Overwritten files

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Ok first off I don't actually have a problem - I'm just interested to
know....

If you overwrite a file using Windows Explorer (eg you OK the warning
message) is the file usually physically overwritten on the drive? or is the
new one be created somewhere else on the drive and the old one deleted? What
are the chances for data recovery?

 

[joeP]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"CWatters" <colin.watters@pandoraBOX.be> wrote in message
news:u9Lee.82968$Tk7.5147767@phobos.telenet-ops.be...
> Ok first off I don't actually have a problem - I'm just interested to
> know....
>
> If you overwrite a file using Windows Explorer (eg you OK the warning
> message) is the file usually physically overwritten on the drive? or is
the
> new one be created somewhere else on the drive and the old one deleted?
What
> are the chances for data recovery?
>

You can only find out by actually trying. If the FS is NTFS chances are poor
I think. I observe that files which are deleted most recently are the first
to be re-used. That is, their MFT entries are re-used. I haven't yet tested
if the clusters are also used first. In case the latter is false you may
have a chance using a tool that scans for file headers, for example Davory
from www.winhex.com.

--
Joep

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

CWatters <colin.watters@pandoraBOX.be> wrote in message
news:u9Lee.82968$Tk7.5147767@phobos.telenet-ops.be...

> Ok first off I don't actually have a problem
> - I'm just interested to know....

> If you overwrite a file using Windows Explorer (eg you OK the warning
> message) is the file usually physically overwritten on the drive? or is the
> new one be created somewhere else on the drive and the old one deleted?

Yeah, basically.

> What are the chances for data recovery?

Pretty good much of the time.

It really depends on what algorithm is used to decide where the
new file will be written, and how the old file fits into that location
wise. Clearly in some situations where there isnt much free space
and the files are large, the new file may well be stored where the
old file was. But that wouldnt be very common at all with the more
common situation of quite a bit of free space and smaller files.

It isnt hard to test either, just use one of the undeleters and try it.

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"CWatters" <colin.watters@pandoraBOX.be> wrote:

> Ok first off I don't actually have a problem - I'm just interested to
> know....
>
> If you overwrite a file using Windows Explorer (eg you OK the warning
> message) is the file usually physically overwritten on the drive? or is the
> new one be created somewhere else on the drive and the old one deleted?

It depends on the mode the file is opened with. A plain replacement of an
existing file by another, with the same filename, writes the new file elsewhere
and frees the space that was allocated to the previous copy.

> What are the chances for data recovery?

It depends on disk usage and the time that elapsed since the space was
deallocated. Chances to recover decrease as unassigned space is reallocated to
new disk writes.

Successful recovery depends on run time since deallocation, fragmentation of the
erased file (only contiguous files can be fully recovered), and having a
distinguishable header type (e.g. Office OLE files, most formats of image files,
etc.). Such program is my ResQdata, and there are others.

Regards, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Thanks for the replies.