Amar Bhattarai: Recover Files from a Corrupted USB Drive

"You need to format the disk in drive E: before you can use it." That dialog has destroyed more recoverable data than most malware — because people click Format, and that click, not the corruption, is what loses the files. Here's the truth of most corrupted-USB cases: the filing system's index is damaged, but the files are still sitting on the flash. Recovery is about reading them out without making anything worse. Order of operations is everything.

01 — The Rules Before Anything Else

Do not format. Not "quick format, it's reversible-ish" — just don't. Every fix dialog Windows offers wants to write to the drive; writing is the enemy.
Do not save anything to the drive, and don't let recovery tools write their output to it either. Recovered files always go to a different disk.
Hold off on chkdsk. It "repairs" the file system by rewriting it, sometimes amputating damaged-looking data into useless FILE0000.CHK fragments. It has a place — after your files are safe, or never.
If the data is truly irreplaceable (the only copy of a thesis, a decade of family photos) and the drive shows physical symptoms — not detected at all, detected as 0 MB or 8 MB, extremely hot, or a hard drive that clicks — stop entirely. Every power-on of physically failing media reduces what a professional lab can recover. DIY recovery is for logical corruption, and knowing the difference is the most valuable paragraph in this article.

💡 Plain English: a corrupted drive is a library where the card catalog burned but the shelves are intact. Recovery tools rebuild the catalog or walk the shelves directly. Formatting throws out the shelves to install a new catalog.

02 — Diagnose Which Situation You Have

Plug the drive in and open Disk Management (diskmgmt.msc). Find the USB disk and match:

What you see	Meaning	Path
Partition shown as RAW, or "needs formatting" prompt	File system index damaged; data likely intact	Section 03 → 04
Disk present, partition area shows Unallocated	Partition table lost; data likely intact	Section 04 (TestDisk shines here)
Files visible but some won't open / folders turned to gibberish	Partial corruption	Copy everything readable NOW, then section 05 for the rest
Detected but wrong tiny capacity (8 MB / 0 MB)	Controller/flash failure	Professional recovery or acceptance
Not detected anywhere, in multiple ports/PCs	Dead electronics	Professional recovery or acceptance

(Test "not detected" properly: different port, different cable if applicable, different computer — USB ports and hubs fail too.)

03 — One Concept, Two Tools

The free, open-source standard for this work is a paired toolkit, and knowing which half to use is the whole skill:

TestDisk rebuilds the structure — finds lost partitions, repairs boot sectors, can often make the drive simply mount again with everything intact: real filenames, real folders. Try it first when Disk Management showed RAW or Unallocated.
PhotoRec ignores structure entirely and walks the raw flash looking for the signatures of known file types — it recovers contents when structure is beyond saving. The price: no filenames, no folders, just f0834562.jpg by the thousand. It works even on formatted drives, which is also your reminder of what quick format does and doesn't erase.

Both come in one download from cgsecurity.org. They're keyboard-driven and look ancient; they are also what half the commercial "recovery suites" wrap a paid UI around.

04 — TestDisk: Restore the Structure

Run testdisk_win.exe as administrator → Create a log.
Select the USB drive — by size, carefully. Selecting your system disk here and writing changes to it is the one way this tool can hurt you.
Partition table type: accept the highlighted auto-detection (Intel for most USB sticks, EFI GPT for larger modern drives).
Analyse → Quick Search. Found partitions appear; highlight one and press P to list its files — this is the magic moment where you see your data alive. (Quick Search empty? Deeper Search scans the whole device; let it run.)
Seeing your files, you have two finishes:
- Safest: copy them off right here — select files/dirs, press C, choose a destination on another disk. Structure repair becomes optional once the data is out.
- Full repair: mark the partition, Write the table, confirm, replug the drive. In clean lost-partition cases it mounts as if nothing happened.

05 — PhotoRec: Carve the Contents

When TestDisk finds nothing listable, switch tools:

Run qphotorec_win.exe (the graphical version — same engine, gentler experience).
Select the drive, choose the partition or Whole disk, file system family FAT/NTFS/exFAT (i.e., not ext), and a destination folder on a different drive with room to spare.
Optional but smart: File Formats → restrict to the types you actually need (jpg, docx, xlsx, pdf, mp4…) — it cuts both runtime and the haystack you'll sort afterwards.
Run it, then budget real time for triage: results arrive as anonymous numbered files sorted into recup_dir folders. Sorting photos by thumbnail view, and documents by opening, is tedious — and beats the alternative of having nothing to sort.

06 — After the Rescue

Verify the recovered copies open, on the other drive, before doing anything else.
Now — and only now — the drive's fate: a full reformat (right-click → Format, untick Quick Format so every cell gets exercised) is the honest stress test. A stick that corrupts again soon after, or shows write errors during the format, has failing flash: bin it. Flash drives are consumables with no warning light.
Update your threat model: the corruption usually came from yanking the drive mid-write, a flaky port, or just flash wearing out. The structural fix is never letting a USB stick be the only home of anything that matters — sticks are couriers, not vaults. I'll put numbers and tooling on that principle in an upcoming backup-strategy guide (the 3-2-1 rule).

🔒 Bottom line: "format disk to continue" is a bluff — call it. Write nothing, run TestDisk to resurrect the structure with names intact, fall back to PhotoRec to carve the contents raw, and send physically-failing drives to professionals instead of torturing them. Then promote whatever you just rescued to a real backup, so the next dead stick is an inconvenience instead of an incident.