How to Check Old Drives for Recoverable Files Before Throwing Them Away

Theo Lucia
Theo Lucia updated
5 min(s)

Use a read-only recovery workflow first, but do not treat “nothing found” as proof that the media contains no recoverable data. In this r/datarecovery case, the user had a mix of old flash drives, SD cards, and hard drives—some possibly unformatted or corrupt—and wanted a free, open-source way to check them before disposal. A bootable Linux environment is a good fit for that job.

Do Not Modify the Source First

Do not format, initialize, repair, or write zeros to a drive until you have decided there is nothing on it you want to keep. If a drive is slow, disconnecting, or reporting read errors, image it before scanning it repeatedly.

Use SystemRescue for the First Pass

SystemRescue is a bootable Linux environment that already includes TestDisk, PhotoRec, and GNU ddrescue. That makes it more practical for this scenario than building a full forensic workstation. Use TestDisk when the partition or file system may still be recoverable, and use PhotoRec when you want to carve files from the underlying data even if the file system is damaged or reformatted.

Handle Each Drive by Its State
  • The drive is detected normally and reads without errors: scan it with TestDisk or PhotoRec and save anything important to a different drive.
  • The drive is unformatted or the file system is corrupt but reads steadily: PhotoRec can still search the underlying data without relying on the damaged file system.
  • The drive is slow, disconnecting, or has bad sectors: use ddrescue to make an image or clone first, then scan the copy. Do not keep stressing the original just to make the scan more “thorough.”
  • The scan finds nothing: that is useful evidence, but not a mathematical guarantee that no specialist could recover anything from the device.

Recovery Scanning Is Not the Same as Safe Disposal

If the goal is to throw the media away, scanning is only the first half of the job. After you recover anything worth keeping, sanitize the device using a method appropriate to that media before disposal. NIST's SP 800-88 Rev. 2 defines sanitization as making access to target data infeasible for the intended level of effort. If a failing drive cannot be reliably sanitized or verified, physical destruction is safer than assuming a failed recovery scan means the old data is gone.

For this Reddit scenario, the practical workflow is therefore: boot SystemRescue, image any unstable media first, scan stable media with TestDisk or PhotoRec, copy out anything important, and only then sanitize or destroy the devices you are ready to discard.

Free Download
Free Download