How to retrieve deleted files in usb using cmd?

​Losing files can be frustrating, especially if they were stored on a USB drive that may have been accidentally formatted or if files were deleted unintentionally. Fortunately, the Command Prompt (CMD) in Windows can be a powerful tool to help retrieve deleted files from a USB drive.

1. Data Deletion on USB Drives

What Happens When You Delete Files?

When you delete a file from a USB drive, the operating system removes the file’s pointer from the file system, making it inaccessible to users. However, the actual data remains on the drive until it is overwritten by new data.

Key Points:

The deleted file’s space is marked as available for new data.

The file remains intact until new files are saved to the USB drive, potentially overwriting the deleted file.

Types of File Deletion

Soft Deletion: When a file is sent to the Recycle Bin, it can be easily restored.

Hard Deletion: Files that are deleted using Shift + Delete or files removed from the Recycle Bin are hard-deleted, making recovery more complex.

Factors Affecting File Recovery

Time since deletion: The longer you wait to recover the files, the higher the chance that they will be overwritten.

Use of the USB drive after deletion: Continuing to use the drive can overwrite deleted files, complicating recovery efforts.

2. Preparation for File Recovery

Before attempting to recover deleted files from your USB drive using CMD, it’s essential to prepare appropriately.

How to Prepare Your USB Drive

Stop using the USB drive: To maximize recovery chances, cease all activities on the drive immediately after realizing files have been deleted.

Connect the USB drive: Ensure the USB drive is properly connected to your computer and recognized by the operating system.

Checking for Corruption

Run a check for corruption: Use the built-in Windows tool to verify that the USB drive is not corrupted. You can do this by plugging in the USB drive, right-clicking on it in File Explorer, and selecting Properties > Tools > Check.

Important Safety Measures

Backup your current data: If you have any other data on the USB drive that you wish to keep, back it up to another location before proceeding with recovery attempts.

Use antivirus software: Scan the USB drive for viruses or malware that might have caused file deletion.

3. Using Command Prompt for File Recovery

Accessing the Command Prompt

To use CMD for file recovery, you need to open it with administrative privileges.

Press Windows + R to open the Run dialog box.

Type cmd and press Enter.

Right-click on the Command Prompt icon and select Run as administrator.

Basic CMD Commands for File Recovery

Familiarize yourself with the essential commands that will aid in the recovery process:

diskpart: Used for managing disks, partitions, and volumes.

chkdsk: Checks the integrity of the file system and repairs issues.

attrib: Displays or changes file attributes.

Step-by-Step Process to Recover Deleted Files

Follow these steps to attempt recovery using CMD:

Identify the USB Drive Letter

Open File Explorer and note the drive letter assigned to your USB drive (e.g., E:).

Open Command Prompt

As mentioned above, access the Command Prompt with administrative privileges.

Use CHKDSK Command

In the CMD window, type the following command and press Enter:

bash

chkdsk E: /f

Replace E: with your USB drive letter. This command checks for and repairs file system errors.

Review the CHKDSK Results

Look for any messages about recovered files or issues found during the scan.

4. Using CHKDSK to Repair USB Drive

What is CHKDSK?

CHKDSK (Check Disk) is a Windows utility that scans the file system and file system metadata of a volume for logical and physical errors. It can often recover files lost due to corruption.

How to Use CHKDSK to Scan and Repair

Open CMD with administrative privileges.

Run the command:

bash

chkdsk E: /f

The /f option tells CHKDSK to fix any found errors.

Wait for the scan to complete.

Depending on the size and condition of the USB drive, this process may take some time.

Check the output for recovered files.

If any recoverable files were found, they would be noted in the results.

Understanding CHKDSK Results

After running CHKDSK, you may see messages such as:

Files Recovered: Indicates the number of files successfully recovered.

No problems found: Means no errors were detected on the USB drive.

5. Using ATTRIB Command to Recover Files

Understanding File Attributes

When files are deleted, their attributes may change, making them invisible. The ATTRIB command can help change these attributes back to make files visible again.

Step-by-Step Guide to Using ATTRIB Command

Open CMD as an administrator.

Navigate to your USB drive:

Type the following command and press Enter:

makefile

E:

Replace E: with your USB drive letter.

Use the ATTRIB command:

To show all files, including hidden and system files, use the following command:

bash

attrib -h -r -s /s /d *

This command will remove the hidden, read-only, and system attributes from all files in the drive.

Check if the deleted files are visible.

Use the dir command to list the files on the drive and see if any previously deleted files have reappeared.

6. Recovering Files with Windows Recovery Tools

In addition to using CMD, Windows offers built-in recovery tools that can help recover lost files.

File History

File History is a backup feature in Windows that automatically backs up your files. If it was enabled before file deletion, you might be able to recover your lost files.

Steps to use File History:

Open Control Panel.

Select System and Security > File History.

Click on “Restore personal files.”

Browse for the lost files and restore them.

Windows Backup

If you regularly back up your files using the Windows Backup feature, you can restore deleted files from a previous backup.

Steps to restore using Windows Backup:

Open Control Panel.

Select System and Security > Backup and Restore (Windows 7).

Click on “Restore my files.”

Follow the prompts to recover files from the backup.

Using System Restore

If you have System Restore enabled, you can revert your computer to a previous state where the files may still exist.

Steps for System Restore:

Search for “System Restore” in the Start menu.

Select “Create a restore point.”

In the System Properties window, click on “System Restore.”

Follow the instructions to restore your system to a previous state.