Overwritten files - is there hope?

Hi Guys,

People have covered this one on a number of occasions before, but i'll ask the question anyway.

I've just had to install a new workstation for an estimating product our development team use - however the installer has inadvertantly overwritten the current database files. I thought, great, i'll go for the backup tape, only to find that the data had not been backed up (darn). Is there any way at all to restore overwritten files ?  If so, what programs can you recommend - most programs will only restore deleted files, not accidentally overwritten.

Thanks for your help
CSSROSSAsked:
Who is Participating?
 
ComputerBeastConnect With a Mentor Commented:
Permanently deleted files are recoverable and also the file and folders from the formatted partitions. In the case of formatted partitions, the recovery becomes possible when the files have been allocated on the same structure that means same location in Lehman words. Otherwise it will also become difficult for data recovery software to recover from formatted drives, if the files get allocated to different location of the drive after the partition is formatted.

As far as overwritten data recovery is concerned, its a bit tough process. There are 2 possibilities which come up in this scenario:

1. If the overwritten file gets saved on the same location (sector of the drive) - possibilities are that these files data can be recovered. An overwritten file is one whose name has been overwritten / has been replaced by the same name file, not its sectors, then the recovery possibilities are there by the datarecovery software, as it will then scan the sectors of the drive and then recover those files.

2. If the overwritten file is saved on different locations - Possibilities are minimal to retrieve that file data.

Modern operating systems create copies of deleted files in unallocated sectors, temp directories, remapped blocks etc, but an overwritten sector can be recovered under examination by sophisticated microscopes only.

As from the overwritten data recovery studies, literature on the use of Magnetic Force Scanning Tunneling Microscopy (MFM or STM) says that main emphasis is not on to recover the overwritten data but to test and improve the design of drive read/write heads. If two photos have been overwritten by mistake, then the developed micro-photograph will display 6 bits in one photo and 8 in another while the recovery process. That means something is still missing...

I never intended to disagree with anyone but was only informing CSSROSS that its near to impossible to recover back overwritten data. But yes possible by some data recovery service providers who can recover that data with STM facilities, which less of firms claim to do so.

Agreeing with Mankowitz, the overwritten data is difficult to recover. As a program was suggested, I tried the same but was not able to recover the original data. I created a 11111.doc file and typed some sentences and saved it in C drive. Created the same name file in D drive and this file was blank. Replaced this file in C drive with D drives file and then ran the data recovery program, the software did recovered the file but the file was empty for content, means it recovered the last replaced/overwritten file and not the original/first file.

Now we can wait for CSSROSS to reply back and make all of us aware of, if he/she could recover the overwritten data. If yes, then we all will be really happy.....

Cheers!!!!
ComputerBeast
0
 
mankowitzCommented:
Overwritten files are gone. Ungettable. Here's why. When you delete a file, all you really do is tell the disk that the space has become available. To give a physical example, it's like removing someone's name from the phonebook. The house still exists, but there's no way to find them.

When you overwrite a file, the file is completely gone. The actual data of the file is replaced with new data. In the house analogy, this is like when the house is destroyed and a highway is put in its place. The house no longer exists.

Exceptions may include journalling filesystems and WORM disks, where the original data has not been overwritten. But.... for a regular hard drive, no dice.
0
 
kode99Commented:
There may be some hope depending on exactly how the file got overwrote.

If the file was actually modified you are out of luck unless you want to pay for a real serious professional recovery.  It is actually possible just very expensive and not something that just any professional service may even do.  Kinda like re-assembling a massive puzzle that is all black,  in the dark.  Very likely not worth the effort.

If the program re-created a database as a new file and slapped it on top then the original file could be there like a deleted file would be. All depends on what the install actually did.

Here's a couple programs you can try,

http://www.active-undelete.com/

http://www.ontrackdatarecovery.com/file-recovery-software/

Most have these 'demo' versions that will show you the files that it may be able to retrieve.  To actually get the files you have to pay.

Basically nothing to lose checking with a demo.  If you find a file that matches the name and size then it might be worth buying it.  Though if the system is in use that reduces the likelyhood of success.

