USB flash drive and memory card data recovery: Everything you need to know

Portable flash media, including USB flash drives, SD cards, microSD cards and CompactFlash cards, are widely used to transfer files and expand storage in cameras, smartphones, drones and other devices. While generally more resistant to physical shock than mechanical hard drives, they are frequently connected to different host systems, shared across platforms and unplugged without proper ejection, which can increase the risk of unexpected data loss.

Many data loss incidents involving removable flash media are caused by logical problems rather than physical hardware failure. In such cases, the device may remain physically functional even though the operating system can no longer access or display the files correctly. Successful recovery therefore depends on avoiding further writes and choosing an appropriate approach based on the condition and specific characteristics of the affected storage.

This guide provides a foundational overview of USB flash drive and memory card data recovery, covering common failure types, the structural and hardware peculiarities of portable flash storage, factors affecting recovery prospects and essential precautions for maximizing recovery success.

Primary failure types

Data loss scenarios on removable flash media, including USB sticks and memory cards, generally fall into two main categories, although some incidents may involve a combination of logical and physical problems:

• Physical and electrical failures: The storage hardware, electrical circuitry or low-level controller firmware is damaged or severely degraded, preventing reliable communication with the computer. Problems can range from bent USB connectors, cracked microSD substrates and liquid corrosion to failed electronic components and heavily degraded NAND flash that produces persistent I/O errors. At the controller level, failures involving translation tables, firmware or excessive bad-block accumulation can cause the device to become inaccessible, report an abnormal capacity such as 0 MB or 8 MB, or expose a generic controller identification instead of the user volume.

  Data recovery software cannot repair physical or electrical faults. Such cases may require professional laboratory intervention, imaging using specialized hardware, electrical repairs or, depending on the device, direct access to the NAND storage.

• Logical failures: The flash memory and controller hardware remain functional, but the logical structures used to organize the stored data become corrupted or inaccessible. Common causes include abrupt removal during an active read/write operation, accidental file deletion, volume formatting, interrupted partition resizing and filesystem corruption that causes the drive to appear as unallocated or in a "RAW" state.

  When the storage hardware remains stable and the host system can reliably read the underlying sectors, logical data loss can almost always be resolved using specialized data recovery software, without opening or modifying the physical device.

Read more: To learn how to pick the right software for different logical data loss scenarios, see our article on how to choose data recovery software.

Logical data loss: What can and cannot be recovered

When a USB flash drive or memory card remains physically healthy, the chances of recovering lost files depend largely on whether the data has simply been unlinked from the file system or has been overwritten:

• Shallow (metadata-only) data loss: Everyday file deletion and most quick-format operations primarily modify filesystem metadata, marking previously used storage space as available for reuse. The underlying file contents may remain in the storage until they are replaced by subsequent writes. Data recovery software can often reconstruct such files as long as the relevant data has not been overwritten.

• Destructive overwriting (irreversible data loss):

  • Full formatting: Unlike a typical quick format, most full-format procedures write zeros or new patterns across every sector of the drive. This can replace all original file contents and metadata structures, leaving the device completely empty and making conventional software-based recovery impossible.

    Some modern mirrorless cameras, action cams and drones may also perform specialized low-level formatting or reset operations to optimize write speeds for video recording. Therefore, depending on the device and its firmware, formatting a memory card inside a camera may be more aggressive than a standard quick format performed by a computer, potentially reducing the chances of successful recovery.

  • File shredding & secure erasure: File shredders and privacy-wiping utilities intentionally destroy files by zeroing them out or overwriting targeted storage blocks with pseudorandom data, sometimes using multiple passes. Once the original data sectors have been genuinely overwritten, the previous binary contents are permanently destroyed and cannot be restored.

  • Cyclic writing: Dashcams and other recording devices may continuously overwrite older footage as storage space is reused. Once older recordings have been overwritten by newer data, the original footage cannot be recovered from those storage areas.

Read more: To learn more about the factors that determine whether lost data can be recovered, see our article on the chances for data recovery.

Logical and security layers in removable flash media

Beyond the physical flash memory, removable USB flash drives and memory cards rely on file systems, device-specific storage structures and, in some cases, encryption mechanisms that determine how files are organized, accessed and protected:

• Common removable media file systems (FAT32 & exFAT): FAT32 and exFAT are widely used on USB flash drives and memory cards because of their broad compatibility across operating systems and devices. When a file is deleted, the file system generally marks the relevant directory entry and allocation information as available for reuse rather than immediately erasing the underlying data. If the file's allocation information remains sufficiently intact, recovery software may be able to reconstruct the original file. Fragmented files can be more difficult to recover because their data blocks are no longer stored contiguously and their original allocation information may have been partially or completely removed.

• Desktop file systems (NTFS, APFS, EXT4): Removable flash drives may also use file systems designed primarily for desktop operating systems. Some of these file systems use journaling to record metadata or file-system transactions, which can help maintain consistency after an unexpected interruption. However, journal information should not be treated as a complete record of deleted files: its usefulness for data recovery varies by file system, the type of failure and how much subsequent activity has occurred.

  Read more: To learn how file systems affect data recoverability, read our article explaining the chances of data recovery depending on the file system.

• Embedded device media implementations: Action cameras, drones and dashcams may use device-specific recording schemes alongside or in place of a conventional file system. Video recording can involve large files, fragmentation, proprietary metadata or continuously updated indexes. If recording is interrupted before the necessary metadata is finalized, the resulting file may be incomplete or unplayable even when much of the underlying audio and video data remains present. Recovery may therefore require specialized video reconstruction techniques in addition to standard filesystem analysis or signature carving.

