I accidentally deleted two files from an audio recorder (Olympus LS-10) connected via USB on my Windows XP system by using <SHIFT> + <DEL>. This was done within the WindowsExplorer application. Since then, There were no write activities on the USB device, so I think, chances are for recovery...
Unfortunately, I have not found any process description on HOW to try to recover a file. There are loads of features but no recipe on WHAT TO DO when a certain problem is to be solved. As data is very valuable, I don't want to risk anything by trying this and that. The first try MUST be successful, please.
Do you have a kind of process description on how to use your program in order to try to recover a file lost as described above?
Thanks.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Hello, I'm sorry for your loss.
You could always use the program in read-only mode, since only deleting files (and creating new files) is really doing some data write.
Recovering your files shouldn't be that hard.
It would help to remember in which format did you saved them (WAV, MP3 or WMA ?).
A file has header that contains a signature and has a specific format. Depeding on which format you used you should search for the signature.
Here's how you do that:
1) start the program
2) pick first option [Expore : HARDDISK/USB]
3) you'll now be asked in [Device setup] some info. For [Drive Hardware Type] pick [TRUE_IDE:0] . For [Interface type] pick [HD_DRIVE:72]. Now you will be asked which [.\PHYSICALDRIVE???:] you want to use (0 or 1 or ... whatever other number); to find out which physical drive number you have to use go to [My Computer] -> right click you Olympus drive -> pick [Properties], go to tab [Hardware] and select your drive in that list; If you did this correcly there should be in frame called [Device Properties] a label called Location : Location "?" ("?") - instead of "?" there will be you physical drive number. No go back to program and write this number there. For [use master(0, default) or slave(1)] pick [0].
4) If everything goes right and you have selected the approriate partition you will now be asked to choose a partition from the drive. It should probably be [entry #0] (you can use arrow keys - up/down - to pick a different partition anyway). Press [Enter] to select it.
5) Now it will ask you if you want to use StandardBigCache. Pick whatever you like. It will not influence the next steps. (if you choose yes it will speed up a little). Press [Enter] until you reach the IDE.
6) You should now see a list of folders/files from you drive.
7) Select any file and press [F3] - GotoFat - an info dialog will be shown, press [enter] to close it.
8) Now you shoul see the FAT list (each cluster is represented by a single block). Press [F1] to make yourself an idea about what can you do here.
9) After you are done looking around press [F7] while you are in this FAT list. You are going to seach the first sector of every cluster for your file signature.
10) Enter the signature ("RIFF$" for wave files, "ID3" for an MP3 file, 0x30 0x26 0xB2 0x75 0x8E 0x66 0xCF 0x11 for WMA; to enter WMA signature use ALT+[numeric pad numbers] - but I hope you will not need this). Press [enter]
11) On [start with cluster] write 0x00. Press [enter].
12) On [select method] pick [read only first sector of cluster:1]. Press [Enter]
13) The program will now show you some progress status text. If a match is found you will be given the cluster number. You can goto that cluster by pressing [c] or continue to search for another match with key [n].
14) If you pressed [c] you are now back to the FAT list. Since you are looking for an unallocated cluster than the first cluster in the list should be colored with [green]. Otherwise continue the search until you find such a cluster by going back to step 9). Otherwise if it's green inspect the cluster with [F4].
15) You could dump cluster using key [d] - i don't know if it works with your OS(it works ok in FreeDOS/MS-DOS)
16) Depending on how many minutes your recording was you should dump all free clusters starting with the cluster you have found. To do this you will probably need another tool - google for one, there are plenty of them.
You might be able to use my tool for the purpurpose of dumping free clusters but you would need to write a bit of code. If you need to do this I could help you a bit, or maybe I could update my program to able to this from the IDE in an easy maner (like to dump the free clusters starting with the mentioned one, for a given amount of clusters) - if you ask of me i'll might be able to do this over the weekend.
