I use Windows XP. I was moving holiday snaps (jpegs) from a USB memory stick
to a folder on my laptop C drive. Unfortunately I used cut/paste rather than
copy/paste, and the computer froze after having apparently transferred 220 or
so pictures. I had to disconnect from the mains and remove the battery before
I could reboot. I let the machine run a disk check. When it rebooted, the
files which had apparently already been cut and moved before the crash were
not visible either on the peg or in the destination folder on the hard drive.
(The remaining, un-cut files were still on the peg).

I have found a file apparently made or modified at the time of the crash:

c:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A

which is about half a megabyte in size, and some apparently associated
smaller files also in the FS folder (OBJECTS.MAP etc.).

Are these anything to do with my lost pictures ? and is there any way I can
retreive/restore them?
I presume that, as I watched it transfer 200+ files before it crashed, they
must be on the hard drive in some format or other....
Instructions in VERY SIMPLE terms please as I am not very computer literate.

Many thanks

I have recovered images from crapped out flash (thumb) drives using this
tool

http://www.cgsecurity.org/wiki/PhotoRec

Step by step instructions are here:

http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step

The most important thing is to NOT write any additional data to the thumb
drive until after you have recovered the images





"SteveButler" <SteveButler@discussions.microsoft.com> wrote in message
news:0B259A09-6A4E-4BC2-AE68-48D1B5711ED2@microsoft.com...
> I use Windows XP. I was moving holiday snaps (jpegs) from a USB memory
> stick
> to a folder on my laptop C drive. Unfortunately I used cut/paste rather
> than
> copy/paste, and the computer froze after having apparently transferred 220
> or
> so pictures. I had to disconnect from the mains and remove the battery
> before
> I could reboot. I let the machine run a disk check. When it rebooted, the
> files which had apparently already been cut and moved before the crash
> were
> not visible either on the peg or in the destination folder on the hard
> drive.
> (The remaining, un-cut files were still on the peg).
>
> I have found a file apparently made or modified at the time of the crash:
>
> c:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A
>
> which is about half a megabyte in size, and some apparently associated
> smaller files also in the FS folder (OBJECTS.MAP etc.).
>
> Are these anything to do with my lost pictures ? and is there any way I
> can
> retreive/restore them?
> I presume that, as I watched it transfer 200+ files before it crashed,
> they
> must be on the hard drive in some format or other....
> Instructions in VERY SIMPLE terms please as I am not very computer
> literate.
>
> Many thanks
>

SteveButler wrote:

> I use Windows XP. I was moving holiday snaps (jpegs) from a USB memory stick
> to a folder on my laptop C drive. Unfortunately I used cut/paste rather than
> copy/paste, and the computer froze after having apparently transferred 220 or
> so pictures. I had to disconnect from the mains and remove the battery before
> I could reboot. I let the machine run a disk check. When it rebooted, the
> files which had apparently already been cut and moved before the crash were
> not visible either on the peg or in the destination folder on the hard drive.
> (The remaining, un-cut files were still on the peg).
>
> I have found a file apparently made or modified at the time of the crash:
>
> c:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A
>
> which is about half a megabyte in size, and some apparently associated
> smaller files also in the FS folder (OBJECTS.MAP etc.).
>
> Are these anything to do with my lost pictures ? and is there any way I can
> retreive/restore them?
> I presume that, as I watched it transfer 200+ files before it crashed, they
> must be on the hard drive in some format or other....
> Instructions in VERY SIMPLE terms please as I am not very computer literate.
>
> Many thanks

When you yanked power, the buffers for the hard disk did not get flushed
(written to the hard disk). That means anything in them not yet
committed got vaporized. There could have also been file corruption
which got fixed on bootup and the corrupted files are gone and may
include your partially copied files or the folder where they would've
been copied.

Items deleted from removable media (floppy, CD/DVD, USB drives) are
deleted rather than moved to the Recycle Bin. So you can't recover the
deleted files on the USB drive from the Recycle Bin.

There's Smart Undelete which claims their trial version is fully
functional. Never used it. Just don't write anything on your USB drive
in the meantime.

"gerryf" <gerryf@community.nospam> wrote in message
news:36163232-4A84-40DE-A350-6419861A38E4@microsoft.com...
>I have recovered images from crapped out flash (thumb) drives using this
>tool
>
> http://www.cgsecurity.org/wiki/PhotoRec
>
> Step by step instructions are here:
>
> http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
>
> The most important thing is to NOT write any additional data to the thumb
> drive until after you have recovered the images
>
Strangely, while that advice is perfectly sound for the more normal types of
drive, it is not so relevant to USB thumb drives or indeed any type of FLASH
memory device. This is because when you perform a write to these devices,
the new data is written to the least recently used data block. This is to
even out the wear to the limited life parts of the device. Overwriting
doesn't become a problem until sufficient material is written such that any
block that contains what you wish to recover becomes the least recently
written block.

