zeroes anywhere and won't affect chances of data recovery any more than a quick format.

Strangely enough, you managed to be BOTH "wrong" 😯 (or riight ) ) .

Without knowing under which OS the format was performed there is no definite answer.

If it was performed under Vista or 7, yes, "full" format writes all zeroes.

Previous NT based systems did not.

It is one of those things that MS changed without giving much publicity to it.
See
http//support.microsoft.com/kb/941961/en-us

jaclaz

Without knowing under which OS the format was performed there is no definite answer.

If it was performed under Vista or 7, yes, "full" format writes all zeroes.

Previous NT based systems did not.

It is one of those things that MS changed without giving much publicity to it.
See
http//support.microsoft.com/kb/941961/en-us

jaclaz

It was done under Win 7.

If the format hadn't taken place, and the memory stick was still RAW, would there have been any chance of data recovery? Again, the hex data showed nothing was saved on the stick, but could that be because the software couldn't find it due to the RAW system?

Jaclaz you've just shown me how far I've let my basic knowledge slip to not be aware of that!!!

Just tested and confirmed on a Win7 machine, I never thought I'd see the day that Windows would implement something thorough like that p

It was done under Win 7.

If the format hadn't taken place, and the memory stick was still RAW, would there have been any chance of data recovery?

Sure, after a "new quick" format (or "old normal") you can usually recover 100% or nearly 100% of data (you may have issues with fragmented files).
Basically a new format (with the same filesystem, such as FAT32 on FAT32) overwrites only some parts of the bootsector and the FAT tables, the actual data is still entirely there.

Again, the hex data showed nothing was saved on the stick, but could that be because the software couldn't find it due to the RAW system?

No.

Sometimes - no offence intended ) - I wonder if before operating (at a "certain level") a PC/OS, the proper instructions have been given and understood.

If you open a disk with a hex editor, go to the MBR and write *anything* over the last two bytes, the disk will become "needing to be initialized".
If you open a disk with a hex editor, go to the MBR and write *anything* over the partition table entry, the volume will become "RAW".
If you open a volume with a hex editor, go to the PBR and write *anything* to the last two bytes or in several other places connected with the BPB, the volume will become "RAW".

Of course apart the very little modifications made, at the most two sectors, all the other sectors are exactly as they were before.

If anything is changed in the MBR or the PBR, you can normally use a "partition level" recovery, the volume (and all it's contents is practically unmodified and it can be recovered 100%.
If anything is changed in the MBR or the PBR AND in the FAT tables or the $MFT you can try "filesystem level" recovery, with somewhat (depending on the extension of the changes) lower percentage of success.
If also the FAT tables or $MFT have been overwritten/wiped extensively or totally, your only chance is "file level" recovery with an expected result of 100% or nearly 100% for contiguous files and a much lower rate for heavily fragmented files.

With sticks, however, I have seen more than one case where the "becoming RAW" was an issue within the controller (or the actual flash/whatever) and after having become "RAW", independently from whether data recovery was successfull or not (in hwole or part) a simple re-format was not enough to have the stick working, and the use of the Manufacturer Tool was needed.
In some of these cases the only "way out" to recover the data is to by-pass the controller and read data directly from the flash, through "specialized" hardware and software.
Same happens with conventional disks, but un these cases usually there are other issues (like the disk being "busy" or not detected at all.

The rule of the thumb is - if you find that a volume becomes RAW and you value the data on it - to power down/disconnect the device as soon as you can and ask for help/support BEFORE doing ANYTHING to it.

You might like this thread
http//www.forensicfocus.com/Forums/viewtopic/t=5150

@Adam10541
Well, you are not the first one to fall in this nicely laid trap, been there, done that 😯 , JFYI
http//www.msfn.org/board/topic/135781-vista-quick-format-or-full-format-that-is-the-question/

jaclaz