• Volume and hardware encryption layers: Portable media can also use encryption to protect data if the device is lost or stolen:

  • Software encryption: Solutions such as BitLocker To Go, encrypted APFS volumes and LUKS can encrypt data at the volume level. When the volume is encrypted, recovery software generally needs valid authentication material, such as a password, recovery key or other supported key material, along with access to the necessary encryption metadata, before it can interpret the underlying filesystem structures.

  • Hardware-encrypted devices: Some secure flash drives incorporate encryption directly into the device controller and may use PIN authentication or dedicated security hardware. If the controller or security subsystem fails, conventional recovery software may be unable to access the underlying data. Recovery can then require specialized hardware and, depending on the device architecture, repair or replacement of the failed components.

  Read more: To learn how encryption affects the data recovery process, see our practical guide to data recovery from encrypted storage.

Hardware, interface and controller specifics

Recovering data from USB flash drives and memory cards also requires taking into account several hardware, interface and controller characteristics that can affect how the removable flash media should be accessed and imaged:

• TRIM and deallocation support: Removable flash media connected through USB bridges or card readers generally do not behave like internal SSDs with respect to TRIM. In most common configurations, deleting a file does not immediately make the underlying NAND contents inaccessible, so the data may remain recoverable until the corresponding storage is reused or erased. However, the exact behavior depends on the device, controller, reader and host system.

• Direct connection vs. host devices: Memory cards should be removed from cameras, drones or smartphones and connected directly to a computer through an appropriate card reader. When a mobile device or camera is connected via USB, it typically exposes files through protocols such as MTP or PTP rather than providing direct block-level access to the storage. This prevents recovery software from accessing the device's raw sectors, unallocated space or underlying partition structures.

• Mechanical and firmware write protection: The physical lock switch on a full-size SD card can signal the card reader and host system to prevent write operations, helping protect existing data from accidental modification. However, support for the switch varies between readers and host systems, and in some cases a locked card may not be detected correctly, which can interfere with imaging or data recovery. Flash controllers may also enter protective or read-only states when they detect certain internal faults. While these states can help prevent further modification, a firmware-enforced read-only state may also indicate an underlying controller or flash-memory problem requiring further diagnosis.

• Connection and power stability: Removable flash media depends on stable physical connections and power supplied through USB ports or card readers. Loose connections, unsuitable hubs or unstable power can cause interruptions during imaging or scanning. For critical recovery work, a direct connection to a reliable USB port and a suitable card reader can help minimize communication problems.

• Counterfeit or capacity-spoofed media: Some fraudulent flash drives are programmed to report a capacity larger than the physical NAND actually installed. Once the genuine physical capacity is exceeded, new data may overwrite previously stored data or become corrupted, potentially destroying earlier files and filesystem structures. Such media can therefore have substantially lower recovery prospects once they have been used beyond their true capacity.

• Monolithic construction: Some microSD cards, compact USB flash drives and other small flash devices use monolithic or highly integrated constructions in which the controller, NAND and electrical connections are packaged together. When such a device fails, conventional chip removal may not be possible. Specialized laboratory recovery can involve exposing internal test points and accessing the NAND directly using specialized techniques.

When to use software (DIY) vs. professional lab services

Whether a removable flash medium can be handled with data recovery software or requires professional laboratory intervention depends primarily on how the device is detected and whether it remains stable during access.

• Software recovery (DIY) is generally applicable when the USB flash drive or memory card is recognized by the operating system, reports its expected capacity and remains stable during read operations. Typical cases include accidentally deleted files, formatted or inaccessible partitions, corrupted file systems (such as a RAW volume or a drive that prompts the user to format it), and lost partitions or accidentally repartitioned volumes.

  Read more: For practical guidance on recovering data from common logical failures, see our articles on recovering data from a RAW partition and restoring deleted files.

• Professional laboratory intervention is recommended when the device shows signs of hardware, controller or flash-memory failure. Warning signs include an incorrect or zero reported capacity (for example, 0 MB or 8 MB), detection under a generic controller or factory name without access to the user's data, or no reaction from the computer when the storage is connected. Severe physical damage, such as cracked components, heat damage or water corrosion, is another clear indication that conventional software-based recovery is impossible.

  Some portable flash storage devices, particularly monolithic cards and other non-standard or physically inaccessible media, may require specialized laboratory techniques to access the underlying NAND storage. Depending on the device, this may involve board-level diagnostics, micro-soldering or direct NAND extraction. These procedures are outside the scope of data recovery software.

Safety precautions for removable flash media recovery

Removable flash media such as SD cards, microSD cards and USB flash drives can be particularly vulnerable to further data loss once a problem occurs. The priority should therefore be to minimize further changes to the media and preserve its current state before attempting recovery:

• Safely eject the device and cease new writes: Never remove the device while it is being accessed or during an ongoing operation. Once data loss occurs, stop all write operations immediately to avoid overwriting recently freed storage blocks.

• Avoid in-place repair utilities: Do not run CHKDSK, First Aid or similar repair tools, and do not accept operating system prompts to format an unreadable drive. Such operations can modify filesystem metadata and potentially overwrite remnants of the original directory structure, reducing the chances of recovery.

• Check the physical write-protect switch: On full-size SD cards, make sure the mechanical lock switch is not damaged or stuck in the locked position. A locked switch can prevent normal write access and, depending on the reader and operating system, may also interfere with imaging or other low-level operations.

• Create a disk image first: If the media is unstable or shows signs of failure, create a sector-by-sector image before attempting extensive recovery operations. Whenever possible, perform recovery from the image rather than repeatedly accessing the original card or USB flash drive.

Read more: For a detailed overview of safe recovery procedures, see our practical guide on recovering data from portable storage devices, with dedicated guides covering USB flash drive recovery and memory card recovery.

Last update: August 27, 2026

If you liked this article, you can share it on social media: