Quick Answer
When a file is deleted from a flash drive, the file itself is not actually removed from the drive. Instead, the file system just marks the space occupied by the file as being available for new data. The contents of the file remain on the flash drive until that space is overwritten by something else. So in theory, deleted files can be recovered as long as they have not been overwritten. However, the longer a deleted file remains on the drive, the higher the chance it could get partially or fully overwritten and become unrecoverable.
Looking Deeper
To understand what happens when a file is deleted from a flash drive, it helps to understand how file deletion works in general. Here are some key points:
File systems don’t actually delete data
When you delete a file, the operating system does not actually remove the data from the storage device. Instead, it just marks the regions of storage occupied by that file as being available for future write operations. This helps improve performance by not requiring the system to physically erase data every time a file is deleted. The actual data remains on the device until new data overwrites it.
File systems use metadata to keep track of files
The file system maintains metadata – data about data – for all files stored on a volume. This metadata is stored in tables or indexes and tracks information like filename, location of data clusters, size, creation/modification times, permissions, etc. When a file is deleted, most of this metadata is removed from the file system index, marking it as free space. But the actual data remains until overwritten.
Flash drives use the FAT32 file system
Most flash drives today use the FAT32 file system. FAT32 keeps a table to track which data clusters are allocated to each file. When a file is deleted, FAT32 removes the entries for that file from the table, marking its data clusters as available. The deleted file’s data remains intact in those clusters until reused.
Data recovery is possible until overwritten
Because the contents of deleted files are not instantly destroyed, there is a window of opportunity to recover recently deleted data from a flash drive. This relies on the fact that the old data still resides untouched in the drive’s storage cells until it gets gradually overwritten by new data. However, the larger the drive and the more it is reused, the less likely recovery becomes.
When Deleted Files Get Overwritten
Deleted files remain recoverable only as long as the space they occupy is not overwritten by new data. Here are some points about how long that takes:
Full overwrite takes time
It can take a substantial amount of time and drive activity before all the clusters from a deleted file get completely overwritten by new data. Each overwrite pass only affects a portion of the deleted file’s space. So recovery remains possible until the entire space is overwritten.
Large drives take longer to overwrite
The larger the storage capacity, the longer it takes to overwrite clusters because there are more of them. For example, overwriting all clusters on a 64GB flash drive will generally take longer than on a 8GB drive. This improves the odds of recovering deleted files from larger drives.
Active use increases overwrite rate
A drive that is actively reading and writing data will experience a higher rate of overwrite operations. The more the drive is used after deletions, the faster unallocated clusters get filled with new data, decreasing recoverability.
Fragmented files overwrite faster
When a deleted file’s contents are split over many non-contiguous clusters, each fragment is more vulnerable to getting overwritten as unrelated data is added. A less fragmented file has better recovery chances.
Recovering Deleted Files
Here are some options for attempting to recover deleted files from a flash drive before they get overwritten:
Undelete software
Special undelete and data recovery software can scan the drive and reconstruct files based on residual metadata and characteristic patterns left on disk. This only works as long as the deleted data still resides untouched on the drive.
Drive imaging
Creating a full forensic image or clone of the drive preserves its current state so recovery can be attempted later without risk of overwrites. But imaging still requires undelete tools to reconstruct deleted files from the clone.
Drive analysis
Forensic analysis tools can scan at the lowest disk sector level and reconstruct files based on residual traces left on the disk, working even if high-level filesystem metadata is missing. But without metadata, filenames and folder paths cannot be recovered.
Turn off the drive
Removing the flash drive and storing it untouched, especially in a cool environment, minimizes the risk of data getting overwritten by another computer. But discharge could still degrade the charge states used to store the data.
Prevention and Precautions
Here are some precautions that can improve the chances of recovering deleted files from a flash drive if needed:
Back up important data
Maintaining backups of important files provides insurance against accidental deletion. Store backups externally from the flash drive to retain copies if the drive fails. Consider using cloud backup services for offsite protection.
Remove less used drives
If a flash drive is not being actively written to, its deleted files remain unaltered for much longer. Eject and securely store little-used drives offline to extend the window for recovery.
Use write-protect tabs
Some flash drives have a sliding plastic tab to switch them into write-protect mode. This prevents accidental overwrites of deleted data to aid recoverability. But it also stops legitimate file changes.
Compress rarely used files
Compressing infrequently accessed files into a smaller number of clusters reduces their surface area for getting overwritten. But compression makes contents harder to recover.
Conclusion
In summary, deleted files remain recoverable from flash drives as long as their storage clusters have not yet been reallocated and overwritten by new data. But recovery becomes less likely over time as normal drive usage gradually overwrites previously deleted data. Taking precautions such as backing up important files and protecting little used drives can help preserve deleted data for recovery if needed. With the right tools and proper care, undeleting lost files from flash drives remains possible in many cases.
