Data Recovery Assistant: First Aid and Disk-Imaging Guide
The routes that cost nothing first, then a safe image of your card or drive.
A web page cannot read a memory card, USB stick or disk directly (browsers block it), so MySmartCoPilot cannot scan a device itself. This assistant shows the routes that cost nothing first, then how to make an image of the card or drive that the scanners on this site can read.
Your plan, in order
Make an image of the card or drive
Copy the right way round. The card or drive is only ever the source; the image is a new file on a different drive. Swapping them overwrites the card.
Windows has no built-in tool that copies a card or USB drive sector by sector, so imaging on Windows needs a separate program. Try Windows File Recovery first: it needs no image.
Windows File Recovery: the command
Win32 Disk Imager (free)
- Install Win32 Disk Imager and plug in the card.
- Under Device, pick the card’s drive letter. Under Image File, choose a new file such as
D:\card.imgon another drive. - If your version offers to read only allocated partitions, leave that off, so every sector is copied.
- Click Read. Never Write: that copies the other way and overwrites the card.
FTK Imager (free), also for a card without a drive letter
A card that Windows shows without a drive letter (unformatted or “RAW”) cannot be picked in Win32 Disk Imager. FTK Imager reads the physical drive itself:
- Choose File > Create Disk Image, select Physical Drive and pick the card (check its size).
- Click Add, choose the image type Raw (dd), and fill in or skip the evidence details.
- Pick a folder on another drive and a file name, and set Image Fragment Size to 0 to get one file. (Otherwise FTK Imager saves the image in parts of 1,500 MB: choose all of them together on this site.)
- Click Finish, then Start.
Disk Utility (no Terminal)
- Open Disk Utility and choose View > Show All Devices.
- Select the card itself in the sidebar (the device, not the volume under it).
- Choose File > New Image, then Image from “…”.
- For Format choose DVD/CD master (it copies every sector, used or not), pick a folder on another disk, and click Save. The result is a .cdr file.
Apple’s guide says not to use Disk Utility on a disk you believe to be failing, and that APFS containers on Macs with Apple silicon or a T2 chip cannot be imaged this way.
Terminal (dd)
Run diskutil list first and find the card by its size, marked (external, physical). rdisk is the raw device, which reads past the buffer cache. dd prints nothing while it works: press Ctrl+T to see how far it has got. It asks for your Mac password (sudo).
Find the card in the lsblk output by its size. The umount line unmounts the card and its partitions; it may say some of them are not mounted, which is fine. status=progress shows the progress (GNU dd). ddrescue (package gddrescue on Debian and Ubuntu) copies the good parts first; keep the mapfile: with it, the same command goes on where it stopped.
When the image is made, open it in SD Card & USB Drive Recovery (deleted files with their names) or Photo & Video Recovery (deep scan after a format).
About the Data Recovery Assistant: First Aid and Disk-Imaging Guide
Something was deleted, formatted or lost. Answer four questions and the assistant puts the routes in the right order for you: first the ones that cost nothing and often work at once (the Recycle Bin or Trash, Recently Deleted in Apple Photos and Messages, the Google Photos, Google Drive and OneDrive trash, File History, Time Machine, Office’s AutoRecover copies, Microsoft’s Windows File Recovery), then, if those fail, how to make a safe disk image of a memory card or USB drive.
A web page cannot read a card, stick or disk directly, so MySmartCoPilot cannot scan a device itself. The imaging steps are given for Windows, macOS and Linux, with the exact commands to copy and checks that catch the dangerous mistakes (a partition instead of the whole device, the system disk, the same drive as source and destination). The image then opens in the undelete scanner or the deep scan on this site.
How to use it
- Answer what you lost, where it was, when it was deleted and whether the card or drive still works.
- Work through the plan from the top: each step says why it might work and links Apple’s, Google’s or Microsoft’s own instructions.
- If none brings the files back, stop using the card or drive and make an image of it with the steps for your computer, on a different drive.
- Open the image in SD Card & USB Drive Recovery (deleted files with their names) or Photo & Video Recovery (deep scan after a format).
Examples
Photos or videos · A memory card · In the last 30 days · Works normally
winfr E: D: /extensive /n *.jpg /n *.jpeg /n *.png /n *.heic /n *.cr2 /n *.nef /n *.arw /n *.dng
Cards formatted FAT32 or exFAT need Windows File Recovery’s Extensive mode, and the results must go to a different drive (here D:).
The card is disk4 in diskutil list
diskutil unmountDisk /dev/disk4 sudo dd if=/dev/rdisk4 of="$HOME/Desktop/card.img" bs=1m
if= is the card and of= the new image file; swapping them would overwrite the card. Press Ctrl+T while dd runs to see its progress.
