Recover overwritten files?

[strategic]

I had a friend call who told me he accidentally overwrote a file with an empty file (don't ask).
Anyway, he asked if there was anyway to recover it. Until present, I have occasionally undeleted files using " http://undeleteplus.com/ " stand alone version on my jumpdrive. The only thing with this one is, the file was never deleted, it was overwritten (sort of), so I simply replied "it can't be recovered". Now I am starting to think about that.:suspiciou
What are your thoughts?:monkey:
Anyone?

 

[snowchick7669]

From my understanding you are correct. When deleted, it is just flagged to be over written. But once it has been overwritten then there's something else in its place.

Maybe forensic type software can delve deeper and locate parts of the file? Not sure, but I have heard that you need to overwrite a file a certain number of times before it is fully gone.

 

[LNCPapa]

What operating system are they using? On Windows Vista/7 there is the previous versions option if shadow copies are enabled - this is only available on certain versions of Vista and 7. If they are on a Mac and they have Time Machine enabled then they can do the same thing. I'm not sure if there is a similar function for linux, but I doubt they would be asking that question if they are using linux.

 

[strategic]

Not sure, but I have heard that you need to overwrite a file a certain number of times before it is fully gone.

I just did an experiment with the software I mention above, and noticed multiple copies of files (same name/same directory). Maybe I should have him give it a shot...

What operating system are they using?

XP PRO

 

[hellokitty[hk]]

From my understanding you are correct. When deleted, it is just flagged to be over written. But once it has been overwritten then there's something else in its place.

I believe thats true. However, when you write new files ("overwritten with a click" is mysterious) to the drive, it may write them where the "deleted" files were, and thus truly overwritten. Even so, you can probably still recover it with the proper software.

 

[raybay]

You can do it with specialized software, but it is very time consuming, and usually expensive.
If his time is worth anything, it is better to do a clean install. There are many private firms who will recover it for $400 on up.

 

[strategic]

Thanks for the input guys. This will be used for future reference

 

[Justin]

If it was overwritten with an empty file and little or nothing else has been written to the disk yet, there is a high chance that you can recover it without much difficulty.

What is the filesystem on the drive in question?

 

[strategic]

@ Justin, I can guarantee there has been writing done on the HDD, being the only PC hooked to the internet. One thing in their favour though is, I am the only one who defrags the HDD, and haven't done it maybe for at least 1/2 year. It isn't really a 'big' issue, but I'm pretty sure that the software I have on my jumpdrive (UndeletePlus, noted in post#1) showed multiple files with the same name on my HDD when I was tsting the software. I don't know if anyonew out there usesthe same software or not, the file system is NTFS.

 

[red1776]

believe it or not, i have had great success with recently deleted and some overwritten files with this free tool.
http://www.recuva.com/download