How to recover a REPLACED (not DELETED) file

self

[rudy45]

Is there any way of recovering the contents of a file over which new contents was saved for the same file name? Existing file "A" is on a computer in a given folder. User opens an email attachment with another file "A" attached to it, and wishes to save the attachment to that folder. Of course, the user is asked if replacement is desired. User ACCIDENTALLY says "yes" and file is replaced, wiping out the original file "A." Question: How, if at all, can the old contents of file "A" be recovered? I don't think recycle bin is an option, because it wasn't deleted. Or is it? How about shareware utility? Of course no backup copy is available. Thanks.

[quantim]

If you have existing software that can read the disk it is possible if the second file did not physically overwrite the original. It is possible the 2nd file was written in a different sector preserving the first.

I guess I would rename the 'overwrite' and the try to recover the original, just my 2 cents.

And obviously every keystroke including refreshing this page could overwrite the deleted file, good luck!

[butternut_squash_bisque]

I think you're screwed. I use "save as" and rename it as a sub-file, so it doesn't overwrite the first, until I can decide to get rid of the initial file.

If it's in a different sector, maybe you can recover it. But I've never been able to do that.

[rudy45]

Thanks; what utility can I use?

[jdm]

How about system restore? I've gotten some stuff back that way.

In Windows XP, you get to System Restore by clicking the Start button, then going to Help and Support and you should see the System Restore option.

Let me know if that works.

[djf]

I'm not sure how the system handles the FAT entries these days. Used to be he would allocate the new file, create a new FAT entry, and mark the original FAT entry as deleted.
He must have some kind of free space chain pointer somewhere also. But if none of the original clusters have been overwitten, it might still be there.

[Condor51]

• Your original file "A" which you saved to folder "x" is history. It has been over written by subsequent file "A". The original is now in computer heaven (joke)

• HOWEVER, all might not be lost. Depending on your mail program and settings, the original email with file "A" may still be there - like in your inbox, or sub folder for that particular 'client' when you receivied the the first file "A".

• Do a search by date of all your email folders. If the original is still there, save with a new file name, like; "A_orig.xxx"

I know what you're going through as I get numerous attachments with the same name - it stinks.

Good luck

[rudy45]

Hi, she has a restore point from 12:30 am today, which is before she wiped out the file.

Problem is, according to the documentation, the restore leaves documents UNaffected. This isn't what I want. I DO want the file in the condition it was at checkpoint time. Is there a way to tell system restore that I DO want the earlier file? Thanks.

[butternut_squash_bisque]

Do you have Norton 'Ghost' installed and working? You can select a point in time to return the HD to, and perhaps that will let you get the original file back.

[rudy45]

Yes, thanks. We do have the email file 'A', but that doesn't help. We're trying to get to the original file 'A' that she overwrote using the email version. I'm going to try system restore, but please see my other post regarding my concern that existing documents will be left as-is (which isn't what I want). Thanks.

[butternut_squash_bisque]

I'm thinking that way, too.

[sure_fine]

just a shot in the dark, but can you get whoever sent the original mail to send it again?

[rudy45]

Hi, thanks. Unfortunately, the issue is not with the email version of the file. The issue is that the email version wiped out the resident hard disk version. That hard disk version is what I'm trying to recover. But thanks anyway.

[rudy45]

OK, I tried system restore, and it failed because "no changes were made." I presume that it is mane no SYSTEM changes were made, i.e. configuration settings, installation/deletion of software etc. In my case, though, we're trying to recover an earlier version of a changed Word document.

It sounds as though system restore is useless as far as recovering data changes, unfortunately. Thanks.

[rudy45]

She doesn't have Norton Ghost installed. However, here's what I'm wondering. Does Ghost have the ability to recover DATA FILES from an earlier restore point? Will it work even though it (Ghost) wasn't installed at the time of that restore point? Maybe I can install Ghost and tell it to get the document from the restore point? Thanks.

[ken in texas]

Restore Points do not store your data files.

The longer you use this computer the more likely that the file you want to recover will be overwritten, if it hasn't already been destroyed..

You need to shut that computer down and find a local computer geek that can use a seperate utility to try and extract the file from the sectors where it was stored.

[butternut_squash_bisque]

Ghost has to be installed and functioning to recover files. It basically takes an image of your HD, and can restore it to that point in time. Ghost doesn't recover individual files, but rather the entire HD.

[rudy45]

Thanks. So, Ghost is USELESS to us in this case, because the file replacement happened when Ghost was absent from the system?

What is the difference between Ghost and Goback? Is the former a file recovery, vs. disk recovery tool? Thanks.

[butternut_squash_bisque]

Norton Go Back:
http://www.symantec.com/home_homeoffice/products/backup_recovery/ngb40/index.html

Norton Ghost:
http://www.symantec.com/home_homeoffice/products/backup_recovery/ghost10/index.html