That's true, but given the size of a flash drive (1gb to 2 gb being the most
common now, though there are larger drives out there), you can easily
overwrite the areas containing the data you want with with a large block of
files

It is best not to use the drive at all until you have recovered your data





"M.I.5¾" <no.one@no.where.NO_SPAM.co.uk> wrote in message
news:48104633$1_1@glkas0286.greenlnk.net...
>
> "gerryf" <gerryf@community.nospam> wrote in message
> news:36163232-4A84-40DE-A350-6419861A38E4@microsoft.com...
>>I have recovered images from crapped out flash (thumb) drives using this
>>tool
>>
>> http://www.cgsecurity.org/wiki/PhotoRec
>>
>> Step by step instructions are here:
>>
>> http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
>>
>> The most important thing is to NOT write any additional data to the thumb
>> drive until after you have recovered the images
>>
> Strangely, while that advice is perfectly sound for the more normal types
> of drive, it is not so relevant to USB thumb drives or indeed any type of
> FLASH memory device. This is because when you perform a write to these
> devices, the new data is written to the least recently used data block.
> This is to even out the wear to the limited life parts of the device.
> Overwriting doesn't become a problem until sufficient material is written
> such that any block that contains what you wish to recover becomes the
> least recently written block.
>

"gerryf" <gerryf@community.nospam> wrote in message
news:9179E8D3-6076-4156-A95F-5B5C2C06D475@microsoft.com...
> That's true, but given the size of a flash drive (1gb to 2 gb being the
> most common now, though there are larger drives out there), you can easily
> overwrite the areas containing the data you want with with a large block
> of files
>
> It is best not to use the drive at all until you have recovered your data
>

1 to 2 Gb??? Tiddlers.

The smallest thumb drive I use is 4Gb.

>
>
>
>
> "M.I.5¾" <no.one@no.where.NO_SPAM.co.uk> wrote in message
> news:48104633$1_1@glkas0286.greenlnk.net...
>>
>> "gerryf" <gerryf@community.nospam> wrote in message
>> news:36163232-4A84-40DE-A350-6419861A38E4@microsoft.com...
>>>I have recovered images from crapped out flash (thumb) drives using this
>>>tool
>>>
>>> http://www.cgsecurity.org/wiki/PhotoRec
>>>
>>> Step by step instructions are here:
>>>
>>> http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
>>>
>>> The most important thing is to NOT write any additional data to the
>>> thumb drive until after you have recovered the images
>>>
>> Strangely, while that advice is perfectly sound for the more normal types
>> of drive, it is not so relevant to USB thumb drives or indeed any type of
>> FLASH memory device. This is because when you perform a write to these
>> devices, the new data is written to the least recently used data block.
>> This is to even out the wear to the limited life parts of the device.
>> Overwriting doesn't become a problem until sufficient material is written
>> such that any block that contains what you wish to recover becomes the
>> least recently written block.
>>

I said the most common in use--you are obviously not the most common in
use...in fact, I am probably over estimating.






"M.I.5¾" <no.one@no.where.NO_SPAM.co.uk> wrote in message
news:4810957c$1_1@glkas0286.greenlnk.net...
>
> "gerryf" <gerryf@community.nospam> wrote in message
> news:9179E8D3-6076-4156-A95F-5B5C2C06D475@microsoft.com...
>> That's true, but given the size of a flash drive (1gb to 2 gb being the
>> most common now, though there are larger drives out there), you can
>> easily overwrite the areas containing the data you want with with a large
>> block of files
>>
>> It is best not to use the drive at all until you have recovered your data
>>
>
> 1 to 2 Gb??? Tiddlers.
>
> The smallest thumb drive I use is 4Gb.
>
>>
>>
>>
>>
>> "M.I.5¾" <no.one@no.where.NO_SPAM.co.uk> wrote in message
>> news:48104633$1_1@glkas0286.greenlnk.net...
>>>
>>> "gerryf" <gerryf@community.nospam> wrote in message
>>> news:36163232-4A84-40DE-A350-6419861A38E4@microsoft.com...
>>>>I have recovered images from crapped out flash (thumb) drives using this
>>>>tool
>>>>
>>>> http://www.cgsecurity.org/wiki/PhotoRec
>>>>
>>>> Step by step instructions are here:
>>>>
>>>> http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
>>>>
>>>> The most important thing is to NOT write any additional data to the
>>>> thumb drive until after you have recovered the images
>>>>
>>> Strangely, while that advice is perfectly sound for the more normal
>>> types of drive, it is not so relevant to USB thumb drives or indeed any
>>> type of FLASH memory device. This is because when you perform a write
>>> to these devices, the new data is written to the least recently used
>>> data block. This is to even out the wear to the limited life parts of
>>> the device. Overwriting doesn't become a problem until sufficient
>>> material is written such that any block that contains what you wish to
>>> recover becomes the least recently written block.
>>>
>
>