Last edit: Mihai Barboi 2017-09-15
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Hi,
I accidentally deleted two files from an audio recorder (Olympus LS-10) connected via USB on my Windows XP system by using
<SHIFT> + <DEL>. This was done within the WindowsExplorer application. Since then, There were no write activities on the USB device, so I think, chances are for recovery...Unfortunately, I have not found any process description on HOW to try to recover a file. There are loads of features but no recipe on WHAT TO DO when a certain problem is to be solved. As data is very valuable, I don't want to risk anything by trying this and that. The first try MUST be successful, please.
Do you have a kind of process description on how to use your program in order to try to recover a file lost as described above?
Thanks.
Hello, I'm sorry for your loss.
You could always use the program in read-only mode, since only deleting files (and creating new files) is really doing some data write.
Recovering your files shouldn't be that hard.
It would help to remember in which format did you saved them (WAV, MP3 or WMA ?).
A file has header that contains a signature and has a specific format. Depeding on which format you used you should search for the signature.
Here's how you do that:
1) start the program
2) pick first option [Expore : HARDDISK/USB]
3) you'll now be asked in [Device setup] some info. For [Drive Hardware Type] pick [TRUE_IDE:0] . For [Interface type] pick [HD_DRIVE:72]. Now you will be asked which [.\PHYSICALDRIVE???:] you want to use (0 or 1 or ... whatever other number); to find out which physical drive number you have to use go to [My Computer] -> right click you Olympus drive -> pick [Properties], go to tab [Hardware] and select your drive in that list; If you did this correcly there should be in frame called [Device Properties] a label called Location : Location "?" ("?") - instead of "?" there will be you physical drive number. No go back to program and write this number there. For [use master(0, default) or slave(1)] pick [0].
4) If everything goes right and you have selected the approriate partition you will now be asked to choose a partition from the drive. It should probably be [entry #0] (you can use arrow keys - up/down - to pick a different partition anyway). Press [Enter] to select it.
5) Now it will ask you if you want to use StandardBigCache. Pick whatever you like. It will not influence the next steps. (if you choose yes it will speed up a little). Press [Enter] until you reach the IDE.
6) You should now see a list of folders/files from you drive.
7) Select any file and press [F3] - GotoFat - an info dialog will be shown, press [enter] to close it.
8) Now you shoul see the FAT list (each cluster is represented by a single block). Press [F1] to make yourself an idea about what can you do here.
9) After you are done looking around press [F7] while you are in this FAT list. You are going to seach the first sector of every cluster for your file signature.
10) Enter the signature ("RIFF$" for wave files, "ID3" for an MP3 file, 0x30 0x26 0xB2 0x75 0x8E 0x66 0xCF 0x11 for WMA; to enter WMA signature use ALT+[numeric pad numbers] - but I hope you will not need this). Press [enter]
11) On [start with cluster] write 0x00. Press [enter].
12) On [select method] pick [read only first sector of cluster:1]. Press [Enter]
13) The program will now show you some progress status text. If a match is found you will be given the cluster number. You can goto that cluster by pressing [c] or continue to search for another match with key [n].
14) If you pressed [c] you are now back to the FAT list. Since you are looking for an unallocated cluster than the first cluster in the list should be colored with [green]. Otherwise continue the search until you find such a cluster by going back to step 9). Otherwise if it's green inspect the cluster with [F4].
15) You could dump cluster using key [d] - i don't know if it works with your OS(it works ok in FreeDOS/MS-DOS)
16) Depending on how many minutes your recording was you should dump all free clusters starting with the cluster you have found. To do this you will probably need another tool - google for one, there are plenty of them.
You might be able to use my tool for the purpurpose of dumping free clusters but you would need to write a bit of code. If you need to do this I could help you a bit, or maybe I could update my program to able to this from the IDE in an easy maner (like to dump the free clusters starting with the mentioned one, for a given amount of clusters) - if you ask of me i'll might be able to do this over the weekend.
Last edit: Mihai Barboi 2017-09-15