A small file has been replaced by another file which has exactly the same name and size. I want to know if the original file can be recovered.
NOTE: Windows operating system.
-
Do you mean "overwritten" as in you know the same file was written to the same place on the disk, or do you mean you "saved as" with the same filename as an existing file? What application and what filesize?– PaulCommented Feb 12, 2015 at 12:54
-
I'm a pretty big fan of WinUndelete. It's worth a shot, I think. If you've saved a bunch more files to the drive since this incident though, you can kiss it goodbye.– Catatonic27Commented Feb 12, 2015 at 12:56
-
A New file was written on the Old one with the same name and size, the contents of the two file are different but size exactly the same; 970 bytes.– was.chmCommented Feb 12, 2015 at 13:21
-
If you know for a fact that the file was written to the same part of the disk, then there is nothing to be done. Do you know this for a fact, or are you just referring to "save as"?– PaulCommented Feb 12, 2015 at 13:23
-
2Duplicate: superuser.com/questions/515906/…– Ƭᴇcʜιᴇ007Commented Sep 25, 2015 at 20:52
|
Show 2 more comments
1 Answer
The answer is NO. Deleted files can be recovered in some cases. But this can only be done if the file has not been overwritten. Once the file has been overwritten there is no software recovery. There are studies of methods for low level data recovery with the use of electron microscope, but this is very expensive, always leads to the destruction of the entire HDD and is not feasible unless for forensics.
You did not provide much information about the particular file. If you are talking about a document created with one of the popular processing applications (word, open-office, etc) you might have a slim chance of finding a backup copy or old version created automatically by the app.
answered Feb 12, 2015 at 12:51
-
Well just because the file was 'overwritten' according to the folder structure doesn't mean it was overwritten according to the filesystem technically speaking. That data could still be there, and the new file could be saved on a different part of the drive. If the OP hasn't done any or hardly any disk write operations there's a decent chance that the file could be there. Commented Feb 12, 2015 at 12:53
-
I completely agree with you @Catatonic27. I have posted my answer based on the original question that literally says overwritten. I did not want to go into assumptions about what might have happened. Its up to OP to provide more detail Commented Feb 12, 2015 at 12:55
-
Ahh, that makes sense. I assumed based on the context that 'overwritten' mean that Windows asked the OP if they wanted to replace the existing file, etc... Commented Feb 12, 2015 at 12:58
-
Any way I would like to try recovering the old file, maybe it is NOT overwritten physically. Do you suggest any utilities?– was.chmCommented Feb 12, 2015 at 13:43
-
You can try WinHex. It is extremely powerful. But it may take you hours or even days to thoroughly parse the entire hard drive. And you need some skill to use this tool. Commented Feb 12, 2015 at 13:52