Recover overwritten files?

By strategic
Aug 12, 2009
  1. I had a friend call who told me he accidentally overwrote a file with an empty file (don't ask).:rolleyes:
    Anyway, he asked if there was anyway to recover it. Until present, I have occasionally undeleted files using " " stand alone version on my jumpdrive. The only thing with this one is, the file was never deleted, it was overwritten (sort of), so I simply replied "it can't be recovered". Now I am starting to think about that.:suspiciou
    What are your thoughts?:monkey:
  2. snowchick7669

    snowchick7669 TS Maniac Posts: 660

    From my understanding you are correct. When deleted, it is just flagged to be over written. But once it has been overwritten then there's something else in its place.

    Maybe forensic type software can delve deeper and locate parts of the file? Not sure, but I have heard that you need to overwrite a file a certain number of times before it is fully gone.
  3. LNCPapa

    LNCPapa TS Special Forces Posts: 4,202   +422

    What operating system are they using? On Windows Vista/7 there is the previous versions option if shadow copies are enabled - this is only available on certain versions of Vista and 7. If they are on a Mac and they have Time Machine enabled then they can do the same thing. I'm not sure if there is a similar function for linux, but I doubt they would be asking that question if they are using linux.
  4. strategic

    strategic TechSpot Paladin Topic Starter Posts: 1,020

    I just did an experiment with the software I mention above, and noticed multiple copies of files (same name/same directory). Maybe I should have him give it a shot...

    XP PRO
  5. hellokitty[hk]

    hellokitty[hk] Hello, nice to meet you! Posts: 3,433   +143

    I believe thats true. However, when you write new files ("overwritten with a click" is mysterious) to the drive, it may write them where the "deleted" files were, and thus truly overwritten. Even so, you can probably still recover it with the proper software.
  6. raybay

    raybay TS Evangelist Posts: 7,241   +9

    You can do it with specialized software, but it is very time consuming, and usually expensive.
    If his time is worth anything, it is better to do a clean install. There are many private firms who will recover it for $400 on up.
  7. strategic

    strategic TechSpot Paladin Topic Starter Posts: 1,020

    Thanks for the input guys. This will be used for future reference;)
  8. Justin

    Justin TS Rookie Posts: 942

    If it was overwritten with an empty file and little or nothing else has been written to the disk yet, there is a high chance that you can recover it without much difficulty.

    What is the filesystem on the drive in question?
  9. strategic

    strategic TechSpot Paladin Topic Starter Posts: 1,020

    @ Justin, I can guarantee there has been writing done on the HDD, being the only PC hooked to the internet. One thing in their favour though is, I am the only one who defrags the HDD, and haven't done it maybe for at least 1/2 year. It isn't really a 'big' issue, but I'm pretty sure that the software I have on my jumpdrive (UndeletePlus, noted in post#1) showed multiple files with the same name on my HDD when I was tsting the software. I don't know if anyonew out there usesthe same software or not, the file system is NTFS.
  10. red1776

    red1776 Omnipotent Ruler of the Universe Posts: 5,219   +157

Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...