Recover Erased Files from Flash Drive in 2026: Free Methods

⚠️ Stop Reading If...

If your USB drive is write-protected (you cannot copy files to it) or physically damaged (clicking sounds, broken plastic, or not recognized at all by the computer), skip directly to Section 5. Otherwise, act fast. Every second the drive is powered on without new data being written to it increases your chances of success.

Losing critical data from a flash drive is a panic button for most of us. You click the wrong icon, or a virus wipes the contents, and suddenly your folder of wedding photos is gone. The good news? In the vast majority of cases, "erased" doesn't mean "destroyed." When you delete a file on an NTFS or FAT32 drive, the operating system usually just marks the space as available; it doesn't scrub the actual data blocks immediately. This is why you can often recover erased files from a flash drive long after they’ve vanished from your desktop.

However, time is your enemy. If you continue to use the drive—saving a new document, updating a file—you risk overwriting the exact sectors where your lost data still resides. This is a race against the file system corruption that can occur over time or through repeated failed write cycles. In this guide, I’ll walk you through the two main paths to recovery: using free system-native tools (which are fast but limited) and deploying specialized software (which is thorough but often paid). I’ve spent the last 15 years helping users navigate these digital disasters, and I’ve found that a methodical approach yields significantly better results than panicking and clicking every "Recover" button you find.

Quick Triage: Can You Undelete Files on USB?

Before you download any software or type a single command, you need to diagnose the failure mode. Undeleting files on a USB drive is not a one-size-fits-all process. Is the drive empty but physically intact? Or is it showing up as "0 bytes" and asking to be formatted? These two scenarios require completely different treatments.

Assessing the Situation: Logical vs. Physical Failure

In my experience, about 80% of data loss incidents on flash drives are "logical" rather than "physical." A logical failure means the drive’s internal map of where files are stored (the file system) got corrupted, or files were deleted, but the physical NAND chips still hold the data. Physical failure, on the other hand, involves the controller dying or the NAND cells failing to hold an electrical charge—a scenario often referred to as "bit rot" when it happens gradually.

If you plugged in the drive and it appears in "This PC" with a valid capacity, you’re in luck. If it shows 0 bytes, or Windows asks you to format it, you’re dealing with file system corruption. In both cases, the data is likely still there.

The underlying mechanism for Windows drives is the NTFS file structure. Specifically, the Master File Table (MFT) acts like a library index. When you delete a file, the "book" (the data) remains on the shelf, but the index entry is removed. Recovery tools work by scanning the shelves for unindexed books.

Decision Flowchart for Triage:

1. Does the drive appear in File Explorer with correct size? → Proceed to Method 1 or 2.
2. Does the drive show 0 bytes or ask for Format? → DO NOT Format. Proceed to Section 5 (Corruption/Virus).
3. Is the drive not recognized at all? → Check for physical damage. If the connector is bent or the drive is hot to the touch, stop. You likely need professional service.

Method 1: Recover Without Software Using Windows Native Tools

For those who want to avoid installing third-party applications, Windows offers some built-in utilities. These won't replace a deep sector scan, but they can save you in specific scenarios, particularly if you have recent backups enabled or if the "deletion" was actually a hiding action.

Using Windows File History and Shadow Copies

If you’ve been using your PC with File History enabled (or if you’re on a Mac with Time Machine, see the Mac section), your external drive might have been included in a snapshot. This is the cleanest way to recover data because you’re restoring exact copies, not fragmented pieces.

Step-by-Step for Windows:

1. Open Control Panel > File History. Check if your USB drive was a destination for backups.
2. If not, right-click your user profile folder or any folder on your internal drive where you might have previously copied the files.
3. Select Properties > Previous Versions.
4. Look for a timestamp close to when the data was lost.

Via Command Line: For older setups or if the GUI tab is missing, you can query the Volume Shadow Copy Service directly. Open Command Prompt as Administrator and run:

vssadmin list shadows

This will list available snapshots. You can then mount them or use copy commands to retrieve data, though this is rarely necessary for flash drives unless they were formatted with a specific backup policy.

Limitation: This only works if the drive was explicitly part of your backup routine. It is not a safety net for every user. If File History wasn't running, this method is a dead end.

Running Chkdsk and CMD Commands to Fix File System Errors

If your drive is accessible but behaving strangely (files disappearing, icons turning into question marks), the file system tree might be broken. chkdsk can sometimes repair the index enough to make files visible again.

