Results 1 to 5 of 5
  1. #1
    3 Star Lounger
    Join Date
    Feb 2001
    Posts
    369
    Thanks
    2
    Thanked 1 Time in 1 Post

    Undelete query not covered in previous posts

    I've just accidentally overwritten 4 files with previous versions with my sync prog - older versions vvere from different computer. Tried lots of undelete utilities, but none can seem to find previous versions in same folder. When a file of the same name is copied or moved into a folder, does windows overwrite the original in the same disc space, or not? If not, is there any way to recover this previous version?

    Thanks

  2. #2
    Platinum Lounger
    Join Date
    Jan 2001
    Location
    Quedgeley, Gloucester, England
    Posts
    5,333
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: Undelete query not covered in previous posts

    If we consider the FAT file system here, the undelete utilities hope to find the original directory entry in the File Allocation Table (the first character of the filename is overlaid with the Greek lower-case sigma character, to indicate that it can be reused). Depending on where it is located in the directory, it may or may not have been reused and thus overwritten by the directory entry for a new file.

    If the old directory entry is still available, the undelete utility will be able to get information about where the data for the file started and how long it was. But the data areas have now been freed up. These data areas may also have been overwritten, in whole or in part, by the data from a new file. I'll leave out the complications of the FAT table pointers...

    So, you would probably be able to reconstruct a few files if they were just deleted and no new files had been created. But your chances of finding the directory entries and the data areas for the original files available after new files have been added is not large.

    Here is where you have to resort to the comprehensive backup which you took moments earlier...

    NTFS is much more complicated, but similar principles apply. If you've added more files after having deleted some, your chance of recovering the original files is low.

    Sorry, but that's the way things work. I suspect you wouldn't even find the original files in the recycle bin, because you haven't gone through the standard Delete process. But look anyway.

    John
    <font face="Script MT Bold"><font color=blue><big><big>John</big></big></font color=blue></font face=script>

    Ita, esto, quidcumque...

  3. #3
    3 Star Lounger
    Join Date
    Feb 2001
    Posts
    369
    Thanks
    2
    Thanked 1 Time in 1 Post

    Re: Undelete query not covered in previous posts

    Sorry John, maybe I wasn't clear - the names have been re-used - the previous versions having the same name as the new versions which were accidentally replaced. Obviously these 4 files (the old versions) are new, but I've not created anything else on that drive since. All the undelete utilities I've seen list existing files as well as deleted ones, and I can't see any files where there are 2 copies with the same name, or with the first character changed.

  4. #4
    Platinum Lounger
    Join Date
    Jan 2001
    Location
    Quedgeley, Gloucester, England
    Posts
    5,333
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: Undelete query not covered in previous posts

    Mark

    From what you say it seems fairly likely that the four "new" names simply replaced the four (identical) "old" names, thus wiping out any information about the start location and size of each of the "old" files. Since the new files are probably similarly sized to the old files (wild guess!), it seem unlikely that you could even find any of the old data by doing a sector scan, since the new data has probably overwritten what was there before.

    It looks as though you won't be successful -- sorry.

    John
    <font face="Script MT Bold"><font color=blue><big><big>John</big></big></font color=blue></font face=script>

    Ita, esto, quidcumque...

  5. #5
    Super Moderator
    Join Date
    May 2002
    Location
    Canberra, Australian Capital Territory, Australia
    Posts
    5,055
    Thanks
    2
    Thanked 417 Times in 346 Posts

    Re: Undelete query not covered in previous posts

    Hi John,

    From what I recall with FAT systems, when a new file is copied over an old one, the new data are writtent to different ares of the disk, unless the disk is full. If so, recovery chances are better than you suggested and, if nothing new has been written to the disk, could be quite good. Once you've found the first sector for a given file, the FAT for that sector will still point to the location of the next sector that previously belonged to the same file.

    Cheers
    Cheers,

    Paul Edstein
    [MS MVP - Word]

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •