Recover Overwritten File Contents – The Smart Way To Retrieve Your Data

by Rod Dunne on November 3, 2010

in Data Recovery

Recover Overwritten File Contents - The Smart Way To Retrieve Your Data
  • Share
  • Share

The chances of being able to recover overwritten file contents can vary widely. While data recovery programs can usually be quite successful at deleted file recovery, recovering overwritten files requires an almost forensic approach to retrieving fragments of your documents and can therefore prove to be one of the more complex PC maintenance tasks.

Background

Your files are stored to the hard drive memory as data clusters around the disk memory. Most recovery tools will be able to restore deleted files by reading the memory and locating these clusters. However, if the document is overwritten (e.g. by saving a new version with the same exact filename) then there is a strong possibility of the  clusters being fully or partially overwritten too.

Using Data Recovery Software To Identify Overwritten Files

On a positive note, there is a chance of retrieving the documents due to the fact that all documents leave a data shadow behind on the memory. A data shadow is basically an electronic footprint of versions of the document(i.e. fragments of clusters belonging to different saved versions of your file).It is possible to use recovery software to try to recover overwritten files by identifying these shadows/clusters on the disk. This is very different from recovering deleted files where the original clusters and index references in the file allocation table will still exist.

While there is a vast amount of retrieval tools available on the market, not all of them are capable of identifying fragments belonging to overwritten files. For this reason, make sure the product you purchase explicitly states that it can recover overwritten file contents. In addition, you should only install the product on a secondary partition (separate from the one containing your overwritten files) in order to avoid the newly stored application files overwriting your lost documents, destroying your chances of being able to retrieve deleted files.

Sourcing Earlier Versions Of Documents

If it is sufficient for you to get an earlier version of your documents then you can of course resort to using the temp files (i.e.tmp files) located in the same directory as your document. You can rename these files with the correct file extension in order to open the modern applications, but they obviously will not have the latest changes you were making.

A less obvious solution would be to recover deleted files from recycle bin folders if the document was deleted beforehand.

Data Forensics Experts

As a last resort, data recovery experts or data forensic experts will have the requisite software applications that can recover overwritten file contents for you from a hard drive. Best results will be achieved if the hard drive has not been used for running applications or saving new documents (as this will potentially overwrite lost clusters/shadows).

Previous post:

Next post: