?
Solved

Overwritten files - is there hope?

Posted on 2007-07-30
15
Medium Priority
?
714 Views
Last Modified: 2010-04-27
Hi Guys,

People have covered this one on a number of occasions before, but i'll ask the question anyway.

I've just had to install a new workstation for an estimating product our development team use - however the installer has inadvertantly overwritten the current database files. I thought, great, i'll go for the backup tape, only to find that the data had not been backed up (darn). Is there any way at all to restore overwritten files ?  If so, what programs can you recommend - most programs will only restore deleted files, not accidentally overwritten.

Thanks for your help
0
Comment
Question by:CSSROSS
  • 4
  • 4
  • 2
  • +5
15 Comments
 
LVL 24

Expert Comment

by:mankowitz
ID: 19597436
Overwritten files are gone. Ungettable. Here's why. When you delete a file, all you really do is tell the disk that the space has become available. To give a physical example, it's like removing someone's name from the phonebook. The house still exists, but there's no way to find them.

When you overwrite a file, the file is completely gone. The actual data of the file is replaced with new data. In the house analogy, this is like when the house is destroyed and a highway is put in its place. The house no longer exists.

Exceptions may include journalling filesystems and WORM disks, where the original data has not been overwritten. But.... for a regular hard drive, no dice.
0
 
LVL 25

Expert Comment

by:kode99
ID: 19597535
There may be some hope depending on exactly how the file got overwrote.

If the file was actually modified you are out of luck unless you want to pay for a real serious professional recovery.  It is actually possible just very expensive and not something that just any professional service may even do.  Kinda like re-assembling a massive puzzle that is all black,  in the dark.  Very likely not worth the effort.

If the program re-created a database as a new file and slapped it on top then the original file could be there like a deleted file would be. All depends on what the install actually did.

Here's a couple programs you can try,

http://www.active-undelete.com/

http://www.ontrackdatarecovery.com/file-recovery-software/

Most have these 'demo' versions that will show you the files that it may be able to retrieve.  To actually get the files you have to pay.

Basically nothing to lose checking with a demo.  If you find a file that matches the name and size then it might be worth buying it.  Though if the system is in use that reduces the likelyhood of success.

0
 
LVL 32

Expert Comment

by:r-k
ID: 19598213
In what sense did the installer overwrite the database? If you mean that you accidentally formatted the disk (or deleted existing files in some way) and then installed new files, then there may still be hope in the sense that the new files may not have been written over the exact same blocks occupied by the old database.

In any case a good program to try is the free trial version of GetDataBack:

 http://www.runtime.org/gdb.htm

There are separate versions for NTFS and FAT.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
LVL 93

Expert Comment

by:nobus
ID: 19598576
if you need those files, try contacting a
0
 
LVL 93

Expert Comment

by:nobus
ID: 19598580
if you need those files, try contacting a recovery Cy with your problem (no recovery, no fee) :

http://www.gillware.com/                                    data recovery Company
http://www.drivesavers.com/services/estimates.html                     "           "           "
0
 
LVL 27

Expert Comment

by:michko
ID: 19600007
This is the best I've seen so far.  I've seen this program recover data from a hard drive after a full format.
http://www.restorer2000.com/
0
 
LVL 3

Expert Comment

by:Circleblue
ID: 19608088
Try On-Track's Easy Recovery software.  You can use a trial version to test it out.

http://www.ontrackdatarecovery.com/file-recovery-software/

Cheers,

Brian
0
 
LVL 7

Expert Comment

by:ComputerBeast
ID: 19636866
Hello CSSROSS

I am afraid that you data is lost, as the basic of data recovery says that overwritten files cannot be recovered back. If you have overwritten a file name or data with in it, you cannot get it back because you have added some new data over the old one.

Its impossible to recover back. The data recovery software will give you back the files but not the data which you require. Its something like erasing a sentence with eraser and then expecting to get it back. Its impossible, isn't it ?

 I would suggest to again search for the backup files on your system otherwise ITS GONE!
0
 
LVL 27

Expert Comment

by:michko
ID: 19637801
ComputerBeast - please do some more research into data recovery.  When data is "deleted" the pointer to where that data is is deleted, the data itself is still on the hard drive.  When data is "overwritten" it isn't always physically overwritten on the hard drive, the new data may have been written in a different location.  Even if the data was physically written over, many data recovery programs can still find the underlying (original) data.  One way data recovery programs work is to scan the hd sector by sector, then try to put the pieces together.  Some better ones can even look at data that has been written over a few times.  Typically data can still be recovered until the physical addresses where that data resides have been overwritten two or three times.  The federal standard for data erasure is to overwrite each sector of a hard drive seven times.  If you'll read my post, I stated the program I suggested had recovered data (word docs, excel, etc) from a hard drive that had been FULLY formatted.  That means a complete overwrite of the entire hard drive, and I was still able to pull the data off.  And, this program is still not as good as the ones professional data recovery services use.  Bottom line - data IS recoverable after is has been overwritten.  

michko
0
 
LVL 7

Accepted Solution

by:
ComputerBeast earned 1000 total points
ID: 19643691
Permanently deleted files are recoverable and also the file and folders from the formatted partitions. In the case of formatted partitions, the recovery becomes possible when the files have been allocated on the same structure that means same location in Lehman words. Otherwise it will also become difficult for data recovery software to recover from formatted drives, if the files get allocated to different location of the drive after the partition is formatted.

As far as overwritten data recovery is concerned, its a bit tough process. There are 2 possibilities which come up in this scenario:

1. If the overwritten file gets saved on the same location (sector of the drive) - possibilities are that these files data can be recovered. An overwritten file is one whose name has been overwritten / has been replaced by the same name file, not its sectors, then the recovery possibilities are there by the datarecovery software, as it will then scan the sectors of the drive and then recover those files.

2. If the overwritten file is saved on different locations - Possibilities are minimal to retrieve that file data.

Modern operating systems create copies of deleted files in unallocated sectors, temp directories, remapped blocks etc, but an overwritten sector can be recovered under examination by sophisticated microscopes only.

As from the overwritten data recovery studies, literature on the use of Magnetic Force Scanning Tunneling Microscopy (MFM or STM) says that main emphasis is not on to recover the overwritten data but to test and improve the design of drive read/write heads. If two photos have been overwritten by mistake, then the developed micro-photograph will display 6 bits in one photo and 8 in another while the recovery process. That means something is still missing...

I never intended to disagree with anyone but was only informing CSSROSS that its near to impossible to recover back overwritten data. But yes possible by some data recovery service providers who can recover that data with STM facilities, which less of firms claim to do so.

Agreeing with Mankowitz, the overwritten data is difficult to recover. As a program was suggested, I tried the same but was not able to recover the original data. I created a 11111.doc file and typed some sentences and saved it in C drive. Created the same name file in D drive and this file was blank. Replaced this file in C drive with D drives file and then ran the data recovery program, the software did recovered the file but the file was empty for content, means it recovered the last replaced/overwritten file and not the original/first file.

Now we can wait for CSSROSS to reply back and make all of us aware of, if he/she could recover the overwritten data. If yes, then we all will be really happy.....

Cheers!!!!
ComputerBeast
0
 
LVL 27

Assisted Solution

by:michko
michko earned 1000 total points
ID: 19645051
ComputerBeast - No problem.  I certainly didn't take offense, experts disagree (or have different opinions if you prefer) occasionally.  :)  I just read your initial post as "this is impossible" and wanted the poster to understand that their data may be recoverable.  Not definitely, but possibly.  Very good information in your last post, I like your photo analogy, and your own experiment shows you're not taking anyone's word for it.  BTW - welcome to EE.  

CSSROSS - just another FYI, if the data is critical, you may want to consider a data recovery company.  I've heard very good things (on this site and others) about this company:
http://www.gillware.com/customers.php
As far as I know, they still charge $400 for recovery, $700 if they have to use the clean room.  Essentially, if you can't recovery the data yourself, you have to determine if the data is worth the cost of professional recovery services.  They also have a "no-fee" policy if they aren't able to recover your data.

Best of luck.

michko
0
 
LVL 7

Expert Comment

by:ComputerBeast
ID: 19651482
Its ok michko....:-)

Good Luck to CSSROSS for data recovery...
0
 

Author Comment

by:CSSROSS
ID: 19745745
Sorry for the long delay in response but the network has been demanding attention.
Like most of you Iam not holding my breath for this data but the disk is now awaiting a Data recovery center to advise if they can recover the data for me.

If all is good I would like to split points between ComputerBeast and Michko.

Thanks all
0
 
LVL 27

Expert Comment

by:michko
ID: 19745789
Best of luck.  Thanks for the assist.

michko
0
 
LVL 7

Expert Comment

by:ComputerBeast
ID: 19761087
Thanks CSSROSS and Good Luck
0

Featured Post

 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article shows how to use a free utility called 'Parkdale' to easily test the performance and benchmark any Hard Drive(s) installed in your computer. We also look at RAM Disks and their speed comparisons.
"Any files you do not have backed up in at least two [other] places are files you do not care about."
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
Suggested Courses

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question