/dev/sdb clicks and gives read errors
sudo ddrescue -d /dev/sdb "$HOME/card.img" "$HOME/card.map"
GNU ddrescue copies the good parts first; the mapfile lets you run the same command again to go on where it stopped.
Common uses
- Finding out, in a minute, whether a deleted photo is still in a trash folder or a cloud bin.
- Getting the exact Windows File Recovery command for a memory card or USB drive.
- Making a safe image of a card before scanning it, on Windows, macOS or Linux.
- Knowing when to stop: TRIM on internal SSDs, full formats and encryption leave nothing to find.
The routes that cost nothing
- Recycle Bin and Trash: select the files and right-click Restore (Windows) or choose File > Put Back (Mac). They go back where they were deleted from. Both keep files until they are emptied, so look even after a long time (Microsoft, Apple).
- Apple Photos: the Recently Deleted album keeps photos and videos for 30 days (Apple). Messages on a Mac: View > Recently Deleted, for up to 30 days (Apple).
- Google Photos and Google Drive: deleted items stay in the trash for 30 days (Google Photos Help, Google Drive Help).
- OneDrive: files deleted within the last 30 days (personal accounts) or 93 days (work or school accounts, unless the administrator changed it) can be restored from its recycle bin (Microsoft).
- File History on Windows: right-click the folder, Restore previous versions (Microsoft); Time Machine on a Mac (Apple).
- Unsaved Office files: the Document Recovery pane after a crash, and Recover Unsaved Workbooks or Presentations in Excel and PowerPoint (Microsoft).
- Windows File Recovery: Microsoft’s command-line app for Windows 10 and 11, from the Microsoft Store. Extensive mode for FAT and exFAT; the destination must be a different drive (Microsoft).
Why an image, and what it needs
Recovery should never write to the card or drive it is recovering, and a web page cannot read a device directly anyway. An image is a single file with every sector of the device, used or not; it is read once, and every scan after that works on the copy. It needs free space on another drive at least as large as the whole card or disk (a 64 GB card makes a 64 GB image), and time: the assistant estimates it from the size and your reader’s speed.
On macOS, Disk Utility makes one without Terminal (format DVD/CD master, which copies all sectors), or dd from the raw device. On Linux, dd with status=progress, or GNU ddrescue with a mapfile for a failing device. Windows has no built-in tool that images a card sector by sector, so the assistant names the free programs Win32 Disk Imager and FTK Imager. Sources: Apple Disk Utility, GNU dd, GNU ddrescue, Win32 Disk Imager, FTK Imager.
When there is nothing left to find
- Internal SSDs: Windows (7 and later) and Macs with Apple SSDs send TRIM when a file is deleted, and the SSD then erases those blocks, so files deleted from an internal SSD are almost always gone (R-Studio). Over USB, TRIM support is patchier (DiskDigger).
- A full format writes over every sector: Windows
format /Pzeroes each one (Microsoft). A quick format leaves the data. - Overwritten data (new photos taken, files copied) cannot be brought back by any software.
- Encrypted drives need their key.
Limitations
- The assistant gives instructions; it does not read your card or drive (no web page can).
- The commands follow the manuals of each system’s own tools. Check the device name twice before running one: a wrong device can be overwritten.
- Cloud and trash retention periods are those the services publish; organisations can set others for work accounts.
Privacy
Your answers stay in this page: nothing is stored or sent. The commands are built in your browser.
Frequently asked questions
Can MySmartCoPilot recover files from my SD card or USB stick directly?
No web page can: browsers do not let pages read storage devices sector by sector. You make an image of the card with the steps here (it is read once and never written to), and the scanners on this site then work on the image, on your own device.
Which should I try first?
The Recycle Bin or Trash, then the cloud trash of any service the files were in (Google Photos, Google Drive, OneDrive, Apple Photos), then backups (File History, Time Machine). They take a minute and keep everything, names and folders included. Imaging and scanning come after.
How do I find which disk is my card?
On a Mac, run diskutil list: the card is marked (external, physical) with its size. On Linux, run lsblk and look for its size. In Win32 Disk Imager, pick the card’s drive letter. When in doubt, unplug the card, run the command again, and see which disk disappeared.
Does Windows File Recovery work on memory cards?
Yes, on FAT and exFAT cards and sticks in its Extensive mode (Microsoft lists FAT and exFAT as Extensive only), on Windows 10 and 11. The recovered files must go to another drive.
Why do the imaging commands need sudo?
Reading a whole device sector by sector needs administrator rights on macOS and Linux. The commands only read from the card (if=) and write to the new image file (of=).
How big will the image be?
As big as the card or drive itself, whatever is on it: a 64 GB card makes a 64 GB image. Enter the size above to see the space and the time it needs.