Lost folder

  • Thread starter Thread starter Joachim Harter
  • Start date Start date
J

Joachim Harter

Hello,

is it possible to recover files (or at least parts of them) that were
replaced by other files having the same name? I'm running Windows 2000,
the HDD is NTFS-formatted.

As the new files are smaller than 2 kB whereas the ones replaced were at
least some megabytes, I strongly suppose that there are remainders which
could be recovered.

I've already tried out demo versions of recovery software (Ontrack Easy
Recovery, Active Uneraser) capable of listing all the deleted files, but
I couldn't reach those partly overwritten ones.

Can anyone suggest a method for recovery (apart from sending my HDD to a
specialist's laboratory?)


Thanks a lot in advance,
Joachim



The background of my data loss, if it is of interest --
I updated my Mozilla mail client today and noticed that the local mail
folders weren't adopted from the previous version (as they were at any
previous update). When setting the path for the local folders manually,
Mozilla created new, almost empty files instead of using the existing
ones. Unfortunately, the last backup was more than a week ago...
 
Joep said:
It's difficult, what you want, you can not track the files through FATs, the
MFT or directories because of the files being re-created. What kind of files
were they, anyway?
Click to expand...

The lost files contained sequentially written emails (from
Mozilla/Netscape), i.e. mainly plain text. I'll give Winhex a try, as
you recommended and post again when I have results.

Thanks so far,

Joachim
 
If you delete something and want to recover it the most important
thing to do is to STOP WRITING to that file system. Any new stuff
that gets written can overwrite parts of the deleted file(s) and make
complete recovery impossible.

So... if you have any work in progress to save, put that elsewhere (on
floppies, a file server, ftp, etc.) and shut down. If you don't have
anything that needs saving maybe even just cut power at once.

Then run some recovery utility from it's own boot disk(s) or CD.
 
Hello,

Searching with Winhex (for the most important email addresses), I could
recover some of the lost data up to now. Unfortunately, it appears that
wide parts of the files' former disk space were already overwritten even
before I had noticed the problem.

Anyway, many thanks indeed to Joep and Boris for your hints and
warnings.


Regards,
Joachim
 
To avoid this type of mishap, I have installed a second hard disk
in my machine. Each morning the startup process copies all
important data files (e.g. email files) to one of 20 rotating folders
on that disk. This gives me excellent protection, at very little cost.
 
It's difficult, what you want, you can not track the files through FATs, the
MFT or directories because of the files being re-created. What kind of files
were they, anyway?

In general, if you're after 'text' I'd suggest a tool like Winhex
(www.winhex.com) and use it to search the disk for text phrases contained in
the lost files. Once such a phrase is located, select the area 'surrounding'
it and copy that to a file.

Now many file formats include much more than ascii characters, there are
(free) tools available that can strip all non-ascii characters from the
files you created by copying blocks of the disk.

Task will be easier if the disk is not fragmented.
 
Back
Top