How to retrieve text from a file without extension in a formatted flash drive?

hocico

New member
I have a USB flash drive (256GB) where I used to store anything I was working with. A few weeks ago I formatted it by accident, and inmediatly Winamp created files in it. The files were small, but enough to overwrite part of the MTB I suppose, because only one of all the recovery programs that I tried could identify the old folder structure, and anything I could recover there was useless because of the severe fragmentation.
The real problem now is the following: I could retrieve like 95% of my work from other sources, but in the other 5% theres a file where I stored ALL the writting. The file was made in Notepad++, and I didn't bother to apply an extension (.txt) to it while saving. If I could at least recover some paragraphs, it would make a difference, but none of the programs I used recognize the file at all.

Is there any program that would let me search raw text within the formatted/erased data? There's any way I could retreive pieces of that text? Any idea? Thank a lot in advance, it's a very important matter.
 

Jared

Administrator
Staff member
You can probably find fragments of it just by using a Hex editor such as WinHex. What you'll want to do is this:

1. Open up notepad (or whatever you used to create the original txt file) and type in a few uncommon words that you know would have been in the lost document.
2. Open of this newly created txt file in a hex editor such as Winhex and take note of how the text appears in hexadecimal code.
3. Open up the thumbdrive using the hex editor and do a search for the hex string of one of those words and see what you find.

Most likely you'll be able to see/read the text right in the hex editor. Just be sure that the view is set to ANSI ACII for the right column.

Here's an example of what a TXT document looks like in Hex:
Text Doc in Hex.jpg

You'll see I highlighted the word "Editor" which translates to the hex code 45 64 69 74 6F 72 (what you'd want to search to find that word)

If you don't find the text, then it was likely overwritten. Because txt files are very small in size they tend to get saved in the lower LBA regions which is the first to get overwritten after a format.

If you do find the text, you can just highlight the text, save it as a file in the hex editor, add the .txt extension, and it should open up for you.
 

hocico

New member
Thank you for your reply!

I have downloaded WinHex, its the first time I use a program of this sort. I picked "File->Open Directory" and then the USB drive. Then I got this message:

No sector-level access to this storage device. File contents have to be read through the operating system. This requires certain user permissions and fails if the file is locked. Opening files might alter last access timestamps. Free space, slack space, deleted files, ADS, EA, etc. will not be visible.

Am I doing anything wrong? I tried to google it but I found nothing related.
 

hocico

New member
I tried "Search->Find Hex Values..." anyway, but nothing happens when I click. No window opens asking me for input.
 

Jared

Administrator
Staff member
First off, you need to run the program as an admin user for it to have proper sector access to anything.

Also, you should be doing the "open disk" option, not open directory.
 

hocico

New member
Thank you so much. I recovered the 100% of the text. This takes a heavy weight off my shoulders. I'm so grateful I wish I could pay back.
 

Jared

Administrator
Staff member
jol":2hclv239 said:
hocico":2hclv239 said:
[post]15070[/post] I'm so grateful I wish I could pay back.
u can send to @Jared some money using paypal, wire transfer Etc.

I like your thinking jol :D

hocico":2hclv239 said:
Thank you so much. I recovered the 100% of the text. This takes a heavy weight off my shoulders. I'm so grateful I wish I could pay back.

Or, you can just drop a nice review on our google place page: https://search.google.com/local/writere ... MIb0DCb27A

Every review helps more paying customers find our small business in Google. So they are as good as gold.
 
Top