0
Improved Protection from Phishing Attacks

WatchGuard DNSWatch reduces malware infections by detecting and blocking malicious DNS requests, improving your ability to protect employees from phishing attacks. Learn more about our newest service included in Total Security Suite today!

 
r-kCommented:
In what sense did the installer overwrite the database? If you mean that you accidentally formatted the disk (or deleted existing files in some way) and then installed new files, then there may still be hope in the sense that the new files may not have been written over the exact same blocks occupied by the old database.

In any case a good program to try is the free trial version of GetDataBack:

 http://www.runtime.org/gdb.htm

There are separate versions for NTFS and FAT.
0
 
nobusCommented:
if you need those files, try contacting a
0
 
nobusCommented:
if you need those files, try contacting a recovery Cy with your problem (no recovery, no fee) :

http://www.gillware.com/                                    data recovery Company
http://www.drivesavers.com/services/estimates.html                     "           "           "
0
 
michkoCommented:
This is the best I've seen so far.  I've seen this program recover data from a hard drive after a full format.
http://www.restorer2000.com/
0
 
CircleblueCommented:
Try On-Track's Easy Recovery software.  You can use a trial version to test it out.

http://www.ontrackdatarecovery.com/file-recovery-software/

Cheers,

Brian
0
 
ComputerBeastCommented:
Hello CSSROSS

I am afraid that you data is lost, as the basic of data recovery says that overwritten files cannot be recovered back. If you have overwritten a file name or data with in it, you cannot get it back because you have added some new data over the old one.

Its impossible to recover back. The data recovery software will give you back the files but not the data which you require. Its something like erasing a sentence with eraser and then expecting to get it back. Its impossible, isn't it ?

 I would suggest to again search for the backup files on your system otherwise ITS GONE!
0
 
michkoCommented:
ComputerBeast - please do some more research into data recovery.  When data is "deleted" the pointer to where that data is is deleted, the data itself is still on the hard drive.  When data is "overwritten" it isn't always physically overwritten on the hard drive, the new data may have been written in a different location.  Even if the data was physically written over, many data recovery programs can still find the underlying (original) data.  One way data recovery programs work is to scan the hd sector by sector, then try to put the pieces together.  Some better ones can even look at data that has been written over a few times.  Typically data can still be recovered until the physical addresses where that data resides have been overwritten two or three times.  The federal standard for data erasure is to overwrite each sector of a hard drive seven times.  If you'll read my post, I stated the program I suggested had recovered data (word docs, excel, etc) from a hard drive that had been FULLY formatted.  That means a complete overwrite of the entire hard drive, and I was still able to pull the data off.  And, this program is still not as good as the ones professional data recovery services use.  Bottom line - data IS recoverable after is has been overwritten.  

michko
0
 
michkoConnect With a Mentor Commented:
ComputerBeast - No problem.  I certainly didn't take offense, experts disagree (or have different opinions if you prefer) occasionally.  :)  I just read your initial post as "this is impossible" and wanted the poster to understand that their data may be recoverable.  Not definitely, but possibly.  Very good information in your last post, I like your photo analogy, and your own experiment shows you're not taking anyone's word for it.  BTW - welcome to EE.  

CSSROSS - just another FYI, if the data is critical, you may want to consider a data recovery company.  I've heard very good things (on this site and others) about this company:
http://www.gillware.com/customers.php
As far as I know, they still charge $400 for recovery, $700 if they have to use the clean room.  Essentially, if you can't recovery the data yourself, you have to determine if the data is worth the cost of professional recovery services.  They also have a "no-fee" policy if they aren't able to recover your data.

Best of luck.

michko
0
 
ComputerBeastCommented:
Its ok michko....:-)

Good Luck to CSSROSS for data recovery...
0
 
CSSROSSAuthor Commented:
Sorry for the long delay in response but the network has been demanding attention.
Like most of you Iam not holding my breath for this data but the disk is now awaiting a Data recovery center to advise if they can recover the data for me.

If all is good I would like to split points between ComputerBeast and Michko.

Thanks all
0
 
michkoCommented:
Best of luck.  Thanks for the assist.

michko
0
 
ComputerBeastCommented:
Thanks CSSROSS and Good Luck
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.