File recovery from a disk image
A disk image is a byte-for-byte copy of a card or flash drive, and deleted files are still inside it: a delete in FAT overwrites one character of the name and frees the chain, leaving the start cluster and the size in place. This tool reads them back, and where the file system is gone entirely it carves the files out by their signatures — checking every result before offering it.
A byte-for-byte copy: dd on Linux and macOS, Win32 Disk Imager or USB Image Tool on Windows. Work from the copy, not from the original.
The tool works out what is inside it: the file system, the live files, the deleted entries and which of them are still recoverable.
By the directory — names and folders come back. By signatures — files are found even where the directory is gone.
Chromium browsers save straight into a folder you choose; the rest get an archive. Files that did not pass the check are kept separately.
Get the deleted files back out of a card or flash drive dump
What to know before you start
- This works on an IMAGE, not on the drive itself. Make the image first — with dd on Linux and macOS, with Win32 Disk Imager or USB Image Tool on Windows — and work from the copy. Reading a failing drive over and over is what finishes it off.
- A deleted file is recovered on the assumption that its pieces lay in one run. That is true of almost everything a camera writes and often untrue on a drive that has been filled and emptied for years — which is why every result here is checked, and the ones that do not check out are kept apart.
- If the clusters of a deleted file now belong to an existing one, the data is gone. Such entries are listed as overwritten rather than handed over as a file that will not open.
- exFAT and NTFS images are recognised but their directories are not read yet. Carving still recovers the files themselves — what is lost is the original names and folders.