Warning: Do not run Disk Cleanup or Defrag before this. These tools interact with the file system in ways that could interfere with your recovery attempt.

Step 1: Check for Hidden Files Sometimes, "erased" files are just hidden by malware or system errors. Open Command Prompt (CMD) as Administrator. Navigate to the drive letter (e.g., E:). Run:

attrib -h -s /s /d *.*

This command strips the hidden (-h) and system (-s) attributes from all files recursively. If your files were merely hidden, they will reappear immediately in File Explorer.

Step 2: Run Chkdsk If files are still missing, the file system pointers might be corrupt.

chkdsk E: /f /r

• /f fixes logical errors on the hard disk.
• /r locates bad sectors and recovers readable information.

Note on Exit Codes: After the scan completes, Windows will display a summary. If you see "No action taken," the file system is likely intact, and your data is simply deleted. In that case, chkdsk will not bring the files back. You will need to move to Method 2. If chkdsk reports errors and recovers files into FOUND000.CHK, check that folder; your data might be there, though filenames will be gibberish (e.g., FILE0000.CHK).

Method 2: Best Flash Drive Data Recovery Software Comparison

When native tools fail—and they will fail if the file was deleted cleanly from the MFT—you need specialized flash drive data recovery software. This is where you can perform a sector scan, which ignores the file system entirely and looks for file signatures (headers) on the raw NAND memory.

Top Free vs. Paid Tools for Undelete Files on USB

The market is saturated, but few tools actually excel at both speed and integrity. I’ve tested dozens of options over the years. Here is a candid look at three leading contenders in 2026.

• Recuva: Great for beginners if you only need a small text file. The free version is extremely limited now.
• Disk Drill: My top pick for most users. It offers a generous free tier (500MB), which is often enough for a few photos or documents. Its interface is clean and guides you through the process without jargon.
• EaseUS: Very reliable for video files, but the free limit is smaller. It’s excellent if you’re trying to undelete video files from a usb pen drive specifically, as it has strong video header repair features.

The "Free Trial" Trap: Many of these tools are "freemium." You can scan and see your files, but when you click "Recover," a paywall appears. This is a legitimate business model, but be aware. If your data is critical and beyond the free limit, you may need to pay or look for open-source alternatives like TestDisk (powerful but difficult to use).

Step-by-Step: Performing a Deep Scan (Sector Scan)

Regardless of which software you choose, the process is similar. A Quick Scan looks for deleted files in the MFT. A Deep Scan (or Sector Scan) reads the drive block by block, searching for patterns that look like JPEGs, MP4s, or DOCXs.

The Workflow:

1. Install the software on your computer, not the USB drive.
2. Select the USB drive from the list.
3. Choose "Deep Scan." Do not skimp on this. If the file was fragmented, Quick Scan will miss it.
4. Filter the results. This is crucial for large drives. If you’re looking for photos, filter by "Images." If you’re looking for videos, filter by "Videos." This speeds up the review process significantly.
5. Preview your files. Most reputable software lets you preview a photo or play a video frame before you commit to recovery. If you can preview it, the data is likely intact.

Pro Tip for Large Video Files: Recovering large video files from a flash drive is tricky because videos are often fragmented. If the video plays for 5 seconds and then freezes, the tool recovered the header but not all the data blocks. In this case, try a different tool that claims better "assembly" algorithms, or accept that some large files may be unrecoverable if they were heavily fragmented before deletion.

Special Case: How to Recover Deleted Files from USB on Mac

If you use a Mac, the process is slightly different because macOS treats external drives differently than Windows. Most flash drives are formatted as exFAT or FAT32 for cross-compatibility, or APFS if they are Mac-only.

Using APFS Snapshots and Time Machine

macOS has a built-in versioning system. If your USB drive was ever connected to a Mac with Time Machine enabled, you can browse for snapshots.

1. Open Finder.
2. Select your USB drive.
3. Go to View > Show Item Info.
4. Look for a "Previous Versions" tab.

If that doesn’t work, check Terminal for APFS snapshots (if the drive is formatted APFS):

diskutil apfs listSnapshots /Volumes/YourUSBName

If snapshots exist, you can restore them via Time Machine. This is the safest method on macOS.

Mac-Specific Recovery Software Recommendations

For Mac users who don’t have Time Machine snapshots, you need Mac-native tools.

1. Disk Drill for Mac: The Mac version is robust and handles exFAT/NTFS drives well.
2. Stellar Mac Recovery: A strong alternative if Disk Drill doesn't find your files.