....
> Are these anything to do with my lost pictures ? and is there any way I can
> retreive/restore them?
> I presume that, as I watched it transfer 200+filesbefore it crashed, they
> must be on the hard drive in some format or other....
> Instructions in VERY SIMPLE terms please as I am not very computer literate.

You can try to find and recover your pictures with Easy File Undelete:

http://www.munsoft.com/EasyFileUndelete/

It uses unique modern algorithms to recover files that other software
either recovers incorrectly or is unable to detect.

VanguardLH wrote:
> SteveButler wrote:
>
>> I use Windows XP. I was moving holiday snaps (jpegs) from a USB memory stick
>> to a folder on my laptop C drive. Unfortunately I used cut/paste rather than
>> copy/paste, and the computer froze after having apparently transferred 220 or
>> so pictures. I had to disconnect from the mains and remove the battery before
>> I could reboot. I let the machine run a disk check. When it rebooted, the
>> files which had apparently already been cut and moved before the crash were
>> not visible either on the peg or in the destination folder on the hard drive.
>> (The remaining, un-cut files were still on the peg).
>>
>> I have found a file apparently made or modified at the time of the crash:
>>
>> c:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DAT A
>>
>> which is about half a megabyte in size, and some apparently associated
>> smaller files also in the FS folder (OBJECTS.MAP etc.).
>>
>> Are these anything to do with my lost pictures ? and is there any way I can
>> retreive/restore them?
>> I presume that, as I watched it transfer 200+ files before it crashed, they
>> must be on the hard drive in some format or other....
>> Instructions in VERY SIMPLE terms please as I am not very computer literate.
>>
>> Many thanks
>
> When you yanked power, the buffers for the hard disk did not get flushed
> (written to the hard disk). That means anything in them not yet
> committed got vaporized. There could have also been file corruption
> which got fixed on bootup and the corrupted files are gone and may
> include your partially copied files or the folder where they would've
> been copied.
>
> Items deleted from removable media (floppy, CD/DVD, USB drives) are
> deleted rather than moved to the Recycle Bin. So you can't recover the
> deleted files on the USB drive from the Recycle Bin.
>
> There's Smart Undelete which claims their trial version is fully
> functional. Never used it. Just don't write anything on your USB drive
> in the meantime.

Have you verified your thumb drive by FILLING IT COMPLETELY UP with
files, unplugging it,
replugging it and reading back all the files? File compare is easiest.

Ebay was estimating that virtually ALL thumb drives over 2GB sold on
ebay were fake. And what do you do with your fake drive? You resell
it on ebay or craigslist. Most vendor sites have pages on how to detect
fake flash drives.

I have a "16GB" thumb drive that has a 32MB, yes megabyte, chip in it.
That's an extreme case as most have bigger chips, but still way less
than advertised. Your computer will say that the drive has its full
advertised capacity...those fakers(sp, replace vowels as required
to suit your level of indignation) are very clever.

I can write LOTS of files to it and read them back, because the OS
is caching the data and not actually reading the drive.
When I dismout/remount it, many of the files are missing and most are
empty or corrupted/crosslinked.
Symptoms will vary depending on how your program handles errors.
People who do small data transfers are unaware that their drive
is fake.

I wrote a program to quickly tell if a drive is fake. I'm
looking for cheap/free fake drives to test it.
mike
--
Return address is VALID!
Bunch-O-Stuff Forsale Here:
http://mike.liveline.de/sale.html

"gerryf" <gerryf@community.nospam> wrote in message
news:137BBCB8-EDE6-4151-AD0D-E2C12B3FD90E@microsoft.com...
>I said the most common in use--you are obviously not the most common in
>use...in fact, I am probably over estimating.
>
>

The cutting edge of technology here, old boy.