Data in formatted USB?

[ArnavKumar]

There are so many tools to recover data from the formatted USB. If the 4GB USB formatted, more than 4GB data can be recovered from it. How is it possible? Where does data gets space? How do these tools find the data?

[digip]

Formatting vs deleting tend to do similar things depending on the tool, while deleting a file, marks that disk space as ready to be used in the event you create or store a new file, until that space is actually written to, the data still exists, just with a flag for that sector that it may be written to. Like flipping a light switch on or off, when you turn off the light, the bulb is still in the lamp until someone changes it with another one.

Formatting a disk on the other hand, tends to destroy data, but that depends on the tool used, OS and file system in use. You can often use a quick format on a thumbdrive in windows, and recovery almost all the data. Formatting say a Fat32 drive to an NTFS file system, will change the drive structure and more than likely, destroy data in the process. Formatting is the last thing you want to do if you want to recover data though while deleting, so long as that space on disk is not written to, you have the potential to recover the data.

Handy recovery has a free version, that works well for most Windows file systems against deleted files: http://www.handyrecovery.com/download.shtml

Linux has its own set of tools for recovering deleted data, and they even have forensic distros that cover more than windows and linux file systems alone, with dedicated tools for the potential recover data from various file systems.

[ArnavKumar]

Thank you digip for your reply. I really appreciate this answer but still i am not getting how a tool can get more data from the disk than the disk capacity.

[digip]

If the 4GB USB formatted, more than 4GB data can be recovered from it. How is it possible?

Technically its not possible. 4GB is 4GB.

However, if the data recovered was compressed before it was stored, it may be possible to extract data larger than 4GB, but other than a hidden partition or things like drives with cd-rom partitions(which usually hold very little space and extra data), 4GB of space is still 4GB of data until expanded. Basically, "You can't shove 10 pounds of shit into a 5 pound bag."

If you compressed the data such as a zipped file, or the drive file system itself was using OS compression(which can be done if formatted as certain file system types), thats the only way I can see you retrieving more than 4GB of data, after expanding/extracting/unzipping the recovered data but even on a compressed file system, the max space of the drive itself is still 4GB, just the data put into it is compressed to save space allowing more files to be stored on it.

After formatting it, recovery is usually not possible in most cases depending on the type of format that was done, as where file deletion, merely marks the sectors with files, ready for use to write to in the future, and the data remains until it is written to, which allows for file recovery of deleted data.

Some drives though, have extra space (minimal), specifically set aside and allocated for when errors or bad sectors happen and smart drives will just use the reserved space when needed.

Edited December 4, 2013 by digip

[smithlynn602]

There are so many tools to recover data from the formatted USB. If the 4GB USB formatted, more than 4GB data can be recovered from it. How is it possible? Where does data gets space? How do these tools find the data?

When ever you delete any data from your hard drive, It still stay there. Only the access path to that data is deleted and these data recovery softwares can recover that path. I also use Kernel for Windows Data Recovery Software for my lost data recovery requirement. To know more about windows data recovery software your can go through http://www.freedatarecoverysoftware.org

[Mr-Protocol]

For a quick triage, FTK Imager: http://www.accessdata.com/support/product-downloads