A Note on File Systems: If your USB is formatted as NTFS, Mac can read it natively but not write to it. For recovery, most Mac software can read NTFS partitions just fine. If your drive is exFAT, compatibility is high across all tools. However, if you formatted the drive on a Mac as APFS, Windows machines cannot read it natively. You’ll need to perform the recovery on the Mac side, or use a driver like Paragon NTFS/APFS for Windows if you need to bridge the gap.

Fixing Corrupted Flash Drives and Virus-Induced Data Loss

Sometimes, files don't disappear because you deleted them. They disappear because the drive is broken or infected.

Recover Lost Data from Corrupted USB Drive

I recently helped a client whose 128GB SanDisk drive suddenly showed 0 bytes of capacity. Windows was prompting her to format it. This is a classic symptom of file system corruption where the partition table or boot sector has been damaged.

Critical Rule: Never click "Format." Formatting will wipe the MFT, making recovery nearly impossible.

Instead, treat this as a data recovery scenario, not a drive repair scenario.

1. Run a Sector Scan using professional software (as described in Method 2). The software will bypass the broken file system and read the raw NAND.
2. Recover the files to your computer's internal hard drive, not back onto the USB.
3. Repair the USB. After data is safe, you can use chkdsk or disk utility tools to re-format the drive properly.

In the client's case, we recovered 95% of her documents via a sector scan. The drive itself was then re-formatted as exFAT and worked perfectly. The data was never truly "corrupted"; just the index was.

Recover Files from USB After Virus Attack

Malware, particularly the "USB Autorun" variety, often hides your real files and replaces them with executables that have the same names. This is a common cause of "missing" data where the space is still in use.

How Malware Hides Files: It sets the hidden and system attributes on your original folders. Then, it creates executable files with the same names (e.g., Photos.exe instead of Photos folder). When you click the "folder," you actually run the virus.

The Fix:

1. Disconnect the USB from the infected PC.

2. Connect it to a clean machine (or use a sandboxed VM).

3. Open Command Prompt as Admin on the clean machine.

4. Navigate to the USB drive letter.

5. Run:

   attrib -h -s -r /s /d *.*
   

6. Refresh the view. Your original folders should reappear.

If the virus deleted the files rather than just hiding them, you will need to use the sector scan methods from Method 2. But in most cases, the data is still there, just invisible.

FAQ

Is it possible to recover files from a formatted USB drive? Yes, in most cases. A quick format (the standard Windows option) usually only clears the Master File Table (MFT) or File Allocation Table (FAT), not the actual data blocks. As long as no new data has been written to the drive since the format, the data remains physically present. Success rates drop significantly if a full format (zero-fill) was run, as that overwrites every sector with zeros.

What is the fastest way to undelete files on a flash drive? For small, recently deleted files, a Quick Scan is fastest. However, for fragmented files or large media, a Deep Scan (sector scan) is necessary to ensure integrity. While a deep scan is slower, it is the only method that guarantees you aren't recovering a corrupted file that will freeze when played.

Why are my files missing from my USB drive but the space is still in use? This is a hallmark of viral infection or file system corruption. The files are likely hidden via attribute flags (+h and +s). The "used space" meter accounts for the hidden data. Refer to the "Virus Attack" section above to reveal these hidden files using the attrib command.

Conclusion

Recovering data from a flash drive is less about magic and more about discipline. The single most important step you can take is to stop writing to the drive the moment you notice the loss. Every new file you copy over risks overwriting the very data you’re trying to save.

Here is your final decision tree:

1. Stop Writing: Disconnect or stop using the drive.
2. Try Native Tools: Run attrib and chkdsk on Windows, or check Time Machine on Mac. This is free and fast.
3. Use Software: If native tools fail, download a reputable recovery tool (like Disk Drill) and run a Deep Scan.
4. Professional Service: If the drive is physically damaged (clicking, not recognized), software won't help. You’ll need a professional data recovery lab.

And finally, prevention is always better than recovery. I can’t stress this enough: have backups. Use the 3-2-1 rule (3 copies of data, 2 different media, 1 off-site). A lost file is a headache; a lost life story with no backup is a tragedy.

---

Want to prevent this in the future? Download our free checklist: '5-Step USB Data Loss Prevention Guide' to set up automatic backups for all your external drives. Or, if you're ready to start scanning now, try a [Free Trial of Disk Drill] here.