Re: recovering overwritten file

Grumpy wrote:
Sorry I am just learning, didn't mean to question your knowledge.

Thanks, that makes it much clearer, and the difference between recovering "deleted" and "overwritten files".

Apparantly professional recovery companies can recover "overwritten" files in some circumstances, maybe the OS's uses the date and time in the file name, but I don't think even this helps in Windows, as the old version of the files apparently just disapears, weird. You would think Windows would just save the new version with same basic name but with new date and time stamp.

Windows is good that its always warns me when about to overwrite a file on a USB flash drive, its a good idea for its easy to forget whats on the flash drive.

So OP Choi is out of luck then, I guess !


"Richard Urban" wrote:

We are talking about over writing here, I believe. (-:

I just ran some tests, using EasyRecovery Professional on my 1 gig SanDisk Mini Cruiser.

1. I created a simple text file and saved to the drive

2. I then altered the original file and resaved.

RESULTS:
The original file was detected and found with a zero byte size. It was listed as deleted. There was no file contents. Recovering showed the same conditions - zero bytes and no text.

3. I altered, saved and then deleted the file. This, of course, over wrote the file yet again.

RESULTS:
The last iteration of the file was found, in a deleted condition, and was able to be recovered by EasyRecovery Professional.

When a file is resaved in an altered condition, the original form is unrecoverable. If the file is just deleted, it is recoverable - as long as saving another file does not overwrite the location.

But, because a thumb drive is so small in capacity, there is a much greater chance that adding, or changing, another file to the drive WILL overwrite part of a deleted file.


--
Regards,

Richard Urban
Microsoft MVP Windows Shell/User
(For email, remove the obvious from my address)

Quote from George Ankner:
If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!



"Grumpy" <Grumpy@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:18DB01B0-7844-44E6-A483-C34ACFCEAEE1@xxxxxxxxxxxxxxxx
Gone in a Flash !

Thats why they call them Flash drives. LOL

Are you sure you can't recover deleted files from USB, SD, etc, Flash drives
and memory, or is it just if you overwrite the file with same name?


"Richard Urban" wrote:

When once a file on a USB key drive is over written, it is gone - for good.
Unlike a magnetic hard drive, there is no residual remnants left for
recovery.

--
Regards,

Richard Urban
Microsoft MVP Windows Shell/User
(For email, remove the obvious from my address)

Quote from George Ankner:
If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!



"Choi" <Choi@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:6D174291-5F3F-44C1-A905-2F346CA433BE@xxxxxxxxxxxxxxxx
I have accidentally overwritten a folder that contained files with the same
names onto my USB key. I was hoping to recover the original files on the
USB
key. I have already tried using Restoration but was not able to find those
files. Does anyone else have ideas? I read one posting on this site that a
person was able to retrieve the original version of an edited photo after
saving over it using Restoration. I thought this should be similar to my
situation but Restoration did not work for me. Any ideas?




Grumpy, no offense, but if by your own admission you don't know much about this stuff, why post.
Briefly, if clusters in use are overwritten, all hope is lost. The Bozo who suggested magnetic media is recoverable after such an exercise neglected to mention attempting involves disassembling the drive and using specialized laboratory technique. Note the erased data on the famous Nixon tapes defied recovery efforts, although admittedly the recording technique is different from that of a hd.
Image recovery programs work extremely well in getting .jpg's off a flash card even if card has been formatted.
I would assume when a file is overwritten, the file's clusters will be overwritten. You do get a warning.
Dave Cohen
.

Relevant Pages

  • RE: Advice regarding servers and Wiping Drives after testing
    ... Using a factor of the drives magnetic density that relates to a +1 ... nullify that overwrite, leaving the last write before that one plainly ... one of the speakers Red and Black connectors. ... Writing all 0's will never prevent against software recovery ...
    (Security-Basics)
  • RE: Peter Gutmann data deletion theaory?
    ... A simple format is nothing like a low level format or a 3* overwrite. ... about data being recovered from decommissioned drives you can do like we ... If you have ever done any form of data recovery, ...
    (Bugtraq)
  • Re: Unclassified Disk "Sanitizers"
    ... you will OVERWRITE it with data from the first sector to the ... wish to pursue other PHYSICAL RECOVERY methods such as the use of Scanning ... >> Read each physical sector of the drive and explain to me how meaningful ... >>> into account various encoding methods used my makers of the drives. ...
    (Security-Basics)
  • RE: Advice regarding servers and Wiping Drives after testing
    ... nullify that overwrite, leaving the last write before that one plainly ... one of the speakers Red and Black connectors. ... Writing all 0's will never prevent against software recovery ... I'd like to see a single case where someone was able to recover data ...
    (Security-Basics)
  • RE: Advice regarding servers and Wiping Drives after testing
    ... recovery process was not shown), in this case a .jpg which was partially ... with 1's and Zeroes we can often get evidence with this new procedure". ... recovered immediately after the overwrite. ... Advice regarding servers and Wiping Drives after testing ...
    (Security-Basics)
Loading